Privacy Policy

1. Who we are

This Privacy Policy explains how Noah Dewaal ("we", "us") collects, uses, shares and protects personal information in MyFinancialOrbit (the "Service"). We follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and, for people in Quebec, the Act respecting the protection of personal information in the private sector as amended by Law 25.

Our Privacy Officer, the person responsible for protecting personal information, is Noah Dewaal, Founder. You can reach them through our contact form or by mail at 25 Ordnance Street, Unit 3002, Toronto, Ontario M6K 0E9.

2. What we collect

We only collect what we need to run the Service. You choose what financial information to enter; nothing is pulled from your bank.

• Account details: your email address and a password (stored only as a secure hash by our sign-in provider), and when you signed up and last signed in.
• What you put in your workspace: your preferred name, province, priorities, accounts and balances, transactions, budgets, goals, investments and other assets, debts, career and income details, shared expenses, scenarios, and any facts you ask Orbit to remember. This can include sensitive financial information, so please don't enter full account or card numbers, your SIN or passwords.
• Imports: CSV files, PDF statements and screenshots are read in your browser. Only the transactions you choose to import are saved; the original file is not uploaded or kept.
• Journal: topics and entries you write, and any Orbit conversations you start inside the journal.
• Ask Orbit: your questions and Orbit's answers if you choose to save conversations, and a daily count of live AI requests (used to keep the service fair and affordable).
• Plan details: whether you're on Standard or Premium, and trial dates. When payments start, our payment processor will hold your card details; we'll only receive the status of your subscription.
• Feedback, Update Requests and contact messages you send us, including the name and email address you give so we can reply.
• Technical information: our hosting provider automatically logs IP address, browser and device type, and pages requested, to deliver the site and protect it from abuse.

We do not use advertising trackers, sell personal information, or build profiles for advertising.

3. How we use it

• to provide the Service: save your workspace, sync it across your devices, show your numbers and calculate insights, budgets and forecasts;
• to personalize what you see, using the priorities and facts you've chosen to share (you can view and delete them in Settings → What Orbit knows);
• to answer your questions in Ask Orbit (see section 4);
• to sign you in, keep your account secure, prevent abuse and fix problems;
• to manage your plan and trial, and, once payments start, your subscription;
• to read and respond to your feedback and improve the Service;
• to send service messages, such as invitations, password resets and important changes to these policies;
• to meet our legal obligations.

We rely on your consent for these purposes, which you give when you agree to this policy, and on the separate choices you make in Settings (for example turning on live AI). You can withdraw consent at any time, subject to legal or contractual limits; some features may then stop working.

We don't make decisions about you based only on automated processing that have legal or similarly significant effects. Insights, suggested budgets and forecasts are produced by set rules from your own data and are shown only to you.

4. Ask Orbit and AI

By default, Ask Orbit answers using set rules that run in your browser, and nothing is sent to an AI company. Live AI is off unless you turn it on in Settings. When it's on, each question sends the following to our AI provider, currently OpenAI:

• a summary of the areas of your data you allow (totals, averages and similar figures; you can preview exactly what's shared in Settings), not individual transactions or account numbers;
• your question and up to the last 12 messages of the conversation;
• your preferred name, coaching style and facts you've asked Orbit to remember, if any;
• in the journal, only the topic you invite Orbit into.

Under OpenAI's API terms, data sent through its API isn't used to train its models by default, and may be kept for a limited time to monitor for abuse. See OpenAI's privacy policy. If we change AI provider, we'll update this policy before doing so.

5. Who we share it with

We don't sell or rent personal information. We share it only with service providers who process it on our behalf to run the Service, under contracts that require them to protect it and use it only for that purpose:

When payments start, we'll add our payment processor to this list before it's used.

We may also disclose information if the law requires it (for example a valid court order), to protect the safety of a person, or as part of a sale or transfer of the Service, in which case the new owner must protect it as described here and we'll tell you.

6. Where your information is stored

Your workspace is stored in a database in the eastern United States (North Virginia). Some of our providers are located in, or may process information in, the United States and other countries. Information processed outside your province or Canada is subject to the laws of those places, and may be accessible to their courts, law enforcement and national security authorities. We assess providers before using them and choose ones with strong security and privacy commitments.

7. Cookies and browser storage

We don't use advertising or analytics cookies. The Service uses your browser's local storage only for things it needs to work:

• keeping you signed in;
• your workspace, if you use MyFinancialOrbit without an account, and the fictional demo;
• preferences such as dismissed tips, tutorial progress and which tab you were on.

Because this storage is strictly necessary, we don't ask for a separate cookie consent. You can clear it at any time in your browser settings; you'll be signed out, and an account-free workspace will be removed.

8. How long we keep it

• Your workspace and journal: until you delete them or your account.
• Automatic daily backups of your workspace: up to 30 days, then deleted automatically.
• Live AI request counts: kept with your account until it's deleted.
• Feedback and Update Requests: kept to improve the Service. If you delete your account, they're no longer linked to you.
• Contact messages: kept as long as needed to answer them and keep a record of requests (for example, a deletion request). Ask us and we'll delete them sooner when we can.
• Hosting logs: kept by our providers for a short period under their own policies.
• When you delete your account, it's removed from our live database right away. Copies in our providers' backups are overwritten within their normal backup cycles.

9. How we protect it

We use reasonable safeguards for the sensitivity of the information: encrypted connections (HTTPS), database rules that let only you read your own data, passwords stored as secure hashes, encrypted storage at our database provider, server-only API keys, and limits on AI usage. Only you can see your workspace; our team does not browse it.

No system is perfectly secure. If a breach of security safeguards creates a real risk of significant harm to you, we'll notify you and the Privacy Commissioner of Canada (and Quebec's Commission d'accès à l'information where it applies) as the law requires, and keep a record of it.

10. Your rights and choices

You can:

• Access and download your information: Settings → Your data → Export as JSON (and Export the journal).
• Correct it: edit anything directly in the app.
• Delete it: Settings → Your data → Delete my workspace (keeps your sign-in) or Delete my account (removes everything).
• Control AI and personalization: turn live AI off, choose which areas Orbit can read, stop saving conversations, and view or delete what Orbit remembers.
• Withdraw consent or ask questions about how we handle your information, including asking for it in a structured, commonly used format.

For anything you can't do in the app, write to us through our contact form. We'll reply within 30 days and may need to confirm your identity first. If you're not satisfied, you can complain to the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d'accès à l'information.

Outside Canada. The Service is designed for people in Canada. If you live in the European Economic Area or the United Kingdom, you have rights under the GDPR, including to access, correct, delete, restrict or object to processing, and to data portability, and to complain to your local data protection authority. If you live in California, you have rights to know, delete and correct personal information; we don't sell or "share" personal information for cross-context behavioural advertising, and we don't use sensitive personal information to infer characteristics about you. Contact us at the address above to use these rights.

11. Emails

We only send emails needed to run your account, such as invitations, password resets and important notices about the Service or these policies. We won't send marketing or promotional emails unless you've agreed to receive them, as required by Canada's Anti-Spam Legislation (CASL), and every such email would include an easy way to unsubscribe.

12. Children

The Service is not intended for people under the age of majority where they live, and we don't knowingly collect their personal information. If you believe a child has created an account, contact us and we'll delete it.

13. Changes to this policy

We'll post any changes here with a new effective date. If a change is important, such as a new use of your information or a new provider that receives it, we'll tell you in the app before it applies and ask for your agreement where required. See also our Terms of Service.