Data Retention & Deletion Policy

While your account is active, Finding Wealth retains the following categories of data:

You can delete your account at any time from Account Center → Settings → Delete Account. When you delete your account:

• All Plaid access tokens are immediately revoked and financial syncing stops.
• Your profile, transactions, linked accounts, budgets, goals, and AI conversation history are deleted from our primary database.
• Your authentication record is removed.
• Backups are purged on a rolling basis — residual backup copies are removed within 30 days of deletion.

Exceptions: billing records are retained for up to 7 years to comply with applicable tax and accounting laws. Anonymized, aggregated analytics data (which cannot be traced back to you) may be retained indefinitely.

If you are unable to delete your account through the app, or wish to request deletion of a specific category of data, direct your request to the Privacy Officer through our contact page, marking it "Deletion Request" and including your registered email address. We will process verified deletion requests within 30 days.

You can disconnect a linked bank account at any time from the Live Accounts page. Disconnecting an account:

• Immediately revokes the Plaid access token for that institution.
• Stops future transaction syncing for that account.
• Removes the access token from our database.

Historical transaction data already synced from the account is retained in your account until you delete it or delete your account. You can manually delete individual transactions from the Transactions page.

Finding Wealth does not currently apply automatic deletion to inactive accounts. Your data is retained as long as your account exists. If this policy changes, we will notify you by email before any automated deletion occurs.

You have the right to receive a copy of your personal data in a structured, machine-readable format. To request a data export, direct your request to the Privacy Officer through our contact page, marking it "Data Export Request". We will fulfil verified requests within 30 days.

As required by section 3.8 of Québec's Law 25, Finding Wealth maintains a register of confidentiality incidents. An incident means unauthorized access to, use of, or communication of personal information, its loss, or any other breach of its protection.

Each entry records the date of discovery, the nature of the incident, the categories of information involved, the number of people affected, the assessment of risk of serious injury, the mitigation measures taken, and the date of any notification given. Entries are retained for five years after the incident date.

Where an incident presents a risk of serious injury, we will notify the Commission d'accès à l'information du Québec and the individuals concerned promptly, as required by section 3.5.

Canadian residents have rights under PIPEDA (or provincial equivalents including Québec's Law 25) to access, correct, and request deletion of their personal information. See the Privacy Policy and Canadian Compliance Disclaimer for more detail on your rights and how to exercise them.