WealthPrivacy Policy
Effective: May 18, 2026 · Updated: August 7, 2026 · Compliant: Law 25 (Quebec) + PIPEDA (Canada)
🍁 In short
Your data stays in Canada (Supabase ca-central-1, Montreal). No banking data is collected. You can export or delete your data at any time from your settings or by emailing support@mywealthwise.ca.
Table of contents
1. Data collected
1.1 What you provide
| Data | Purpose | Legal basis |
|---|---|---|
| Email, name | Account creation | Explicit consent |
| Email, language and requested resource | Deliver a requested checklist and follow up by email | Explicit consent |
| Password (bcrypt hashed) or Google OAuth | Authentication | Contract performance |
| Symbols, quantities, purchase prices | Portfolio analysis | Contract performance |
| Financial goals (FIRE, retirement) | Personalized projections | Consent |
| Preferences (language, currency, alerts) | Personalization | Consent |
1.2 Automatic collection
- IP, User-Agent, timestamps: security logs (90 days)
- Technical session categories: native app or website, phone/tablet/computer, operating system and browser, to measure compatibility and adoption. The raw User-Agent is not retained in product analytics and no geolocation is collected.
- Session cookies: authentication persistence (30 days)
1.3 What we NEVER collect
- ❌ Banking data (account number, transit, PIN)
- ❌ SIN, tax identifiers, biometric data
- ❌ Real-time geolocation
- ❌ External browsing history (no cross-site tracking)
2. Processing purposes
- Contract performance: create your account, calculate your portfolio, display your alerts.
- Legal obligations: retain transactions for tax obligations (CRA / Revenu Québec).
- Legitimate interests: security, anti-fraud, performance.
- Explicit consent: newsletters, AI improvements via anonymized data.
3. Third-party sharing
Your data is shared only with strictly necessary subprocessors:
| Third party | Data | Country |
|---|---|---|
| Supabase (database hosting) | All (except password) | 🍁 Canada (ca-central-1) |
| Google Gemini API | Anonymized portfolio (no email/identity) | 🇺🇸 United States |
| Stripe (Premium payments) | Email, subscription amount | 🇺🇸 United States |
| Resend (emails) | Email + requested checklist + unsubscribe link | 🇺🇸 United States |
| Vercel Web Analytics | Aggregated pages and interactions, without email address or form content | 🇺🇸 United States |
| SnapTrade (broker connector — read-only, optional) | Positions and transactions from the broker accounts you choose to connect. No password, no trades, no fund transfers. | 🍁 Canada (Toronto, ON) |
| Google Ads (ad conversion measurement — only after consent) | Anonymous advertising identifier + page URL visited. Activated only if you accept advertising cookies via the consent banner. Default: denied (Consent Mode v2). You can withdraw consent at any time. | 🇺🇸 United States |
| Yahoo Finance API | Public symbols only | 🇺🇸 United States |
Transfers outside Canada are governed by standard contractual clauses (SCCs) and the EU-US Data Privacy Framework. No broker, no fund, no portfolio data is shared with any advertiser. Google Ads (above) receives only a generic advertising identifier and the page visited, and only if you enable advertising cookies.
4. Data retention
| Data | Duration |
|---|---|
| Active account | While using the service; immediate in-app deletion or processing within 30 days for an email request |
| Imported portfolio & transactions | Until the account is deleted |
| Billing records held by the payment provider | As required by the provider's applicable legal obligations |
| Access logs (IP) | 90 days |
| Authenticated usage events and technical session categories | Until the account is deleted; current reporting dashboards use a maximum 90-day window |
| Session cookies | Session or 30 days |
5. Your rights (Law 25, art. 9)
- Right of access: receive a copy of all your data. 30-day delay, free.
- Right of rectification: correct your data from the app or by email.
- Right to erasure: delete your account from the app or use our public account-deletion page. Email requests are processed within 30 days, except for data subject to a legal retention requirement.
- Right to portability: export everything in JSON / CSV from your settings.
- Right to object: unsubscribe from marketing emails at any time.
- Right to restrict processing: request a suspension by email.
To exercise a right: visit the account-deletion page or email support@mywealthwise.ca — response within 30 days.
6. Security
- ✅ Encryption in transit (TLS 1.3) and at rest (Supabase Postgres)
- ✅ Passwords hashed with bcrypt (10+ rounds)
- ✅ Row-Level Security (16 RLS policies) — you only see your own portfolios
- ✅ Rate limiting + audit logs
- ✅ Notification to the CAI within 72 hours in case of incident (Law 25, art. 13)
7. Cookies
| Cookie | Use | Consent |
|---|---|---|
session_id | Authentication | Required (essential) |
language_pref | Language (FR/EN) | Implicit |
theme | Light/dark mode | Implicit |
| Google Analytics (if enabled) | Anonymous statistics | 🟡 Opt-in |
| Vercel Web Analytics | Aggregated page and product interaction measurement without personal identifiers or third-party cookies | Cookie-free |
8. Contact & DPO
Data controller: WealthWise (publisher of the service)
Data Protection Officer (DPO): reachable at support@mywealthwise.ca
Email: support@mywealthwise.ca
Supervisory authority: Commission d'accès à l'information du Québec (CAI) — you may file a complaint there if you are not satisfied with our response.
Changes to this policy
Any material change will be notified by email at least 30 days before it takes effect.