Privacy Policy

Service Operator

OPHIR is operated by:

General and legal inquiries: contact@joinophir.app
Privacy inquiries: privacy@joinophir.app
Support: support@joinophir.app

Plain-Language Overview

Protecting privacy is one of OPHIR's fundamental responsibilities.

We understand that financial information, budgeting information, and personal financial goals are highly sensitive. OPHIR is designed to help you understand and organize your finances while giving you meaningful control over how your personal information is collected, used, disclosed, retained, and protected.

This Privacy Policy explains:

• what personal information we collect;
• how and why we collect it;
• how we use and disclose it;
• how long we retain it;
• how we protect it;
• the rights available to you under applicable privacy law; and
• how you may exercise those rights.

This Privacy Policy applies when you use the OPHIR mobile application, websites, financial account connectivity services, budgeting and forecasting tools, analytics, AI-assisted features, customer support, or any related product or service that links to this Privacy Policy (collectively, the Service).

This overview is provided for convenience. If it conflicts with a detailed provision below, the detailed provision governs, subject always to rights that applicable law does not permit us to waive or restrict.

Privacy at a Glance

1. Scope of this Privacy Policy

This Privacy Policy describes how Soavinjato Andrianarisoa, operating as OPHIR (OPHIR, we, us, or our), collects, uses, discloses, retains, and protects personal information when you use:

• the OPHIR mobile application and websites;
• account creation and management features;
• financial institution connections;
• budgeting, categorization, forecasting, and analytics tools;
• automated financial insights and the personal financial assistant;
• customer support, notifications, and related services.

This Privacy Policy applies to personal information processed by OPHIR. Third-party services, including Plaid, Apple, Google, and your financial institution, may independently process information under their own privacy policies.

This Privacy Policy should be read together with the OPHIR Terms of Service and any notices shown when information is collected or consent is requested.

2. Our Privacy Principles

Protection of personal information is a core design principle of OPHIR.

2.1 Accountability

OPHIR is responsible for personal information under its control. The person identified in Section 24 is responsible for privacy compliance and may be contacted about our practices.

2.2 Identified Purposes

Before or at the time personal information is collected, we identify the purposes for which it is required, except where otherwise permitted or required by law.

2.3 Consent

Where required by applicable law, we obtain consent that is clear, free, informed, and given for specific purposes before collecting, using, or disclosing personal information. We present a written request for consent separately from other information where required. Consent may be express or implied depending on the sensitivity of the information and the circumstances, as permitted by law.

Where processing is based on consent, you may withdraw that consent, subject to legal or contractual restrictions and reasonable notice.

2.4 Data Minimization

We seek to collect only the personal information reasonably necessary to provide, secure, improve, and support the Service. We do not intentionally collect personal information unrelated to the purposes described in this Privacy Policy.

2.5 Limited Use and Disclosure

Personal information is used only for the identified purposes unless you authorize another purpose or the use or disclosure is permitted or required by law.

2.6 Accuracy

We take reasonable steps to keep personal information accurate, complete, and up to date for the purposes for which it is used. Because some financial information is supplied by financial institutions or data providers, you should review imported information and report material inaccuracies.

2.7 Safeguards

We maintain safeguards appropriate to the sensitivity of the personal information under our control and the reasonably foreseeable risks.

2.8 Transparency

We seek to explain our privacy practices in clear, accessible language and to make information about those practices readily available.

2.9 Individual Participation

Subject to applicable law, individuals may request access to, correction of, or additional information about personal information under our control.

2.10 Privacy by Design

Where reasonably practicable, privacy considerations are incorporated into the design, development, deployment, and ongoing operation of the Service, including new features and data-processing activities.

3. Applicable Privacy Laws

OPHIR operates from Québec and provides services primarily to individuals in Canada.

Our privacy practices are designed with regard to applicable Canadian legislation, including:

• Québec's Act respecting the protection of personal information in the private sector, as amended;
• Québec Law 25;
• the federal Personal Information Protection and Electronic Documents Act (PIPEDA), where applicable;
• applicable consumer-protection, cybersecurity, and record-retention requirements.

If mandatory law provides greater protection, that law prevails. Nothing in this Privacy Policy excludes, limits, or waives a right that cannot lawfully be excluded, limited, or waived.

4. Definitions

Personal information means information about an identifiable natural person, including information that can identify a person directly or indirectly. Financial information is generally sensitive and requires heightened protection.

Information that has been lawfully de-identified or aggregated so that it can no longer reasonably be associated with an identifiable person may not be treated as personal information where applicable law so provides. We do not attempt to re-identify properly de-identified information except for lawful purposes such as testing de-identification methods, security, or compliance.

5. Personal Information We Collect

The information collected depends on the features you use, the institutions you connect, the Plaid products enabled, your device, and your settings.

5.1 Account and Profile Information

We may collect:

• name and email address;
• region or province and preferred language;
• internal account identifier;
• authentication data and status;
• security and recovery settings;
• account creation, sign-in, and change history.

5.2 Connected Financial Account Information

Only after you initiate a connection and provide the required authorization may OPHIR and the connectivity provider receive information you permit through the connection interface. Depending on the institution and enabled products, this may include:

• financial institution name;
• account name, type, subtype, description, and masked account number;
• account and connection identifiers;
• current, available, or other displayed balances and currency;
• transaction amount, date, description, merchant, category, location, and status;
• recurring income and expense information;
• credit or liability balances, limits, interest rates, payment dates and amounts, and repayment terms;
• investment account, holding, value, and transaction information if that feature is expressly offered and authorized;
• account-holder name and contact information if required by an enabled product and authorized by you;
• connection status, errors, reauthentication needs, and consent history.

OPHIR requests only the categories needed for activated features. OPHIR is not designed to initiate payments and, unless a separate payment feature is expressly implemented and disclosed, does not request full account and routing numbers for transferring funds.

Unless OPHIR expressly states otherwise, we do not receive or store your online banking password. Authentication generally occurs in the interface of your financial institution or connectivity provider.

5.3 Information You Enter

We may collect:

• custom account names and categories;
• budgets, financial goals, and planned amounts;
• notes and corrections;
• recurring-obligation information;
• household settings;
• prompts and instructions submitted to assistant features;
• feedback, survey responses, and other information you voluntarily provide.

Do not enter online banking passwords, full payment-card numbers, one-time codes, secret keys, or other credentials in notes, support messages, or assistant prompts.

5.4 Subscription Information

Subscriptions are purchased through the Apple App Store or Google Play. We may receive limited information needed to validate and manage access, such as:

• store and subscription plan;
• subscription, trial, renewal, or cancellation status;
• transaction or receipt identifiers;
• purchase date and entitlement period;
• store country or currency;
• refund or dispute information.

OPHIR does not receive your full payment-card number from the store. Apple or Google processes payment information under its own terms and privacy policy.

5.5 Device, Technical, and Usage Information

We may automatically collect:

• device type and model;
• operating system and application version;
• language, time zone, and approximate region;
• IP address and network information;
• installation, session, and device identifiers;
• access dates and times;
• screens viewed, features used, and interaction sequence;
• crash, performance, diagnostic, and security logs;
• installation source, consent records, and notification settings.

We use this information to operate, secure, diagnose, and improve the Service, not to sell a user profile.

5.6 Communications and Support

If you contact us, we may collect your contact details, message content, attachments, technical details, request history, and information reasonably required to verify identity and resolve the matter.

5.7 Other Lawful Sources

We may receive information:

• from Plaid and financial institutions at your request;
• from Apple or Google in connection with a subscription;
• from providers of security, abuse prevention, communications, hosting, and analytics services;
• from public or government sources when lawful and necessary;
• from a person lawfully authorized to act for you.

6. How We Collect Personal Information

We collect personal information:

• directly from you when you register, configure the Service, enter information, or contact us;
• through a financial account connection you authorize;
• automatically through operation of the application, website, and server infrastructure;
• from service providers and platforms to the extent needed to provide the Service;
• when otherwise permitted or required by law.

At collection, we provide clear information about material purposes. For sensitive information, we request express consent where required. Additional contextual notices may appear before connecting an account, enabling a new feature, or using information for a new purpose.

7. Why We Collect and Use Personal Information

We may use personal information for the following purposes.

7.1 Providing the Service

• create and maintain an account;
• authenticate users and recover access;
• connect and refresh authorized financial information;
• display accounts, balances, and transactions;
• categorize transactions;
• create budgets, goals, summaries, and reports;
• calculate cash-flow estimates and forecasts;
• identify recurring transactions;
• generate alerts, explanations, and automated insights;
• synchronize settings across supported devices;
• manage subscription entitlements;
• carry out your requests and instructions.

7.2 Security and Integrity

• prevent unauthorized access, fraud, and abuse;
• detect anomalous activity;
• diagnose failures and protect infrastructure;
• maintain security logs;
• verify identity for sensitive requests;
• investigate incidents and support continuity.

7.3 Support and Communications

• respond to inquiries;
• send service, transactional, and security notices;
• communicate changes to the Service, this Privacy Policy, or the Terms of Service;
• receive feedback and assess service quality.

7.4 Improvement and Development

• analyze performance and feature use;
• correct errors and improve reliability;
• improve categorization, forecasts, and analytical methods;
• develop new features;
• conduct internal testing and quality control.

When improving models, we seek to use the minimum information necessary and, where reasonably practicable, aggregated or de-identified information. We do not use connected financial account data to train a publicly available artificial-intelligence model unless we first give a separate clear notice and obtain any express consent required by law.

7.5 Legal and Business Purposes

• comply with applicable law and valid legal process;
• maintain required records;
• protect the rights, safety, and property of users, OPHIR, and others;
• establish, exercise, or defend legal claims;
• support audits, financing, reorganization, sale, or transfer of the Service with appropriate safeguards.

We do not use personal information for a purpose that a reasonable person would consider inappropriate in the circumstances.

8. Consent and Your Choices

Depending on the context and applicable law, processing may be based on express or implied consent or on a lawful exception.

Because financial information is sensitive, we request the required authorization before connecting a financial account. Plaid or your financial institution may show the requested data categories and purposes. Your selections in that interface apply to the relevant connection.

If we intend to use or disclose information for a materially new purpose, we will provide notice and obtain new consent where required.

You may withdraw consent subject to reasonable notice and legal or contractual restrictions. Withdrawal may disconnect a financial account, stop data refreshes, or prevent us from providing a dependent feature. It does not affect the lawfulness of earlier processing or remove mandatory retention requirements.

You may:

• choose not to connect a financial account and use available manual features;
• select supported accounts during connection;
• disconnect an account in settings;
• change permissions through an available reconnection process;
• disable optional notifications or analytics settings where controls are offered;
• unsubscribe from promotional messages while continuing to receive necessary service and security messages.

9. Plaid and Financial Account Connections

OPHIR may use Plaid Technologies Inc., its Canadian affiliates, or related entities (Plaid) to establish connections with supported financial institutions.

When you use Plaid:

• you proceed through Plaid Link or your financial institution's interface;
• Plaid identifies the requested data categories and connection purpose;
• you select the institution and, where available, the accounts;
• Plaid and the institution handle authentication and transmit authorized data to OPHIR;
• OPHIR receives only the data and metadata available through the enabled products and your authorization;
• Plaid may keep consent and connection records under its own obligations and policies;
• use of Plaid is also subject to Plaid's privacy policy.

Plaid's privacy policy:
https://plaid.com/legal/#end-user-privacy-policy

Plaid Portal, where available for your connection:
https://my.plaid.com

You may disconnect an account through OPHIR settings, available Plaid tools, or your financial institution. Disconnection normally stops future refreshes but may not immediately delete information previously received by OPHIR, Plaid, or the institution. To request deletion of information held by OPHIR, use the account-deletion feature or contact privacy@joinophir.app. Plaid's separate tools and policies may apply to information it controls.

10. Automated Processing, Profiling, and AI-Assisted Features

OPHIR may use automated rules, statistical methods, and categorization models to produce budget calculations, forecasts, indicators, alerts, and suggested actions.

Such processing may:

• classify transactions;
• identify expected recurring payments or income;
• calculate projected balances and cash flow;
• flag unusual changes;
• generate explanations and personalized prompts.

Where we collect personal information using technology that can identify, locate, or profile a person, we provide the notice and activation information required by applicable law before collection.

These outputs are informational. They are not credit decisions, regulated suitability assessments, professional advice, or legally binding decisions. OPHIR does not use an exclusively automated output to decide, on behalf of a bank, whether you qualify for credit, insurance, employment, or an essential service.

You may correct available categories and source information. Contact privacy@joinophir.app with questions about a material automated output.

11. When We Disclose Personal Information

We do not sell or rent personal information. We disclose it only as necessary for the purposes described below.

11.1 Service Providers

Recipients may include:

• Plaid and other financial-data connectivity providers;
• cloud hosting, database, backup, and content-delivery providers;
• authentication, security, and abuse-prevention providers;
• performance analytics and crash-diagnostics services;
• email, notification, and customer-support providers;
• Apple and Google for subscriptions, distribution, and platform functions;
• professional advisers, auditors, insurers, and legal counsel.

Providers are authorized to process information for the contracted service and are subject to appropriate contractual, confidentiality, and security obligations, except where a provider independently determines its processing under its published policy and applicable law.

11.2 At Your Direction

We may disclose information to an institution, service, household member, or other person when you clearly direct us to do so and the relevant feature permits the disclosure.

11.3 Legal Requirements and Safety

We may disclose information when we believe in good faith that disclosure is necessary to comply with applicable law, valid court process, or a lawful request from a competent authority; protect rights or safety; investigate fraud or an incident; or establish, exercise, or defend a legal claim.

We assess legal requests and, where lawful and appropriate, limit disclosure to what is necessary.

11.4 Business Transactions

In connection with financing, reorganization, merger, asset sale, or transfer of the Service, information may be disclosed to prospective or actual participants subject to confidentiality and applicable law. A successor must comply with applicable obligations or provide notice and obtain consent where required.

12. Processing Outside Québec

OPHIR operates from Québec, but service providers, Plaid, Apple, Google, financial institutions, or infrastructure may process or store information elsewhere in Canada, in the United States, or in other countries.

Information processed in another jurisdiction may be subject to local law and accessible to courts, law-enforcement authorities, or government bodies under that law.

Before communicating personal information outside Québec, OPHIR conducts any privacy impact assessment required by law and considers the sensitivity of the information, purposes, safeguards, contractual terms, and legal framework in the destination. We use contractual and other reasonable measures intended to provide adequate protection.

For additional information about the principal categories of providers and processing locations, contact privacy@joinophir.app.

13. Retention, De-identification, and Destruction

We retain personal information only as long as reasonably necessary for the purposes described in this Privacy Policy and to meet legal, accounting, security, and contractual requirements.

Retention depends on:

• the duration of your account and subscription;
• the need to provide requested features;
• the nature and sensitivity of the information;
• limitation periods and mandatory recordkeeping;
• the need to prevent fraud, investigate incidents, and resolve disputes;
• backup and service-provider system capabilities.

After account closure, we delete or de-identify active user data according to our retention schedule unless further retention is required or permitted by law. Limited records may remain longer in security logs, backups, consent records, receipts, legal files, or provider systems.

Backups are deleted or overwritten in the ordinary cycle and are isolated from normal use until then. Properly de-identified information may be retained for analytics, security, and Service improvement.

Disconnecting a financial account stops future refreshes but is not a request to delete information already imported. To request deletion, use the account-deletion feature or contact privacy@joinophir.app.

14. How We Protect Personal Information

We use administrative, organizational, contractual, technical, and physical measures appropriate to the sensitivity of financial information and the risks, including where applicable:

• encryption in transit;
• infrastructure protections for stored information;
• role-based and need-to-know access controls;
• multi-factor authentication for administrative access;
• secrets management and a prohibition on storing online banking passwords at OPHIR;
• logging, monitoring, and detection of suspicious activity;
• updates, vulnerability management, and secure development practices;
• backups and recovery planning;
• contractual requirements for providers;
• incident-response procedures;
• periodic review of safeguards.

No system can guarantee absolute security. You are also responsible for protecting your device, password, access code, and email account. Contact support@joinophir.app promptly if you suspect compromise.

15. Confidentiality Incidents

We maintain a process to identify, assess, contain, document, and remediate incidents involving personal information.

If an incident creates a risk of serious injury or meets another notification threshold under applicable law, we will notify the competent authority and affected individuals as required and provide information about the incident, potential consequences, and recommended steps. We also maintain any incident register required by law.

16. Your Privacy Rights

Subject to applicable law and limited exceptions, you may:

• ask whether we hold personal information about you;
• request access to and a copy of that information;
• request correction of inaccurate, incomplete, or equivocal information;
• request deletion or cessation of dissemination where the law provides;
• withdraw consent to a use or disclosure;
• obtain information about purposes, collection methods, access categories, recipients, processing locations, and retention;
• request information about a material decision based exclusively on automated processing where such a right applies;
• request computerized personal information in a structured, commonly used technological format where the portability right applies;
• submit a complaint to OPHIR or a competent regulator.

16.1 How to Submit a Request

Send a written request to the person in charge of the protection of personal information:

privacy@joinophir.app

Include your name, account email address, the type of request, and enough information to locate the relevant records. Do not send an online banking password, full card number, or one-time code.

We may request reasonable identity verification to prevent unauthorized disclosure. We respond within the period required by applicable law. If we cannot fully grant a request, we will provide reasons where permitted and explain available review options.

Access is ordinarily provided without charge. Where the law permits a reasonable fee, we will give advance notice.

17. Complaints

You may first send a privacy question or complaint to privacy@joinophir.app. We will acknowledge it, conduct a fair review, and provide a substantive response within a reasonable period.

If you are not satisfied, you may contact:

Commission d'accès à l'information du Québec
https://www.cai.gouv.qc.ca

or, where applicable:

Office of the Privacy Commissioner of Canada
https://www.priv.gc.ca

Contacting OPHIR does not restrict your right to contact a competent authority.

18. Cookies and Similar Technologies

The website and application may use strictly necessary local storage, session tokens, SDKs, or similar technologies to:

• sign you in and maintain a session;
• remember settings;
• support security and prevent abuse;
• measure performance and diagnose problems;
• understand feature use.

If we use optional analytics or advertising technologies, we will provide any required notice and choice before activation. We do not use connected financial account data for cross-context tracking or third-party behavioural advertising.

You may control certain technologies through application, browser, or operating-system settings, or through a consent interface where provided. Blocking strictly necessary technologies may prevent the Service from working correctly.

19. Communications

We may send necessary notices about your account, security, financial connections, subscription, and changes to the Service. You cannot opt out of notices that are necessary to provide the Service.

Promotional communications are sent in accordance with applicable law and available consents. You may unsubscribe through the message or available settings. Unsubscribing from marketing does not stop service or security communications.

20. Children

The Service is intended for Canadian residents who are at least 18 years old and legally capable of entering into a contract. We do not knowingly direct the Service to children or knowingly collect personal information from anyone under 18.

If you believe a minor provided personal information to us, contact privacy@joinophir.app. We will review the matter and take appropriate action.

If a household-budget feature allows you to add information about another person, you must have lawful authority and any consent required from that person. Do not provide another person's information without an appropriate legal basis.

21. Third-Party Services and Links

The Service may link to Plaid, Apple, Google, financial institutions, and other third-party resources. Their activities are governed by their own terms and privacy policies. Review those policies before providing information.

This Privacy Policy does not apply to information a third party collects directly as an independent organization, although OPHIR remains responsible for its own provider selection and oversight to the extent required by law.

22. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes to the Service, technology, providers, law, or our practices.

An updated version will show a new date. For material changes, we will provide notice reasonably designed to reach you, such as through the application, email, website, or application store. We will obtain new consent before applying a materially new purpose where required by law.

We encourage you to review this Privacy Policy periodically. Previous versions may be made available where required by law or reasonably practicable.

23. Language

This Canadian English version serves as OPHIR's administrative master version. A French version is provided for users in Québec and wherever required by applicable language law. Other translations may also be provided for convenience.

Nothing in any language version limits rights that cannot be waived. Processing remains governed by applicable Québec and Canadian federal law, including, where applicable, Québec's Act respecting the protection of personal information in the private sector and PIPEDA. If different versions are inconsistent, mandatory law and the version that must legally prevail will govern.

24. Contact Information

For privacy questions, rights requests, and complaints:

privacy@joinophir.app

General and legal inquiries: contact@joinophir.app
Support: support@joinophir.app
General information: hello@joinophir.app

Do not send your online banking password, full payment-card number, one-time authentication code, or other secret credentials when contacting us.