PIPEDA and Privacy
How we comply with Canadian privacy law and protect your information
What Is PIPEDA?
PIPEDA (Personal Information Protection and Electronic Documents Act) is Canada's federal privacy law. It governs how private-sector organisations collect, use, and disclose personal information in the course of commercial activity.
As a Canadian company handling Canadians' financial data, PIPEDA compliance is fundamental to how we operate.
Where Your Data Lives
We are transparent about where your data is processed and stored. Every provider and region is listed on our Subprocessors page. Our backend services run on Google Cloud in the northamerica-northeast1 (Montreal) region, and our primary database is currently hosted by Supabase in the United States (us-west-2). Where personal data is processed outside Canada, PIPEDA requires us to provide comparable protection through contractual and technical safeguards, which we do.
No Third-Party AI on Your Data
We made a deliberate decision in February 2026 to remove the last third-party AI dependency that touched personal data. Our categorisation engine works on patterns and merchant data without sending your transactions, balances, or identity to outside AI providers.
Our Privacy Commitments
We Only Collect What's Necessary
We collect the minimum data needed to provide the service:
- Account credentials for authentication
- Financial data you choose to import or enter
- Basic profile information (name, email, province)
- Usage data to improve the service
We do not collect data "just in case" — every piece of information we store has a clear purpose.
We Never Sell Your Data
Your financial information is never sold to third parties. Not to advertisers, data brokers, or anyone else. Your data exists solely to provide you with the NivoaFlow service.
No Invasive Tracking
We do not use ad tracking, behavioural analytics, or any tools that identify you personally for marketing. We do not build advertising profiles from your financial data.
Transparency
We are open about what we store and why. Our privacy policy explains in plain language what data we collect, how we use it, and how long we keep it.
CASL Compliance
CASL (Canada's Anti-Spam Legislation) governs commercial electronic messages. Our approach:
- Explicit consent only — we only send marketing emails if you have opted in
- Easy unsubscribe — every marketing email includes a one-click unsubscribe
- Transactional emails — account-related notifications (security alerts, billing confirmations, trial reminders) are sent as needed without marketing consent
Your Privacy Rights
Under PIPEDA, you have the right to:
- Access the personal information we hold about you — use the export feature for a complete copy
- Correct any inaccurate information from Settings > Profile
- Withdraw consent for data collection
- Delete your data entirely — see deleting your account
- Complain to the Office of the Privacy Commissioner of Canada if you believe your rights are not being respected
Breach Notification
We follow PIPEDA's mandatory breach reporting framework. In the event of a data breach posing a real risk of significant harm, we will notify affected users and the Office of the Privacy Commissioner of Canada as required, including a description of the breach, the personal information involved, and the steps we and you can take to reduce harm.
Data Export
You can download a complete copy of all your data at any time from Settings > Data & Deletion > Export Data. Your data belongs to you. See exporting your data for details. For infrastructure security, see data security overview.