SUPA Budget Privacy Policy

Last Updated: 2026-10-08

This Privacy Policy describes how SUPA Budget ("we," "us," or "our") collects, uses, discloses, retains, and otherwise processes personal information when you use our application and website (together, "the Service"). We process your personal information to provide, maintain, and improve the Service, to comply with applicable law, and for the other purposes described in this Privacy Policy. By accessing or using the Service, you acknowledge that you have read this Privacy Policy and that you consent to the collection, use, and disclosure of your personal information in accordance with it. If you do not agree with this Privacy Policy, you must not use the Service.

1. Definitions

For the purposes of this Privacy Policy, the following capitalized terms have the meanings set out below.

2. Information We Collect

We collect personal information in the categories described below. We limit our collection to what is reasonably necessary to provide and improve the Service and to fulfill the purposes set out in Section 3.

Account Information. When you create an Account, we collect information you provide to us directly, including your full name, email address, telephone number, and a password. Your password is stored only in hashed, irreversible form and is never accessible to us in plain text. We may also collect optional profile information you choose to provide, such as your preferred display name, profile photo, time zone, currency, and language.

Google Account Information (Sign in with Google). If you choose to register or log in using "Continue with Google," we request access only to your basic Google profile through the openid, email, and profile scopes. From Google we receive your name, your email address, your profile picture URL, and your unique Google account identifier. We do not request or access any other data in your Google Account, such as your Gmail messages, contacts, calendar, or Google Drive files, and we never receive your Google password.

Financial Information You Enter. The Service is a personal finance application, and you may enter information about your income, expenses, budgets, savings goals, categories, accounts, and other financial details directly into the Service. This information is stored on our servers and associated with your Account.

Financial Account Data Retrieved Through Plaid. When you choose to connect a bank account or other financial institution to the Service, we use Plaid Inc. ("Plaid") to retrieve information about that account on your behalf. The information we receive through Plaid in connection with your use of the Service includes your account name, account type, the account number mask (typically the last four digits only), the currency of the account, the current and available balances, and your transaction history (including the date, amount, description, merchant, and any category information returned by Plaid for each transaction). We do not receive, see, or store your bank login credentials, multi-factor authentication codes, or any other authentication information used to access your financial institution. Those credentials are entered directly into Plaid's secure interface and are managed exclusively by Plaid and your financial institution. We do not use Plaid's identity-verification products and accordingly do not receive your name, address, telephone number, email address, or other identifying information from your bank through Plaid.

Usage Data. When you use the Service, we automatically collect certain information about your interaction with it, including your device type, operating system and version, browser type and version, IP address, approximate geographic location derived from your IP address, the pages or screens you view, the actions you take, the dates and times of your visits, and any error or diagnostic information generated by your use of the Service. We use this information for the purposes described in Section 3.

User Content. The Service allows you to upload, submit, or generate content such as notes, attachments, custom categories, transaction descriptions, and similar materials. We store this content so that we can provide the Service to you.

AI Processing Data. Where you use AI-assisted features of the Service, including the import of transactions from text or files, we transmit the input you provide to Google Gemini AI for processing. The input may include the text or file you submit, contextual metadata, and derived structured outputs (such as parsed transactions). This data is used to deliver financial insights and recommendations to you and is not used to train Google's AI models. Google may retain this data for up to 90 days in accordance with its applicable policies.

Payment Information. All payments for the Service are processed by Stripe, our third-party payment processor. We do not collect or store your full credit card number, security code, or other complete payment instrument details. We may receive limited transaction metadata from Stripe, such as the last four digits of your card, the card brand, the billing country, the transaction status, and any subscription identifier we use to manage your subscription.

3. How We Use Your Information

We use the personal information we collect for the following purposes: to provide, operate, maintain, and improve the Service; to authenticate you and secure access to your Account; to import, categorize, display, and analyze your financial accounts, transactions, and balances within the Service, including data retrieved through Plaid; to personalize your experience by tailoring features, defaults, and recommendations to your usage patterns; to communicate with you, including by sending operational updates, security alerts, support responses, billing communications, and other notifications related to your Account; to process payments and manage subscriptions through Stripe; to generate financial insights, summaries, and recommendations through our AI processing pipeline, including Google Gemini AI; to detect, prevent, investigate, and respond to fraud, abuse, security incidents, and unauthorized access; to enforce our Terms of Use and other agreements; and to comply with our legal, regulatory, and contractual obligations, including responding to lawful requests from public authorities. Where we rely on consent as the basis for processing, you may withdraw that consent at any time as described in Section 6.a.

4. Data Sharing and Disclosure

We do not sell or rent your personal information to third parties. We share your personal information only in the limited circumstances described below.

With Service Providers. We engage third-party service providers to perform functions on our behalf, including hosting, infrastructure, analytics, customer support, communications, and similar operational activities. These service providers process personal information only on our instructions, only for the purposes for which they are engaged, and under contractual obligations requiring them to maintain appropriate security measures and to handle personal information in a manner consistent with this Privacy Policy.

With Google Gemini AI. Where you use AI-assisted features, we transmit input data to Google Gemini AI for processing as described in Section 2. AI-generated insights derived from your input may be temporarily retained by Google for up to 90 days for research and analysis. Google does not use this data to train its AI models. Google's processing of AI Processing Data is governed by Google's applicable privacy policies, which apply in addition to this Privacy Policy.

With Stripe (Payment Processor). We use Stripe to securely process payments for subscriptions and other purchases made through the Service. When you make a payment, your payment information is transmitted directly to Stripe and is not stored by SUPA Budget. Stripe processes your payment information under its own privacy and security policies and pursuant to industry-standard encryption and compliance standards. Further information about Stripe's practices is available at Stripe's support page.

With Plaid (Financial Data Aggregator). To enable you to securely link your bank accounts and other financial institutions to the Service, we use Plaid Inc. ("Plaid"), a third-party financial data aggregator. When you choose to connect a financial account, we direct you to Plaid's interface, where you authenticate with your financial institution. Plaid then retrieves Financial Account Data from that institution and transmits it to us, on your behalf, so that we can display, categorize, and analyze it within the Service.

By connecting a financial account through the Service, you expressly authorize SUPA Budget and Plaid, individually and on each other's behalf, to access, transmit, store, and process your Financial Account Data for the purpose of providing the Service to you. Plaid's collection, use, retention, and disclosure of your data, including any data Plaid retains independently of SUPA Budget, is governed by Plaid's End User Privacy Policy, currently available at https://plaid.com/legal/#end-user-privacy-policy. We strongly encourage you to review Plaid's End User Privacy Policy before connecting an account, as Plaid's data practices are independent from those described in this Privacy Policy. You may disconnect a financial account at any time and without cause from your profile settings, which will revoke our and Plaid's ongoing authorization to access that account on your behalf, as further described in Section 6.

With Affiliates. We may share personal information with our corporate affiliates that adhere to data-protection commitments at least as protective as those described in this Privacy Policy, in order to support our business operations and improve the Service.

With Your Consent. We will share your personal information with third parties not otherwise described in this Section 4 only with your explicit consent or at your direction.

For Legal Compliance. We may disclose your personal information where required to do so by law, regulation, legal process, or governmental request, including in response to subpoenas, court orders, search warrants, regulatory inquiries, or other valid legal demands. We may also disclose your personal information where we believe in good faith that disclosure is necessary to comply with applicable legal obligations.

For Protection of Rights and Safety. We may disclose your personal information where we believe in good faith that disclosure is necessary to protect against imminent harm, fraud, security incidents, or unauthorized access to or use of the Service, or to enforce our Terms of Use or other agreements.

In Connection with a Corporate Transaction. If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of our assets, your personal information may be transferred to the successor or acquiring entity as part of that transaction, subject to commitments to handle the information in a manner consistent with this Privacy Policy.

4.a. Google User Data

This section describes how SUPA Budget accesses, uses, stores, and shares information received from Google when you use "Continue with Google."

SUPA Budget's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

5. Data Security

We implement and maintain administrative, technical, and physical safeguards designed to protect your personal information against unauthorized access, use, disclosure, alteration, loss, or destruction. These safeguards include encryption of data in transit using industry-standard protocols, encryption of sensitive data at rest, access controls limiting access to personal information to authorized personnel with a legitimate business need, regular security reviews, and employee training on data protection. Bank login credentials used to connect financial accounts are entered directly into Plaid's secure interface and are never received, stored, or otherwise accessible to SUPA Budget. Payment instrument details are processed and stored by Stripe and are never received or stored by SUPA Budget. Notwithstanding these measures, no system of electronic storage or transmission is perfectly secure, and we cannot guarantee the absolute security of your information.

6. Data Retention

We retain personal information only for as long as is necessary to fulfill the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, regulatory, or reporting obligations, and as further described below.

Personal Data. We retain Account Information, financial information you enter, and User Content for as long as your Account remains active and for the limited additional periods described in this Section 6.

Usage Data. We retain Usage Data for analytics, security, and Service improvement purposes for the period reasonably necessary to fulfill those purposes, unless a longer retention period is required by applicable law.

AI Processing Data. AI input and derived data transmitted to Google Gemini AI may be retained by Google for up to 90 days under its applicable policies. We do not retain copies of raw AI input beyond what is needed to operate the Service.

Backups. We maintain automated daily backups of our database to protect against data loss. Backups are stored securely in cloud storage and are retained on a rolling schedule: daily backups for 30 days, weekly backups for an additional 4 weeks, and monthly backups for an additional 6 months. A user-initiated Account deletion or erasure request removes your data from our active systems immediately; however, residual copies may persist in existing backups for up to approximately 8 months as the backup rotation cycle completes.

Plaid Connections and Financial Account Data. When you disconnect a financial account from the Service or delete your Account, we will revoke our and Plaid's authorization to access that account on your behalf. Financial Account Data already imported into the Service is retained and deleted in accordance with the timelines described elsewhere in this Section 6. Data retained by Plaid following revocation is governed by Plaid's End User Privacy Policy, not by this Privacy Policy.

Deactivated Accounts. If you choose to deactivate your Account, your personal information and financial information will be preserved for a period of 30 days from the date of deactivation, during which you may reactivate your Account by logging back in. After the 30-day period, your Account and all associated data will be permanently and irreversibly deleted from our active systems.

User-Initiated Deletion. You may request the permanent deletion of your Account and all associated data at any time from the Account tab in your profile settings. Deletion requested in this manner is immediate and irreversible — no recovery period applies — and you will lose access to your data and any active subscription.

Payment Records. Following deletion of your Account, we and our payment processor (Stripe) may retain your billing and payment history, including your customer profile with Stripe, for the period required by applicable legal, tax, and accounting obligations. This information is retained solely for those compliance purposes, is not used to provide the Service to you, and is not accessible to you through the Service after deletion.

Legal Holds. Notwithstanding any deletion timelines described in this Section 6, we may retain personal information for longer periods where required to comply with legal obligations, to resolve disputes, or to enforce our agreements.

6.a. Your Data Rights

In accordance with applicable Canadian privacy legislation, including PIPEDA and Alberta's PIPA, you have the following rights regarding your personal information.

Right of Access. You may request a copy of the personal information we hold about you, subject to applicable legal exceptions.

Right to Correction. You may update or correct your personal information through your profile settings at any time, or by contacting us at the address below.

Right to Erasure. You may request the permanent deletion of your Account and all associated data at any time from your profile settings. We will process your deletion request immediately upon confirmation, subject to the limited retention obligations described in Section 6.

Right to Withdraw Consent. Where our processing of your personal information is based on consent, you may withdraw your consent at any time, without affecting the lawfulness of any processing that occurred before withdrawal. In particular, you may withdraw your consent to the collection and processing of Financial Account Data at any time by disconnecting the relevant financial account from your profile settings.

Express Consent for Financial Account Data. By connecting a financial account through Plaid, you provide your express, informed consent for SUPA Budget and Plaid to collect, transmit, store, and process the Financial Account Data described in Section 2 for the purposes described in this Privacy Policy. We rely on this express consent as the basis for our processing of Financial Account Data, in addition to any contractual basis arising from your use of the Service.

To exercise these rights or for any privacy-related inquiry, please contact us at support@supabudget.ca. We will respond to your request within the time period required by applicable law.

7. Tracking Technologies and Cookies

We use cookies and similar tracking technologies to operate, secure, and improve the Service. The cookies and similar technologies we use include the following.

Session Cookies. We use session cookies to operate the Service, maintain your authenticated session, and remember your selections during a single visit. These cookies are deleted when you close your browser or log out.

Preference Cookies. We use preference cookies to store your settings and preferences for future visits, such as your language, currency, or display preferences.

Security Cookies. We use security cookies to detect and prevent suspicious activity, protect against unauthorized access, and otherwise safeguard the Service.

Analytics Cookies. We use analytics cookies to understand how users interact with the Service, identify performance issues, and improve the Service.

You can manage your cookie preferences through your browser settings, although disabling certain cookies may limit your ability to use parts of the Service.

8. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, in technology, in legal requirements, or for other operational reasons. When we make changes, we will update the "Last Updated" date at the top of this Privacy Policy and post the revised version on this page. Where the changes are material, we will provide additional notice through the Service or by other appropriate means. Your continued use of the Service after the effective date of any revised Privacy Policy constitutes your acceptance of the revised Privacy Policy.

9. Law Enforcement Requests

We may disclose your personal information without prior notice to you where required to do so by law, including in response to valid legal requests from courts, regulatory authorities, or law enforcement agencies. We will limit any such disclosure to what is reasonably necessary to comply with the relevant request and applicable law.

10. Storage Outside of Canada

Your personal information may be processed and stored outside of Canada, including in jurisdictions whose privacy laws may differ from those of Canada or the province in which you reside. In particular, Plaid processes and stores Financial Account Data in the United States, subject to its End User Privacy Policy; Stripe processes payment information in jurisdictions where it operates, subject to its privacy policy; and Google Gemini AI processes AI Processing Data in jurisdictions where Google operates, subject to its applicable privacy policies. Where we transfer personal information outside of Canada, we require recipients to apply data-protection safeguards appropriate to the sensitivity of the information.

11. Accessing and Modifying Your Information

You can access and modify most of your personal information through your Account settings within the Service. For information you cannot access or modify directly, or for further assistance, please contact us at support@supabudget.ca.

12. Protecting Your Information

We take reasonable steps to safeguard the personal information we hold, proportionate to the sensitivity of the information and the risks associated with its processing. These steps include the use of secure data storage and processing environments, encryption protocols designed to protect data in transit and at rest, regular security reviews and updates, employee training on data protection, strict access controls that limit access to personal information to authorized personnel with a legitimate business need, monitoring for suspicious activity, and secure servers and infrastructure. We continually review and update our safeguards as the threat landscape and applicable best practices evolve.

13. Links to Other Websites

The Service may contain links to third-party websites, applications, or services that we do not own or control. We are not responsible for the privacy practices, content, or availability of those third parties, and this Privacy Policy does not apply to them. We encourage you to review the privacy policy of any third-party website or service before providing it with any personal information.

14. Governing Law

This Privacy Policy is governed by the laws of the Province of Alberta and the federal laws of Canada applicable therein, without regard to conflict-of-laws principles.

15. Contact Us

If you have any questions, concerns, or complaints about this Privacy Policy or our privacy practices, please contact us at support@supabudget.ca. If you are not satisfied with our response, you may have the right to lodge a complaint with the Office of the Privacy Commissioner of Canada or the Office of the Information and Privacy Commissioner of Alberta.