Privacy Policy
Canada-first privacy with PIPEDA-aligned practices.
Last Updated: October 19, 2026
Optional website feedback
If you submit feedback on our free-trial page, we store your selected answer, optional comment, submission reference and submission time for up to 90 days using Cloudflare. No name or email is required. Please leave personal and financial details out of your comment. Feedback works even when you decline analytics or enable Do Not Track. For spam prevention, we temporarily store an hourly keyed hash of your network address for up to two hours, separately from your response; we do not store the raw address with feedback. When analytics is allowed, we may record your choice and submission reference with your visit to understand where the website needs improvement. We do not send your comment to analytics. Skipping this question does not affect your access to the trial.
1. Our Commitment to Canadians
NivoaFlow is designed with Canada-first privacy principles. We align our practices with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial legislation, including Alberta's PIPA and British Columbia's PIPA.
We believe that financial privacy is a fundamental right. Unlike many global platforms, NivoaFlow is built specifically to address the privacy needs of Canadian households, ensuring your financial footprint is managed with transparency and accountability.
2. Accountability & Meaningful Consent
Accountability: NivoaFlow's designated privacy lead is responsible for oversight of our data protection practices and regulatory alignment. We are responsible for personal information under our control.
Consent: We utilize an "Opt-In" model. We will not collect, use, or disclose your personal information without your knowledge and consent, except where required or permitted by law. You may withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice.
3. Limiting Collection & Use
We only collect information strictly necessary for the purposes identified at the time of collection. These purposes include:
Identity & Account Data
- Name and Email Address (for account verification and privacy-aligned account administration).
- If you choose Sign in with Google or Sign in with Apple (both optional), the provider shares your name, email address and a unique account identifier with us. We never receive your Google or Apple password. You can always use an email address and password instead.
- IP Address and Session Metadata (for security auditing and geo-fencing).
Financial Ledger Data
- Transaction History (dates, merchants, amounts) imported via CSV or connected bank accounts.
- Account Names and Categories defined by you.
- Forecasting assumptions and budget targets.
- Bank account identifiers and balances (when you connect accounts via Plaid).
Note: We never store your bank login credentials (PINs, passwords, or security questions). Bank connectivity is provided securely via Plaid.
Profile & Preferences
- Date of birth (optional, for age-based financial planning).
- Tax province (for Canadian tax calculations).
- Device identifiers (for session security).
- Subscription status (managed via Stripe, with no payment card details stored).
4. Bank Connectivity via Plaid
NivoaFlow offers optional bank account connectivity through Plaid Inc., a trusted financial data aggregator. When you choose to connect your bank accounts:
How It Works
- You authenticate directly with your bank through Plaid's secure interface.
- NivoaFlow receives a secure token, never your login credentials.
- We access only the data needed: account balances, transaction history, and account identifiers.
Your Control
- Connect: Bank connections are optional and initiated by you.
- Disconnect: You may disconnect any bank account at any time from your account settings.
- Revoke: You can also revoke access directly through Plaid Portal.
- Reauthorization: Connection persistence varies by institution. We will notify you when a reconnection is needed.
Plaid is a subprocessor acting on our behalf. For details on how Plaid handles your data, see the Plaid End User Privacy Policy.
5. Subscription Payment Processing
NivoaFlow uses Stripe, Inc. for web subscription payments and Apple App Store or Google Play billing, supported by RevenueCat, Inc., for mobile subscriptions.
What Stripe Receives
- Your email address (for payment receipts and billing correspondence).
- Payment details (card number, expiry, CVC) are entered directly into Stripe's secure payment form and are handled entirely by Stripe.
What NivoaFlow Stores
- Subscription status (active, cancelled, past due).
- Billing cycle dates.
- We do not store your card number, expiry, or CVC.
Stripe is a PCI DSS Level 1 certified payment processor. For details on how Stripe handles your data, see the Stripe Privacy Policy.
Mobile Subscriptions
- Apple or Google processes the store payment; NivoaFlow does not receive your full payment-card details.
- RevenueCat validates the store purchase and manages subscription entitlements on our behalf.
- RevenueCat receives an app user ID, store purchase identifiers, subscription status, and basic device/store metadata.
- RevenueCat does not receive your bank transactions, linked-account balances, receipt images, or Plaid credentials from NivoaFlow.
For details on RevenueCat's processing, see the RevenueCat Privacy Policy.
6. Customer Support Chat
Our support chat on nivoaflow.com and in the app is provided by Tidio, which includes an automated assistant that answers common questions before a person replies.
What Tidio Receives
- The messages you send in the chat window.
- A visitor identifier, your IP address, and basic browser and device information.
- Any name or email address you choose to provide so we can follow up.
What Tidio Does Not Receive
- Your account balances, transactions, or any connected bank data.
- Your password or authentication tokens.
Please do not share passwords or full account numbers in chat. We will never ask for them. For details on how Tidio handles this data, see the Tidio Privacy Policy.
7. Waitlist & Marketing Communications
If you sign up for our early access waitlist, we collect the following information:
Waitlist Data
- Email Address: To contact you about launch updates and new features.
- Consent Preference: Whether you opted in to receive marketing communications.
- Consent Metadata: Timestamp and method of consent (for CASL compliance).
- Anonymized IP Hash: A one-way hash of your IP address for consent audit trail (cannot be reversed to identify you).
- Referral Source: How you found us (e.g., landing page, blog) and any UTM campaign parameters.
CASL-aligned consent: We collect express consent via an unchecked checkbox before sending commercial electronic messages. You must actively opt in to receive marketing emails.
Data Retention: We retain waitlist data until you request deletion or unsubscribe. Unsubscribe requests are processed within 10 business days.
No Third-Party Sharing: Your waitlist email is never sold, rented, or shared with third parties for their marketing purposes.
Unsubscribe: To unsubscribe from marketing communications, reply to any email with "unsubscribe" or contact support@nivoaflow.com.
8. Data Residency & International Transfers
We use cloud service providers that process and store data in Canada, the United States, and other jurisdictions as needed to deliver the service. Where data is processed outside your jurisdiction, we apply contractual and technical safeguards appropriate to the sensitivity of the data.
For a complete list of our service providers, see our Subprocessors page.
9. Safeguards & Data Sovereignty
We protect personal information with security safeguards appropriate to the sensitivity of the information:
- Row-Level Security (RLS): Your data is isolated at the database layer, preventing your records from being accessible to other users.
- Encryption: Data is encrypted both in transit and at rest using industry-standard encryption.
- Access Controls: NivoaFlow limits access to your financial data to authorized personnel through technical and policy controls. Production data access is restricted and logged.
- Data Portability: We support data portability. You may request a copy of your data by contacting privacy@nivoaflow.com, and we will provide it in a standard machine-readable format.
10. Data Retention
We retain personal information only as long as necessary for the purposes identified or as required by law:
| Data Type | Retention Period |
|---|---|
| Account & Financial Data | Until you delete your account |
| Bank Connection Tokens (Plaid) | Until you disconnect or reauthorization is required |
| Encrypted Apple Sign-In Revocation Data | Until Apple accepts revocation, or the first daily cleanup after the seven-day retry window ends |
| Security & Audit Logs | As required for security and compliance purposes |
| Waitlist Data | Until you unsubscribe or request deletion |
| Billing and Payment Records (held by Stripe) | Six years after the end of the tax year they relate to, as Canadian tax law requires, including after you delete your account |
| Support Correspondence | As required for dispute resolution and compliance |
| Live Visit Alerts (public site) | 48 hours; first and last visit dates 12 months; alert messages one month |
| Product Usage Record (random code) | 24 months; the link between the code and you is deleted with your data |
| Anonymous Deletion Summary | Kept after deletion (contains nothing that identifies you) |
| Repeat Sign-Up Fingerprint | 12 months after your data is deleted |
How to Delete Your Account
- In the mobile app: You, then Privacy, then Delete account
- On the web: sign in at app.nivoaflow.com, open Settings, then Profile, and choose Delete Account at the bottom of the page
- Without signing in: email privacy@nivoaflow.com from the address on your account and ask us to delete it
- Subscriptions bought through Google Play or the App Store: cancel them in the store to stop future billing. You can still proceed with account deletion after acknowledging that store billing continues.
When you request account deletion, your data is hidden immediately. You choose a grace period during which you can cancel the request. After the grace period expires, your login and email address are deleted and your personal data is removed, except the records and limited technical data described in this section. We also request revocation of third-party access tokens. If you reset your data instead, your login stays so you can start again with the same account.
Sign in with Apple. We use an encrypted Apple authorization token to revoke NivoaFlow's access when final account deletion begins. If Apple is temporarily unavailable, we retry for up to seven days. The encrypted token and technical identifiers needed for these retries are erased when Apple accepts revocation or during the first daily cleanup after that window, even if revocation has not succeeded. These retries do not keep your login or financial data active. If no usable Apple token is available, your deletion still proceeds. You can also remove NivoaFlow from Sign in with Apple in your Apple Account settings.
How to Reset Your Data Without Deleting Your Account
You can remove your financial data and keep your NivoaFlow sign-in. This applies to NivoaFlow, the app shown on Google Play and the App Store.
- In the mobile app: You, then Privacy, then Reset data. Type RESET to confirm.
- On the web: sign in at app.nivoaflow.com, open Settings, then Profile, and choose Reset Data above Delete Account. Type RESET to confirm.
- Removed right away: every account, transaction, budget, goal and rule. Bank and brokerage connections are disconnected, and a plan billed on the web is cancelled and moves to free.
- Kept: your account itself, so your sign-in stays, and billing and payment records for six years after the end of the tax year they relate to, as Canadian tax law requires.
- Subscriptions bought through Google Play or the App Store: a reset does not cancel them, so cancel them in the store if you want to stop paying.
- A reset cannot be undone. If you want your account and all of your data gone, use the account deletion steps above.
Anonymous deletion summary. When your data is deleted, we keep a short summary to understand why people leave and how to improve NivoaFlow: your country and province or state, birth decade, income range, life stage and housing, which banks and brokerages you connected and how, the types and number of accounts, the number of imports and transactions and how many months they covered, how you signed up and where you came from, your plan, which screens you visited, how many days you used NivoaFlow, which features you used, how many days key steps took (such as finishing setup or connecting a bank), whether your bank connections worked, and when and why you deleted your data. It contains no name, email address, date of birth, IP address, balances, transactions, account names or account numbers, and it is never linked to your account if you sign up again.
Repeat sign-up fingerprint. For fraud and abuse prevention, we keep a one-way coded version of your email address with that summary for 12 months. It cannot be turned back into your email address. It only lets us tell that a new sign-up used the same email address, or the same name before the @, as a deleted account. For example, a new sign-up with the same email address as a deleted account does not receive a second free trial. After 12 months it is erased and the summary is fully anonymous.
11. Breach Notification
To support our PIPEDA-aligned privacy program and applicable provincial obligations, we maintain breach response procedures:
Assessment: If we become aware of a security incident involving personal information, we will promptly assess the scope and severity of the breach.
Notification: Where a breach creates a real risk of significant harm, we will notify affected individuals as soon as feasible, and report to the Office of the Privacy Commissioner of Canada as required by law.
Content: Notifications will include the nature of the breach, the types of information involved, steps we are taking, and actions you can take to protect yourself.
Record-Keeping: We maintain records of all breaches as required under PIPEDA, regardless of whether notification was required.
12. Cookies & Analytics
We use cookies and similar technologies to support the operation of our platform:
Essential Cookies
Required for the platform to function. These cannot be disabled.
- Session cookies: Maintain your login state
- Security cookies: CSRF protection, rate limiting
- Preference cookies: Theme (dark/light mode), currency settings
Analytics Cookies (Optional)
Only activated when you choose “Analytics Only” or “Accept All” on the consent banner.
- Google Analytics 4: Collects page views, campaign attribution, events, and performance measurements on our public marketing site
- Microsoft Clarity: When configured, provides consent-gated, masked interaction and usability diagnostics on our public marketing site
- Opt-in only: These analytics tools do not load unless you provide consent. Live Visit Alerts, below, are the one cookie-free exception
- Separated choice: Analytics consent does not enable advertising tags
- Limited scope: These public-site tools do not receive the financial records stored in your NivoaFlow account
Live Visit Alerts (No Cookies)
So we can see how people move through our public site, our own server notes each page you view on nivoaflow.com and sends a short alert to NivoaFlow staff through Telegram. It also covers the app’s signed-out pages (sign-up, sign-in, password reset and the /try sample) and sends one note, with no name or email address, when an account is created. Nothing is sent once you are signed in.
- What the alert shows: the pages you view and when, the site that referred you and any campaign tags, your approximate city and the name of your internet provider (for example, TELUS) from your IP address, your browser and device type, links into the app that you click, and when you first visited and last visited
- No cookies, no stored IP: your IP address and browser type are turned into one-way codes. One changes every day and becomes your visitor code (like K7Q2). The other stays the same for 12 months so we can see when you first visited and when you came back. We cannot read your IP address from either code. Your IP address is never stored or sent to Telegram
- Return visits: a new network or browser looks like a new visitor. If you accept analytics cookies, a random id kept in your browser is used instead, so a return from another network is also recognised, for up to 12 months
- Retention: visit details are kept for 48 hours; your first and most recent visit dates and visit count for 12 months; alert messages are deleted automatically from our private chat after one month
Product Usage Record (In the App, No Cookies)
So we can see which parts of NivoaFlow help people and where they get stuck, our own server keeps a record of steps and features used in the app. It is filed under a random code, not under your account, name or email address.
- What it records: steps such as finishing setup, starting a trial, subscribing or cancelling, connecting a bank or brokerage and whether it worked (with the bank’s name and any error code), importing a file, changing a suggested category, and deleting your data; the days you use the app and which features you open that day
- What it never records: your name, email address, IP address, balances, amounts, transactions, merchant names or account numbers
- After you delete your data: the link between the random code and your account is deleted with the rest of your data, so the record can no longer be traced back to you. It is never linked to a new account if you sign up again
- Retention: 24 months, then deleted
- Where it stays: in our own database, with the rest of your account data (see Data Residency above); it is not sent to advertising or analytics companies
Product Analytics in the App (PostHog)
While you are signed in to the web app or the mobile app, we send usage events to PostHog so we can see which screens and features are used and where setup stalls.
- What it receives: the screens and pages you open, named events (for example, finishing setup or starting an import), when the app is opened or closed, your browser or device type and app version, your NivoaFlow account ID, and your IP address as the events arrive, which PostHog can use to estimate your city
- What it never receives: your name, email address, balances, amounts, transactions, merchant names or account numbers. Text on screen is masked, automatic click capture is off and session recording is off
- Where: PostHog stores this in the United States (see Data Residency above)
- After you delete your account: the events remain filed under an account ID that no longer links to you
Crash and Error Reports (Sentry)
When something breaks in the web app or the mobile app, a report goes to Sentry so we can find and fix it.
- What it receives: the error and where in our code it happened, the screen or page, your browser or device model and operating system, the app version, and timing for a sample of requests to our servers
- What it never receives: reports are not tagged with your name, email address or account, and we do not send balances, transactions or form contents
- Where: Sentry stores reports in the United States
Advertising Measurement (Optional)
Only activated when you choose “Accept All.” Depending on which campaigns we run, configured tags may include Meta, TikTok, Reddit, and LinkedIn.
- These tags measure visits and campaign actions on our public site after consent
- Campaign parameters and advertising click identifiers may be retained for attribution
- The advertising platforms process tag data under their own privacy terms
- Advertising tags are not loaded on authenticated financial dashboard pages by this implementation
What We Don’t Do
- We do not sell cookie or financial data to data brokers
- We do not make optional analytics or advertising consent a condition of service
- We do not send account balances, transactions, budgets, or goals to advertising platforms
Managing Cookies: Use “Cookie settings” in the site footer to change your choice, or use your browser settings. Changing a choice stops future optional collection; you may also need to clear existing platform cookies through your browser.
13. Automated Processing and Suggestions
NivoaFlow uses fixed rules and a statistical model that runs on our own servers to suggest categories and surface patterns. We do not use generative AI, and your financial data is not sent to third-party AI services. Here is how these systems work:
How We Use Automated Processing
- Suggested categories: Suggested from merchant names, your own rules, and a model trained only on your own reviewed transactions
- Recurring detection: Identify recurring bills and subscriptions from your transaction history
- Cash flow forecasting: Project future balances based on historical spending patterns
- Insights: Surface spending trends and budget figures using fixed rules, with the numbers shown
Your Rights & Controls
- Override: You can always review and change any suggested category
- No profiling for third parties: We do not use your data to profile you for advertisers or lenders
- Your data trains only your own model: The categorization model for your account is trained on your own transactions. It is not shared with other members, and your financial data is not used to train any third-party model
- Human review: Significant automated decisions can be reviewed upon request
Not Financial Advice
Insights, forecasts, and projections are for informational purposes only. They should not be relied upon as financial advice. Always verify important financial information and consult qualified professionals for significant decisions.
14. Children's Privacy
NivoaFlow is designed for adults. Our services are intended for individuals who are at least 18 years of age (or the age of majority in their province).
Inadvertent Collection: We do not knowingly collect personal information directly from children under 13. If we become aware that we have inadvertently collected such information, we will delete it promptly. If you believe a child under 13 has provided us with personal information, please contact privacy@nivoaflow.com.
15. Provincial Privacy Laws
In addition to our PIPEDA-aligned practices, we design our privacy program with applicable provincial privacy legislation in mind:
Alberta (PIPA)
Alberta residents are protected under the Personal Information Protection Act (PIPA). You have the right to access your personal information, request corrections, and file complaints with the Office of the Information and Privacy Commissioner of Alberta.
British Columbia (PIPA)
BC residents are protected under the Personal Information Protection Act (PIPA). You have the right to access your personal information, request corrections, and file complaints with the Office of the Information and Privacy Commissioner for BC.
Quebec (Law 25 / Bill 64)
Quebec residents are protected under updated privacy legislation (Law 25). You have enhanced rights including data portability, the right to be forgotten, and the right to object to automated decision-making. Complaints may be filed with the Commission d'accès à l'information du Québec.
The specific rights available to you may vary depending on your province of residence. Contact us if you have questions about your provincial privacy rights.
16. Individual Access & Openness
Upon request, we will inform you of the existence, use, and disclosure of your personal information and provide you with access to that information. NivoaFlow users have the right to:
- Challenge the accuracy and completeness of the information and have it amended as appropriate.
- Request deletion of all account data, which we will process promptly according to our data retention policy.
- Inquire about the specific sub-processors used for their account data.
17. Handling Inquiries & Complaints
If you have a question or complaint regarding our privacy practices or PIPEDA-aligned privacy program, please contact our privacy lead at privacy@nivoaflow.com.
If you are not satisfied with our response, you have the right to contact the Office of the Privacy Commissioner of Canada:
Office of the Privacy Commissioner of Canada
30 Victoria Street, Gatineau, Quebec, K1A 1H3
Toll-free: 1-800-282-1376 | www.priv.gc.ca
Questions About Privacy?
As a Canadian-focused platform, we pride ourselves on transparency. If you need a more technical deep-dive into our RLS isolation or cross-border safeguards, we are happy to assist.
General Inquiries
support@nivoaflow.comPrivacy Officer
privacy@nivoaflow.comSecurity Issues
security@nivoaflow.com