Privacy Policy

Effective date: to be set on adoption.

1. The Short Version

This Privacy Policy explains, in plain language, what personal information we collect when you use Your Pocket Planner, why we collect it, who we share it with, how long we keep it, and the choices you have. The longer sections that follow give the legal detail. If anything below is unclear, contact our Privacy Officer (Section 16).

In summary:

• Your Pocket Planner is a Canadian financial planning and education tool. We collect the information you give us so we can build your personalized plan and answer your questions about it.
• We do not sell your personal information. We do not share it with advertisers. We do not use your information to train artificial intelligence models offered by third parties.
• We ask for your consent in separate buckets, not one bundled box, so you can opt in to some uses and not others.
• You can access, correct, or delete your information at any time, subject to legal recordkeeping obligations.
• We are accountable to you. If something goes wrong, you have a clear path to raise it with us, and ultimately with Canadian privacy regulators.

2. Who We Are and What This Policy Covers

Your Pocket Planner is a Canadian financial planning and education service. We help individuals understand their household finances, build a personalized plan, and answer follow-up questions. We do not give personalized investment, securities, or trade recommendations. We do not manage money on your behalf. We do not hold ourselves out as a "Financial Planner" or "Financial Advisor" under provincial title-protection legislation.

This Privacy Policy applies to personal information that the Company collects, uses, discloses, retains, and disposes of through:

• Our website at yourpocketplanner.ca and related subdomains.
• Our web application at app.yourpocketplanner.ca.
• Any email, chat, or messaging channels through which you contact us.
• Any document you upload to us or paste into our application.

It does not cover personal information you share with third parties whose products you may use alongside ours (for example, your bank, your existing investment advisor, or a tax preparer). Their privacy notices govern that information.

The Company is responsible for personal information in its custody and under its control, including information that is processed on our behalf by service providers. We comply with the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, Alberta's Personal Information Protection Act (PIPA AB) and British Columbia's Personal Information Protection Act (PIPA BC). Where any of these regimes imposes a stricter obligation than the others, we comply with the stricter standard for the individuals it protects.

Quebec residents. Until our Quebec compliance posture under the Act respecting the protection of personal information in the private sector (Law 25) is reviewed by counsel, the Service is not offered to Quebec residents and we do not solicit Quebec residents. If you are a Quebec resident and have created an account, please contact our Privacy Officer.

3. Information We Collect

We follow the principle of data minimization. We collect only what we need to provide the service, support your account, comply with law, and operate as a business. The categories below describe the information we collect today (V1 of the product). New categories will be added to this Policy before any new collection begins.

3.1 Account and identity information

• Your name and the email address you use to sign up.
• A password (stored only as a salted hash; we cannot read it).
• Your province of residence (used to apply the correct tax and benefit rules and to confirm that the service is available to you).
• Your age or date of birth.

3.2 Financial planning information you provide

All financial planning information in V1 is entered manually by you. We do not connect to your bank, your investment accounts, or the Canada Revenue Agency. Categories include:

• Income: employment, self-employment, pension, government benefits, investment income, rental income, support payments, windfalls.
• Assets: cash savings, registered accounts (RRSP, RRIF, TFSA, FHSA, RESP, RDSP, LIRA / LIF, foreign retirement assets), non-registered investments, real estate, vehicles, business interests.
• Debts: mortgages, lines of credit, credit card balances, student loans, personal loans, support obligations.
• Household and family details: marital status, partner financial information (where you provide it), dependent children, support arrangements, custody percentages, disability tax credit status.
• Insurance: life, disability, critical illness, long-term care, group benefits, coverage amounts, beneficiaries (where you provide them).
• Goals and preferences: target retirement age, lifestyle goals, risk tolerance, time horizons, charitable giving plans.
• Estate planning context: existence and date of a will, powers of attorney, named executors, trustees, beneficiaries (where you provide them).

3.3 Documents you upload

If you choose to upload documents to help us understand your situation (for example, a Notice of Assessment, a pension statement, an insurance policy), we extract the data points relevant to your plan. We treat the underlying document as Sensitive personal information.

3.4 Conversations with our planning assistant (N.I.E.L.)

When you chat with our planning assistant, we collect the messages you send, the assistant's responses, and any structured updates the assistant proposes (which you confirm before they are applied to your plan). See our AI Use Disclosure for the full description of how AI is used.

3.5 Customer support communications

Emails, support tickets, and any other messages you send us are stored so we can respond and resolve the issue. We may also keep an internal note summarizing the resolution.

3.6 Technical and device information

When you visit the website or use the application, we automatically collect:

• IP address (truncated where feasible).
• Device type, operating system, and browser version.
• Approximate location derived from your IP address (city / region).
• Session timestamps, pages or screens viewed, and feature usage events.
• Crash logs and error reports.

See our Cookie Policy for the cookies and similar technologies we use.

3.7 Information we do NOT collect in V1

• Your Social Insurance Number (SIN).
• Bank account numbers or banking credentials.
• Brokerage account credentials or login information.
• Direct connections to the Canada Revenue Agency.
• Any biometric information (face scans, fingerprints, voice prints) for identity verification.

If we expand the product to include connected accounts (Phase 2) or Canada Revenue Agency integration (Phase 3), we will update this Policy and obtain fresh, granular consent before any new collection begins.

4. Why We Collect Your Information (Purposes)

We use the personal information we collect for the purposes listed below.

4.1 To provide the service

• Create and maintain your account.
• Generate your personalized financial plan and projections.
• Respond to your questions through our planning assistant.
• Provide educational content tailored to your situation.
• Save and update your plan as your circumstances change.

4.2 To operate as a business

• Process subscription payments and issue receipts.
• Provide customer support.
• Investigate and prevent fraud, abuse, or misuse of the service.
• Comply with legal and regulatory obligations.

4.3 To improve the product (only with your consent)

• Analyze aggregated or de-identified usage patterns to improve features and content. We do not use your individual personal information to train third-party foundation models.

4.4 To communicate with you

• Service messages (account-related notices, password resets, security alerts, plan-update reminders, terms changes). These are not optional while your account is active.
• Marketing messages (newsletters, product announcements, educational content not tied to your plan). These require your separate, express opt-in consent under Canada's Anti-Spam Legislation (CASL) and you can withdraw consent at any time.

5. Legal Basis and Your Consent

Our lawful basis for collecting, using, and disclosing your personal information is your knowledge and meaningful consent, subject to the limited exceptions permitted under PIPEDA and provincial law (for example, investigation of fraud, compliance with a subpoena, or where collection is necessary to respond to an emergency that threatens life or safety).

We ask for your consent in separate, granular buckets so that you can agree to some uses and decline others. We will never bundle these into a single "I agree to everything" checkbox.

5.1 Consent buckets

• Core data. The minimum information we need to provide the service (account, financial planning information you enter, document uploads where you choose to upload). Required to use the service.
• Connected accounts. Bank, investment, and CRA connections. Not offered in V1. Separately consentable when launched in Phase 2 or later.
• Sensitive document handling. Storage and AI-based extraction of documents you upload. You can use the service without uploading any documents.
• Marketing communications. Newsletters, product announcements, educational content. CASL-compliant express opt-in. You can withdraw at any time.
• AI processing. Use of artificial intelligence to generate your plan, answer your questions, and extract data from documents. See AI Use Disclosure. Some AI use is necessary to provide the service; other uses (for example, voice features when available) are optional.

5.2 Withdrawing consent

You can withdraw consent for any non-essential use at any time. Withdraw marketing consent by clicking unsubscribe in any email, or by emailing hello@yourpocketplanner.ca. Withdraw consent for AI processing where optional, or for document handling, through your account settings. Withdraw consent for Core data by deleting your account (Section 10), which closes the service for you.

Where withdrawal would prevent us from delivering some or all of the service, we will explain the consequences before acting on your request.

5.3 Express versus implied consent

We use express consent (an affirmative action by you) for Sensitive personal information, for marketing communications, and for any new purpose not previously disclosed. Implied consent is used only where it is reasonable in the circumstances and consistent with Office of the Privacy Commissioner of Canada guidance.

6. How We Use Your Information

Beyond the purposes in Section 4, we apply the following limits on use:

• We do not sell your personal information.
• We do not share your personal information with advertisers.
• We do not use your personal information for purposes you have not consented to or that are not permitted under PIPEDA.
• We do not use your personal information to train artificial intelligence foundation models offered by us or by our vendors. Our agreements with AI vendors expressly prohibit such use.
• Where we analyze usage to improve the product, we use aggregated or de-identified data wherever feasible.

7. How We Share Your Information

We share personal information only with the parties listed below, and only to the extent necessary for the stated purpose.

7.1 Service providers

We use carefully selected service providers to operate the service. Each provider is bound by a written agreement that limits their use of personal information to the purposes we authorize, requires confidentiality and security safeguards appropriate to the sensitivity of the data, and requires breach notification to us.

Current service providers include:

• Cloud hosting and application platform: Vercel Inc. (United States). Hosts our website and application. Limited access to personal information.
• Application database and authentication: Supabase Inc. (data residency region: Canada). Stores your account, your plan information, and your conversation history with the planning assistant.
• Artificial intelligence: Anthropic, PBC (United States). Powers our planning assistant. We send your messages and relevant plan context to Anthropic to generate responses. Anthropic is contractually prohibited from using your data to train its models.
• Artificial intelligence (voice): Google LLC (United States), through the paid Gemini API. Powers the voice features of our planning assistant, including the spoken Discovery conversation. We send the audio and text from those interactions, along with the relevant context from your plan, to Google to generate responses. Under the paid Gemini API, Google does not use your prompts or responses to train or improve its models and acts as a data processor; it retains this data only briefly to detect abuse and meet legal requirements.
• Email delivery (transactional and marketing): vendor not yet selected as of this version of the Policy; the chosen vendor will be added before public launch.
• Payment processing: Stripe, Inc. (United States). Handles your subscription payments. We do not store full payment card numbers ourselves.
• Customer support: handled internally via email at launch. We do not use a third-party customer support platform. An in-house customer support assistant is in development and will be described here when launched.
• Analytics: PostHog (data residency region: European Union). Helps us understand how the website and application are used and how well the signup process works. It uses cookies and, for signed-in users, builds a usage profile keyed to your account. We run it in an identified-only mode with session recording turned off, and we do not use it for advertising.

A current, complete list of sub-processors is available on request and is also maintained internally by our Privacy Officer.

7.2 Cross-border processing

Some of our service providers process personal information in the United States. When personal information leaves Canada, it is subject to the laws of the country in which it is processed, including the possibility of lawful access by foreign government authorities (such as under the U.S. CLOUD Act). We require these providers to apply safeguards equivalent to those required under Canadian privacy law, and we limit what we share with them to what is necessary for the service.

Our default storage region for personal information is Canada. Where we process outside Canada, the relevant section above identifies the country.

7.3 Legal requirements

We may disclose personal information without your consent where required or permitted by law, including in response to:

• A subpoena, warrant, or court order.
• A lawful demand by a Canadian regulator, peace officer, or government institution with statutory authority.
• An emergency that threatens the life, health, or security of a person, where we believe the disclosure is necessary.
• A specific investigation of a breach of an agreement or a contravention of law, in accordance with PIPEDA exceptions.

Where we are legally able to do so, we will notify you of any government or third-party demand for your personal information before responding.

7.4 Business transactions

If the Company is involved in a merger, acquisition, financing, reorganization, or sale of assets, your personal information may be disclosed to potential or actual counterparties (subject to confidentiality undertakings) and, ultimately, transferred to the successor entity. We will require successors to comply with this Policy or to provide notice of any material change.

8. How Long We Keep Your Information

We keep personal information only as long as necessary for the purposes we collected it for, plus any period required by law (for example, tax or accounting recordkeeping). Default retention periods are set out below and are reviewed at least annually by our Privacy Officer.

• Active account information: while your account is active and for 24 months after you close it or stop using the service, after which it is deleted or anonymized.
• Documents you have uploaded: 12 months after upload unless they are actively referenced in your current plan, in which case for as long as your account is active.
• Customer support messages: 24 months after the issue is closed.
• Planning assistant conversation logs: while your account is active, with the option to delete individual conversations on demand.
• Technical, security, and audit logs: 24 months (longer where required to investigate a security incident).
• Breach records (required by PIPEDA): at least 24 months.
• Marketing consent logs: for the duration of consent plus 24 months after withdrawal, to demonstrate compliance with CASL.
• Payment and tax records: for the period required by Canadian tax law (six years from the end of the last tax year to which the records relate, in accordance with Canada Revenue Agency record retention guidance).

When personal information is no longer needed, it is securely deleted, destroyed, or anonymized in accordance with our internal Data Retention and Disposal Policy.

9. How We Protect Your Information

We apply administrative, technical, and physical safeguards proportional to the sensitivity of the information we hold. Our safeguards include:

• Encryption in transit (TLS 1.2 or higher) and at rest (AES-256 or equivalent).
• Multi-factor authentication for all internal systems with access to personal information.
• Role-based access control on the principle of least privilege; access is granted only where needed for a specific job function.
• Centralized secret management with no credentials in source code.
• Audit logging of access to Sensitive personal information, with review for anomalies.
• Mandatory privacy and security training for all staff and contractors before they access production systems, with annual refreshers.
• A documented Breach Response Plan, with notification obligations to regulators and affected individuals where required by law.

No system is perfectly secure. If a breach affecting your information occurs and we determine that it poses a real risk of significant harm to you, we will notify you and the Office of the Privacy Commissioner of Canada (and provincial regulators where required) as soon as feasible, consistent with our Breach Response Plan and PIPEDA.

10. Your Rights

Subject to the limited exceptions in PIPEDA and provincial privacy law, you have the right to:

• Access the personal information we hold about you.
• Receive a copy of your personal information in a usable format.
• Correct information that is inaccurate, incomplete, or out of date.
• Withdraw consent for any non-essential use of your personal information (see Section 5.2).
• Close your account and request deletion of your personal information.
• Complain to our Privacy Officer if you believe we have not handled your personal information appropriately.
• Escalate a complaint to the Office of the Privacy Commissioner of Canada (or to the Alberta Information and Privacy Commissioner, or the Office of the Information and Privacy Commissioner for British Columbia, where applicable). See Section 16 for contact information.

10.1 How to exercise these rights

Email our Privacy Officer at hello@yourpocketplanner.ca or use the in-app data request form. We will:

• Acknowledge your request within 5 business days.
• Verify your identity proportionally to the sensitivity of the request, without collecting more information than necessary for verification.
• Respond to access and correction requests within 30 days, with a written explanation if we require an extension permitted under PIPEDA section 8(3).
• Provide our response in plain language and in an accessible format.
• Charge no fee, except where allowed by law and disclosed to you in advance.

10.2 Account deletion

When you delete your account, we delete or anonymize your personal information within 30 days except where we are required by law to retain specific records (Section 8). Some information may persist in backups for a limited period until the backup is rotated; during that period it is not accessible for any operational purpose.

11. Marketing Communications

We send marketing emails only to individuals who have given express opt-in consent, in accordance with Canada's Anti-Spam Legislation (CASL). Every marketing message identifies us, provides our contact information, and includes a working unsubscribe link. You can withdraw consent at any time by clicking unsubscribe or by emailing hello@yourpocketplanner.ca. We honour unsubscribe requests within 10 business days, as required by CASL.

We do not engage in targeted advertising, retargeting, or third-party advertising networks. We do not sell or share your email address with advertisers.

12. Artificial Intelligence and Automated Processing

Your Pocket Planner uses artificial intelligence (AI) to help generate your plan, answer your questions, and extract data from documents you upload. Our AI Use Disclosure explains in detail what the AI does, what it does not do, which vendors process AI requests, and how to opt out of optional AI features. This Privacy Policy and the AI Use Disclosure should be read together.

Key points carried over here for clarity:

• The AI assistant is an automated tool. It does not provide regulated investment, tax, or legal advice. You retain full control over your financial decisions.
• AI-suggested changes to your plan are surfaced to you for confirmation before they are applied.
• Personal information sent to AI vendors is governed by contracts that prohibit those vendors from using it to train their models.
• If the service ever introduces fully automated decision-making that produces a legal or similarly significant effect on you, we will provide a separate disclosure and a human-review pathway.

13. Children

Your Pocket Planner is intended for adults. The service is not directed at, and we do not knowingly collect personal information from, individuals under 18 years of age. Where a parent or guardian provides information about a dependent child as part of household planning (for example, RESP information, disability planning, custody arrangements), we treat that information as Sensitive personal information, use it solely for planning purposes, and limit access to it accordingly. If you believe we have inadvertently collected information from a minor, please contact our Privacy Officer and we will delete it.

14. Changes to This Policy

We will update this Policy from time to time to reflect changes in the service, our practices, or the law. Material changes will be communicated to active users by email or in-product notice at least 30 days before they take effect, except where a shorter period is required by law. The current version is always available at yourpocketplanner.ca/privacy. The effective date is shown at the top of this Policy and the version history is maintained internally.

15. Provincial-Specific Information

If you reside in Alberta or British Columbia, you have additional rights under PIPA AB and PIPA BC respectively. Where these regimes impose stricter obligations than PIPEDA (for example, mandatory breach notification to the Alberta Information and Privacy Commissioner under PIPA AB section 34.1), we apply the stricter standard to your information. If you reside in Quebec, please see Section 2.

16. How to Contact Us

16.1 Our Privacy Officer

All privacy questions, requests, and complaints should be addressed to:

• Privacy Officer, Your Pocket Planner
• Email: hello@yourpocketplanner.ca
• Mailing address: to be inserted on adoption (counsel-coordinated)

We will acknowledge your message within 5 business days and respond substantively within 30 days, in accordance with Section 10.

16.2 Privacy regulators

If you are not satisfied with our response, you have the right to escalate your complaint to the appropriate Canadian privacy regulator:

• Office of the Privacy Commissioner of Canada (federal). 30 Victoria Street, Gatineau QC K1A 1H3. Toll-free: 1-800-282-1376. Web: priv.gc.ca.
• Office of the Information and Privacy Commissioner of Alberta. 410, 9925-109 Street NW, Edmonton AB T5K 2J8. Toll-free: 1-888-878-4044. Web: oipc.ab.ca.
• Office of the Information and Privacy Commissioner for British Columbia. 947 Fort Street, PO Box 9038 Stn Prov Govt, Victoria BC V8W 9A4. Toll-free: 1-800-663-7867. Web: oipc.bc.ca.

Note for counsel and Privacy Officer: regulator addresses and phone numbers change from time to time; verify before publication.

Effective date: TO BE SET ON ADOPTION

DRAFT v0.1 . Authored 2026-05-12 . Pending counsel review.