Privacy Policy

1. The waitlist

If you have joined the waitlist at flowd.ca/join and have not created an account, this is the only section of this policy that applies to you. Joining the waitlist does not create an account, and we do not ask you for a card.

• What we collect: your email address, and nothing else. Not your name, not your bank, not any financial information.
• Why we collect it: to tell you when Flowd opens and what a founding spot costs, and to ask you one question about what other budgeting apps have got wrong for you. You are welcome to ignore the question.
• Who handles it: our waitlist runs on beehiiv, an email platform based in the United States. Your address is stored on beehiiv's servers in the United States and is therefore subject to the laws of that country. beehiiv processes it on our instructions and does not use it for its own purposes.
• How long we keep it: until Flowd opens, or until you unsubscribe, whichever comes first. If we decide not to launch, we will delete the list.

You gave express consent to receive email from Flowd when you submitted the waitlist form. That consent is what Canada's anti-spam legislation (CASL) requires, and you can take it back at any time. Every email we send carries an unsubscribe link that works immediately, and you never have to give a reason. You can also write to support@flowd.ca and we will remove you. Once you unsubscribe we stop sending, and beehiiv keeps a record of the unsubscribe itself so that you are not added back by mistake.

We do not sell, rent, or trade the waitlist. We do not share it with advertisers, and we do not use it to build a profile of you.

2. What we collect

We aim to collect only what we need to provide the Service:

• Account information: your name and email address, and authentication details when you sign in.
• Statements you upload: the bank and credit-card PDF statements you choose to add, and the transaction data extracted from them.
• Billing information: if you subscribe, payment is handled by our payment processor. We receive limited details such as plan, status, and the last four digits of your card. We do not store full card numbers.
• Usage information: basic, privacy-respecting analytics about how the Service is used, to keep it reliable and improve it.

3. Your statement data

The statements you upload are the heart of Flowd, and we treat them with care. When you add a PDF, we use an AI service (Anthropic's Claude, processed on servers in the United States) to extract the transactions, clean up merchant names, and categorize spending so we can build your dashboard, net-worth view, goals, and projections. Anthropic does not use data sent through its API to train its models.

We never request or store your online-banking credentials, and we do not initiate connections to your financial institution. You stay in control of which statements you share and can remove them at any time.

4. How we use your information

We use the information above to:

• Provide and operate the Service: categorize transactions, calculate balances and net worth, track goals, and generate insights.
• Maintain security, prevent fraud, and troubleshoot problems.
• Process payments and manage your subscription.
• Communicate with you about your account and important changes.
• Improve Flowd, using aggregated or de-identified information wherever possible.

We do not use your financial data for advertising, and we do not sell it.

5. Consent

We rely on your consent to collect and use your personal information, consistent with PIPEDA. You provide consent by creating an account and uploading statements. You can withdraw consent at any time by deleting your data or closing your account, subject to legal or contractual requirements (for example, retaining billing records).

6. Sharing and disclosure

We do not sell, rent, or trade your personal information. We share it only in these limited cases:

• Service providers who help us run Flowd (hosting, payment processing, and AI statement reading) under contracts that require them to protect your data and use it only on our instructions.
• Legal requirements: when we are required by valid Canadian law or legal process, or to protect the rights, safety, and security of users and the public.
• Business transfers: if Flowd is involved in a merger or acquisition, with notice to you and continued protection of your data.

7. Storage and security

Your account and financial data live in our cloud database (Supabase). Some processing happens with service providers in the United States: uploaded statements are read by Anthropic's Claude AI to extract transactions, payments are handled by Stripe, and the app runs on Vercel. This means your information may be stored or processed outside Canada and can be subject to the laws of those jurisdictions. Each provider is bound by contract to protect it. We use technical and organizational safeguards, including encryption in transit and at rest, access controls, and the principle of least privilege, to protect it. No system is perfectly secure, but we work continuously to keep your data safe and will notify you and the appropriate authorities of any breach as required by law.

Separately from all of that, every page on flowd.ca loads its typefaces from Google Fonts. This means Google receives your IP address and browser type when a page loads, whether or not you have an account or have signed up for anything. Google Fonts does not set cookies, and we do not send it anything else about you.

8. Retention and deletion

We keep your information only as long as needed to provide the Service or as required by law. You can export everything we hold about you, and permanently delete your entire account, including every statement and transaction, at any time from your settings. When you delete your account, we remove your statements and associated financial data, retaining only what we must for legal, tax, or fraud-prevention purposes, for as long as required.

9. Your rights

Under PIPEDA and applicable provincial law, you have the right to:

• Access the personal information we hold about you and request a copy.
• Ask us to correct inaccurate or incomplete information.
• Withdraw consent and have your data deleted, subject to legal limits.
• Ask questions or raise a concern about how we handle your data.

How to ask. Write to support@flowd.ca and tell us which of the above you want. There is no form to fill in and no particular wording you need to use. These rights apply whether you hold an account or have only joined the waitlist.

What happens next. We will answer within 30 days, and we will not charge you for it. If a request is complex and we genuinely need longer, we will write to you before those 30 days are up, explain why, and give you a new date. We may need to confirm who you are before we hand over personal information, which protects you more than it protects us. If there is part of a request we cannot act on, we will tell you which part and why.

If you are not satisfied with how we have handled your request, you have the right to complain to the Office of the Privacy Commissioner of Canada.

10. Cookies

We use a small number of cookies and similar technologies to keep you signed in, remember your preferences, and understand aggregate usage. You can control cookies through your browser settings. Disabling some may affect how the Service works.

11. Children

Flowd is not directed to children and is intended for users who are the age of majority in their province or territory. We do not knowingly collect personal information from children.

12. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will provide reasonable notice by posting the updated policy with a new "last updated" date or notifying you in the app.

13. Contact us

Flowd's Privacy Officer is the person responsible for protecting the personal information we hold and for answering the requests described in section 9. To ask a privacy question or exercise any of your rights, write to the Privacy Officer at support@flowd.ca. We are based in Ontario, Canada.