Privacy Policy

1. Information We Collect

We collect information you provide directly to us, such as when you create an account, use our services, or contact us for support. We limit our collection of personal information to what is reasonably necessary to provide and improve the Service.

Personal Information

• Name and email address (to create your account and send transactional emails)
• Account credentials and authentication information (managed by Clerk, our auth provider)
• Financial data you choose to input — budgets, transactions, goals, categories (to power the budgeting features you signed up for)
• Communication preferences (to honor your choices for transactional notifications and any future marketing emails)
• Region and currency preferences (to display amounts and registered-account types relevant to your country)

Automatically Collected Information

• Device information and IP address (for security, fraud prevention, and to detect approximate region)
• Usage patterns and app interactions (to improve the product — see Section 7)
• Security logs and access attempts (to protect your account)
• Cookies and similar tracking technologies (see Section 8 and our Cookie Policy)

Bank-Synced Data (Paid Plans Only) — Sensitive Personal Information

Bank-synced financial data is treated as sensitive personal information under Quebec Law 25 and US state privacy laws. We apply heightened consent and protection standards: you must explicitly authorize the bank connection on a dedicated consent screen before any data is retrieved.

When you connect a bank account via Plaid or Flinks (available on Waypoint Plus and Pro plans), we receive and store:

• Account names, types, masked account numbers, and current balances (to display your accounts and net worth)
• Transaction details — date, amount, merchant/description, category (to power transaction tracking, budgeting, and Money Coach)
• Financial institution name and logo (to identify which bank each account belongs to)

We do not receive or store your banking passwords, login credentials, or security questions. These remain with the bank connection provider (Plaid or Flinks) and are never transmitted to Waypoint. For Flinks connections, we have opted out of identity data collection (addresses, phone numbers, employment information) — we only receive transaction and balance data.

About per-account display preferences: In-app toggles on the Banks page (such as"Syncing" and"Included balance") control what each account shows in your transactions feed, reports, and net-worth view. They are display filters and do not stop data synchronization at the source — your bank connection continues to deliver balance and transaction updates to Waypoint while it is active. To stop ongoing data collection from a specific bank, disconnect that bank via the Banks page.

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our services
• Process transactions and manage your account
• Send you technical notices and support messages
• Respond to your comments and questions
• Monitor and analyze usage patterns for security purposes
• Detect and prevent fraud and abuse
• Comply with legal obligations

AI Chat Features - Local Storage Only

3. Information Sharing and Disclosure

We do not sell, trade, or otherwise transfer your personal information to third parties without your consent, except in the following circumstances:

• Service Providers: We may share information with trusted third parties who assist us in operating our service, conducting our business, or serving our users
• Legal Requirements: We may disclose information when required by law or to protect our rights, property, or safety
• Business Transfers: In the event of a merger, acquisition, or sale of assets, user information may be transferred as part of the transaction
• Consent: We may share information with your explicit consent

Third-Party Service Providers

We use the following third-party service providers who may process your personal information. Each acts as our service provider (processor) — they process data on our behalf and under our instructions, not for their own independent purposes.

Service Provider Review: Before engaging any of the service providers listed above, we evaluate their privacy practices, security posture, and applicable certifications. We continue to monitor their public commitments and update this policy if a provider materially changes how personal information is handled.

Note: All third-party service providers are required to comply with applicable privacy laws and use your information only for the purposes described above.

4. Data Security

We implement appropriate technical and organizational security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit and at rest
• Regular security assessments and updates
• Access controls and authentication systems
• Monitoring and logging of system access
• Employee training on data protection
• Secure data centers and infrastructure

5. Data Retention and Account Deletion

We retain your personal information for as long as necessary to provide our services and fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

How to Delete Your Account

When You Delete Your Account

When you delete your account, we begin deletion of your personal information from our systems immediately, including:

• Your profile information (name, email, preferences)
• All budgets, transactions, and financial data you created
• Connected bank account information and settings
• Savings goals, financial goals, and custom categories
• Chat history with AI features (stored locally on your device — cleared by clearing browser data)

Backup Retention: When you delete your account, your personal data is purged immediately from our active systems. Encrypted database backups managed by our infrastructure provider (Supabase) follow their standard retention policy and will eventually purge any remaining copies on that schedule. We do not retain manual backups of user data.

Retention Windows During Active Use

• Bank transaction history: We pull up to 90 days of historical transactions when you first connect a bank. Ongoing sync stores transactions for the lifetime of your account, so you can review your full history within Waypoint.
• Inactive bank connections: If a bank connection remains in an error state for 30 or more days without being reconnected, we automatically remove it along with its associated transactions.
• Account deletion: Personal data is purged immediately from our active systems. Any remaining copies in encrypted infrastructure backups (Supabase) are subject to their standard retention schedule.

Payment and Subscription Data

For any questions about data deletion or retention, please contact us at support@waypointbudget.com

6. Your Rights, Consent, and Choices

You have the right to:

• Access and update your personal information
• Request correction of inaccurate or incomplete personal information
• Request deletion of your personal information
• Request a copy of your data in a portable format
• Opt out of certain communications
• Withdraw consent for data processing (see below)
• File a complaint with privacy authorities

Express Consent for Sensitive Data

Bank-synced financial data is treated as sensitive personal information. Before any bank connection is made, you are presented with a dedicated consent screen that names the provider (Plaid or Flinks), explains what data will be retrieved, and requires your express opt-in. You may decline at any time, and you may withdraw consent later by disconnecting the bank.

How to Withdraw Consent

You may withdraw your consent for specific processing activities by:

• (a) Disconnect a bank: Open the Banks page in Waypoint and disconnect the relevant institution to stop all further bank-synced data collection from that provider.
• (b) Cookie banner: Decline analytics cookies on first visit, or change your choice at any time from our Cookie Policy page. Declining prevents Meta Pixel from loading.
• (c) Email opt-out: Email support@waypointbudget.com to opt out of any non-transactional emails, or to make a general consent-withdrawal request.
• (d) Delete your account: Use Profile → Manage → Security → Delete account to withdraw consent for all processing and remove your data.

Consequences of withdrawal: Some withdrawals will limit functionality. For example, disconnecting your bank stops automatic transaction sync (you can still use manual entry). Deleting your account ends all access to the Service. We will tell you in plain language what changes when you withdraw consent.

Response Time

We respond to verified privacy requests (access, correction, deletion, portability, consent withdrawal) within 30 days of receipt. If we need additional time due to the complexity of a request, we will tell you within the first 30 days and explain why.

To exercise these rights, please contact us at support@waypointbudget.com

6A. Data Accuracy

We take reasonable steps to keep the personal information we hold about you accurate, complete, and up to date for the purposes for which it is used:

• You can update your name, email, profile image, and preferences at any time from Profile → Manage.
• You can edit, recategorize, or delete any transaction you have imported, entered, or synced.
• If you spot incorrect data we hold about you that you cannot fix yourself, email support@waypointbudget.com and we will correct it.
• For bank-synced data, please remember that the source of truth is your financial institution — we display what Plaid or Flinks returns. If a transaction is wrong at the source, contact your bank.

6B. Automated Decision-Making

Under Quebec Law 25 article 12.1, we disclose the following automated processing of your personal information. None of these decisions have legal effects on you or significantly affect you in the legal sense — they are convenience features you can override.

• Transaction auto-categorization: When transactions arrive from your bank, we apply rule-based logic and an AI model (Google Gemini via OpenRouter) to suggest a category for each transaction. The category is based on the transaction's merchant, amount, and description, plus your existing categorization rules. You can change any suggested category at any time, and the system will learn from your correction.
• Money Coach AI suggestions: When you ask Money Coach a question, it analyzes your spending, budget, and goals to generate a personalized response. The data used for each query is described in Section 3 (OpenRouter & Google Gemini AI). Money Coach output is informational only and is never executed automatically against your account.
• Auto-disconnect of bank connections: If a bank connection remains in a persistent error state for 30 or more days without being reconnected, we automatically remove it along with its associated transactions. While the connection is broken, an in-app banner on the Banks page surfaces the issue so you can reconnect at any time.

Quebec residents: You may request additional information about the personal information used for any of these automated decisions, the principal factors and parameters that led to the decision, and the right to submit observations to a Waypoint Budget employee to review the decision. Contact our Privacy Officer at jamal@waypointbudget.com.

6C. Data Portability (Quebec Law 25 art. 27)

You have the right to receive a copy of the personal information you have provided to us in a structured, commonly used, technological format, and to have it transmitted to another organization where technically feasible.

• You can export your transactions and account data at any time from your Profile page in CSV format.
• For a complete data export (profile + budgets + transactions + goals + categories), email support@waypointbudget.com and we will provide a JSON/CSV bundle within 30 days.
• Transmission to another organization is supported on a best-efforts basis and depends on the receiving organization's technical ability to ingest the format.

6D. Email Communications (CASL)

We comply with Canada's Anti-Spam Legislation (CASL) and US email-marketing rules (CAN-SPAM). All commercial electronic messages we send identify Waypoint Budget Inc. as the sender, include our mailing address (Alberta, Canada), and include a clear unsubscribe link.

• Transactional emails (account confirmation, password resets, payment receipts, security alerts, support replies) are sent regardless of marketing consent because they relate directly to the Service you signed up for. These are required to operate your account and have no unsubscribe option.
• Marketing emails (newsletters, feature announcements, promotional offers) are sent only with your express consent. If we add marketing email programs in future, you will receive a separate opt-in prompt before we send any.
• Unsubscribe: Every marketing email includes a one-click unsubscribe link. We process unsubscribes within 10 business days as required by CASL.

6E. California Privacy Rights (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) gives you the following rights:

• Right to know what personal information we collect about you, the sources we collect it from, the purposes for which we use it, and the third parties we share it with
• Right to delete the personal information we have collected about you (subject to certain legal exceptions)
• Right to correct inaccurate personal information we hold about you
• Right to limit use and disclosure of sensitive personal information — applies to financial account data; you can disconnect bank connections at any time
• Right to opt out of sale or sharing for cross-context behavioral advertising
• Right to non-discrimination for exercising any of the above rights

We do not sell your personal information. We do not"sell" or"share" personal information for cross-context behavioral advertising as those terms are defined under the CCPA/CPRA.

To exercise California rights: Email support@waypointbudget.com with the subject line"California Privacy Request" or use the in-app account deletion flow described in Section 5. We may need to verify your identity before responding to a verifiable consumer request. You may also designate an authorized agent to make a request on your behalf.

Other US states: We extend equivalent access, deletion, correction, and portability rights to residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), and other US states with comparable laws. Use the same contact method above.

7. Analytics

We use analytics services to understand and improve your experience:

Vercel Analytics & Speed Insights

We use Vercel Analytics and Speed Insights to monitor basic website performance and traffic:

• Anonymous page views and visit counts
• Website performance metrics (load times, responsiveness)
• General traffic sources and referrers
• Device and browser types (aggregated)

No consent required: Vercel Analytics is privacy-first by design, uses no tracking cookies, collects no personal data, and cannot identify individual users. This is considered"strictly necessary" analytics for technical operation.

Summary: PostHog, Meta Pixel, and Google Ads conversion tracking are all gated by your cookie-banner choice — none of them load, set cookies, or fire events until you click "Accept" on the consent banner. Declining or ignoring the banner means no third-party analytics or advertising trackers run. Vercel Analytics and Vercel Speed Insights load as first-party measurement (no third-party cookies, no individual identification) and operate as strictly-necessary site analytics.

For more details about cookies we use, see our Cookie Policy.

8. Cookies, Tracking, and Global Privacy Control

We use cookies and similar technologies to enhance your experience, analyze usage, and improve our services. You can control cookie settings through your browser preferences and our in-app cookie banner.

We do not share cookie data with third parties for cross-context behavioral advertising.

Global Privacy Control (GPC)

We honor the Global Privacy Control browser signal. If your browser sends a GPC header, we treat it as an opt-out of any"sale" or"sharing" of personal information under the CCPA/CPRA and equivalent US state laws, and as a withdrawal of consent for non-essential advertising trackers (such as Meta Pixel). Note that you do not need to send GPC for us to comply with those laws — we already do not sell or share your data.

9. Children's Privacy

Our Service is not directed to children. You must be at least 16 years of age to create a Waypoint Budget account. In Quebec, the minimum age is the higher of 14 or any age set by Quebec law for consent to the processing of personal information.

We do not knowingly collect personal information from children under 16 (or under 14 in Quebec). If we become aware that we have collected personal information from a child under these ages without verifiable parental or guardian consent, we will delete it.

Google Play Families Policy: Waypoint Budget is not enrolled in Google Play's"Designed for Families" program. The app is not designed for or targeted to children.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us at support@waypointbudget.com and we will take steps to delete it.

10. Data Storage Location

Security Safeguards

We implement comprehensive security measures to protect your information:

• Encryption in Transit: All data transmitted between your device and our servers is encrypted using industry-standard TLS/SSL protocols
• Encryption at Rest: Your data is encrypted when stored in our database
• Access Controls: Strict authentication and authorization controls limit who can access your data
• SOC 2 Compliance: Our database provider (Supabase) maintains SOC 2 Type II certification for security and availability
• Regular Audits: We conduct regular security assessments and vulnerability scans
• Data Minimization: We only collect and store data necessary to provide our services

Your Rights Under Canadian Privacy Laws

Under PIPEDA, Quebec Law 25, and provincial privacy laws, you have the right to:

• Know where your data is stored (disclosed above)
• Access and update your personal information
• Request correction of inaccurate personal information
• Request deletion of your account and all associated data
• Request a copy of your data in a portable format
• Request information about security measures protecting your data
• Request information about, and to submit observations on, decisions made about you exclusively by automated processing
• File a complaint with the Privacy Commissioner of Canada or the Commission d'accès à l'information du Québec if you have concerns

For questions about data storage or to exercise your privacy rights, contact us at support@waypointbudget.com

11. Data Breach Notification

In the unlikely event of a data breach that poses a real risk of significant harm to you, we are committed to transparent and timely communication.

Our Commitment

Your Rights

• Right to be informed about data breaches that may affect your personal information
• Right to file a complaint with the Privacy Commissioner of Canada, the Commission d'accès à l'information du Québec, or your state Attorney General if you believe your privacy rights have been violated
• Right to seek remedies under PIPEDA, Quebec Law 25, or applicable US privacy laws for any harm caused by a privacy breach
• Right to request details about the breach and the steps we are taking to prevent future incidents

Prevention Measures

We apply security measures appropriate to our size and the sensitivity of the data we hold, including:

• Platform-level security monitoring provided by our infrastructure providers (Supabase, Vercel, Clerk), each of which maintains industry certifications such as SOC 2.
• Internal incident-response procedures appropriate to our current team size, with documented escalation paths.
• Encryption of sensitive data in transit (TLS 1.2+) and at rest on encrypted storage volumes managed by Supabase (AES-256). Per-row application-level encryption is not currently used.
• Multi-factor authentication and access controls

If you believe your account may have been compromised, please contact us immediately at support@waypointbudget.com

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the"Effective Date". For material changes, we will provide additional notice (such as an in-app banner or email) at least 30 days before the change takes effect. You are advised to review this Privacy Policy periodically for any changes.

Previous Versions

We maintain a record of material revisions to this policy. To request a previous version of this Privacy Policy, email support@waypointbudget.com.

App Store Privacy Labels

The disclosures in this policy are consistent with the App Store privacy nutrition labels and the Google Play Data safety declarations for the Waypoint Budget iOS and Android apps. If you spot a discrepancy, the controlling document is this Privacy Policy — please report any inconsistency to support@waypointbudget.com so we can correct the store listing.

Quebec Residents — Service in French

This Privacy Policy and the Waypoint Budget Service are currently provided in English only. A French-language version is on our product roadmap. In the meantime, if you are a Quebec resident with questions about this policy or your rights under Quebec Law 25, please email support@waypointbudget.com and we will respond as quickly as we can in English.

13. Privacy Officer / Person in Charge of the Protection of Personal Information

In accordance with PIPEDA and Quebec Law 25 (article 3.1), Waypoint Budget Inc. designates a Privacy Officer who is also the Person in Charge of the Protection of Personal Information for Quebec residents. The Privacy Officer is accountable for our compliance with this Privacy Policy and applicable Canadian privacy laws.

The Privacy Officer is responsible for:

• Responding to privacy-related inquiries and data access requests
• Investigating and responding to privacy complaints
• Overseeing breach response and regulator notifications
• Conducting privacy impact assessments for new processing activities and cross-border transfers
• Reviewing observations from individuals subject to automated decision-making
• Ensuring our data handling practices comply with PIPEDA, Quebec Law 25, and applicable US state privacy laws

Filing a Complaint

If you believe your privacy rights have been violated and are not satisfied with our response, you may file a complaint with the Office of the Privacy Commissioner of Canada:

• Website: priv.gc.ca
• Phone: 1-800-282-1376
• Mail: 30 Victoria Street, Gatineau, Quebec K1A 1H3

Quebec residents may also file a complaint with the Commission d'accès à l'information du Québec (CAI):

• Website: cai.gouv.qc.ca

California residents may contact the California Privacy Protection Agency (CPPA) or the California Attorney General. Residents of other US states with comprehensive privacy laws may contact their state Attorney General.

14. Contact Us

If you have any questions about this Privacy Policy, please contact us at support@waypointbudget.com or reach our Privacy Officer at jamal@waypointbudget.com for privacy-specific inquiries.