Legal

Privacy policy

Draft · needs legal reviewLast updated October 2, 2026 · Also in French
The short version: your data stays in Canada, we never ask for your SIN, and you can export or delete it anytime.

1. What we collect

Account details, the receipts and bills you add, and the data we extract from them. We never collect your Social Insurance Number.

2. Where it’s stored

In Canada: AWS Canada (Central) through Supabase, including backups.

3. Who processes it

Named service providers, including our AI receipt-reading provider, bank-feed providers (Flinks, Plaid), billing (Stripe) and e-signature. Each is bound by contract; the AI provider can’t train on your data.

4. Bank access

Read-only. We store tokens in a secrets vault, never in plain columns.

5. Card numbers

We keep only the last 4 digits and mask full numbers on stored images.

6. How long we keep it

6 years after each tax year, CRA’s standard period, then deleted unless you choose to keep it longer.

7. Your rights

Access, correct, export or delete your data. Write to privacy@useclaimwise.com. Deletion completes within 30 days.

8. Quebec

A privacy impact assessment is completed before any transfer outside Quebec, per Law 25.

9. Cookies

Essential cookies keep you signed in. Analytics cookies are optional and off until you say yes. No advertising trackers.

Questions? legal@useclaimwise.com · Claimwise, Toronto, Ontario, Canada.