Kova Privacy Policy (Draft)

Our commitments in brief

We use your financial data only to give you Kova's features and keep them secure.
We never sell your data, use it for advertising, or share it with banks or card issuers for their marketing.
No bank or card issuer pays us; we have no reason to pass them your data.
Our bank connections are read-only, and we never see your bank password.
You can disconnect accounts, download your data or delete your account at any time.

1. Who we are and what this covers

[Kova legal entity name] ("Kova", "we", "us") is an Ontario corporation. This policy explains how we collect, use, disclose and protect personal information when you use the Kova website, app and related services. We follow the Personal Information Protection and Electronic Documents Act (PIPEDA) and design our practices to meet the proposed Protecting Privacy and Consumer Data Act (Bill C-36) if it becomes law.

Our Privacy Officer is accountable for our compliance: [name], [privacy email], [registered address], Toronto, Ontario.

2. What we collect

We collect only what Kova's features need. We do not collect your Social Insurance Number, bank passwords or full payment card numbers.

Category	Examples	Source
Account details	Name, email, province, date of birth (used to confirm you are 18 or older), login details	You
Connected account data	Account names and types, balances, transactions (merchant, amount, date, category), credit card product names	Your financial institution, through [Plaid / Flinks], with your consent
Information you enter	Income, TFSA, RRSP and FHSA contribution room, first-time home buyer status, savings goals	You
Recommendations	The recommendations we generate for you, the assumptions behind them, and whether you dismissed or acted on them	Kova
Subscription and billing	Plan, billing history, last four digits and expiry of your card	You, through [Stripe]
Support	Messages you send us	You
Device and usage	IP address, device and browser type, pages used, crash logs	Automatically, when you use Kova

Account details
Examples: Name, email, province, date of birth (used to confirm you are 18 or older), login details
Source: You
Connected account data
Examples: Account names and types, balances, transactions (merchant, amount, date, category), credit card product names
Source: Your financial institution, through [Plaid / Flinks], with your consent
Information you enter
Examples: Income, TFSA, RRSP and FHSA contribution room, first-time home buyer status, savings goals
Source: You
Recommendations
Examples: The recommendations we generate for you, the assumptions behind them, and whether you dismissed or acted on them
Source: Kova
Subscription and billing
Examples: Plan, billing history, last four digits and expiry of your card
Source: You, through [Stripe]
Support
Examples: Messages you send us
Source: You
Device and usage
Examples: IP address, device and browser type, pages used, crash logs
Source: Automatically, when you use Kova

Some of this, such as income and spending, is sensitive financial information, and we protect it accordingly.

3. How we use your information

We use your information to:

show your accounts and spending in one place;
generate account, savings, debt and credit card recommendations and the estimates behind them;
check eligibility (Ontario residency, age, FHSA eligibility you confirm);
process subscriptions, send receipts, renewal reminders and service notices;
respond to support requests;
keep Kova secure, prevent fraud and fix problems;
improve our engines (for example, how merchants map to spending categories), using de-identified or aggregated data wherever possible;
meet legal obligations.

We send marketing emails only if you opt in, and you can unsubscribe at any time, as required by Canada's anti-spam law.

What we never do: sell or rent your personal information; use your financial data for advertising or ad targeting; share it with banks, card issuers or other financial companies for their marketing or underwriting; or let anyone pay us to influence your recommendations.

4. Consent

We ask for your express consent before connecting any financial account, and we explain what data that connection gives us. Each future feature that shares data with a third party (for example, an integration you choose to turn on) will ask for its own separate consent; it is never bundled into your sign-up.

You can withdraw consent at any time by disconnecting an account or closing your account. Withdrawing consent means Kova can no longer give recommendations based on that data. Some information, such as billing records, we must keep for legal reasons after you withdraw (see section 7).

5. Automated recommendations

Kova's recommendations are produced automatically by software, without a person reviewing each one. Each recommendation shows the main information and assumptions it used, such as your income, contribution room, spending period and the date card terms were last verified.

You can ask us to explain how a recommendation was made, what personal information it relied on, and to correct information you think is wrong. Automated recommendations never decide anything for you: they don't move money, open accounts or apply for products.

6. Service providers and other disclosures

We share personal information only with service providers that help us run Kova, under contracts that limit their use of it to providing services to us and require comparable protection.

Provider	Purpose	Data location
Plaid	Connecting your financial accounts (read-only)	Canada
Supabase	Database and authentication	Canada
Vercel	Website and app hosting	Canada
Railway	Recommendation engines	Canada
Stripe	Subscription payments	Canada
Google Workspace	Account and service emails	Canada

Plaid
Purpose: Connecting your financial accounts (read-only)
Data location: Canada
Supabase
Purpose: Database and authentication
Data location: Canada
Vercel
Purpose: Website and app hosting
Data location: Canada
Railway
Purpose: Recommendation engines
Data location: Canada
Stripe
Purpose: Subscription payments
Data location: Canada
Google Workspace
Purpose: Account and service emails
Data location: Canada

Some providers may process or store information outside Canada, including in the United States. There it is subject to local laws and may be accessible to authorities of that country. We prefer Canadian data residency where available.

We may also disclose personal information: when required by law or a valid legal order; to protect the rights, safety or security of users, Kova or others; or to a buyer or successor in a merger or sale of Kova, which must continue to protect it under this policy.

7. How long we keep information

We keep personal information only as long as we need it for the purposes above or as the law requires.

Information	Kept for
Connected account data and recommendations	While your account is open; deleted within 30 days after you disconnect an account (unless you choose to keep its history) or close your account
Information you enter	While your account is open; deleted within 30 days of closure
Billing and tax records	6 years, as required for business tax records
Support messages	1 years after the last message
Device and usage logs	12 months
Backups	Overwritten within 90 days

Connected account data and recommendations
Kept for: While your account is open; deleted within 30 days after you disconnect an account (unless you choose to keep its history) or close your account
Information you enter
Kept for: While your account is open; deleted within 30 days of closure
Billing and tax records
Kept for: 6 years, as required for business tax records
Support messages
Kept for: 1 years after the last message
Device and usage logs
Kept for: 12 months
Backups
Kept for: Overwritten within 90 days

After these periods, we delete information or de-identify it so it can no longer identify you.

8. Security

We protect your information with safeguards suited to its sensitivity, including encryption in transit and at rest (AES-256), access limited to staff who need it, multi-factor authentication for internal systems, row-level access controls in our database, and regular security reviews. We plan to obtain a SOC 2 Type II audit as Kova grows. No system is perfectly secure, and you should keep your login credentials private.

If a breach of our safeguards creates a real risk of significant harm to you, we will notify you and the Office of the Privacy Commissioner of Canada as soon as feasible, as PIPEDA requires, and keep a record of every breach.

9. Your rights and choices

You can:

Access the personal information we hold about you and how we've used and disclosed it;
Correct inaccurate information, most of it directly in Settings;
Download your data in a common format [planned for launch];
Disconnect any financial account at any time;
Withdraw consent or delete your account, subject to legal retention (section 7);
Ask for an explanation of any automated recommendation (section 5);
Opt out of marketing emails.

Send requests to [privacy email]. We will verify your identity and respond within 30 days, or tell you if we need more time and why. Requests are free.

10. Minors

Kova is only for people 18 and older. We do not knowingly collect information from anyone under 18; if we learn we have, we delete it.

11. Changes to this policy

We will email you at least 30 days before a material change takes effect. If a change would use your information for a new purpose, we will ask for your consent first.

12. Contact and complaints

Contact our Privacy Officer at [privacy email] or [registered address], Toronto, Ontario. If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca).