Privacy Policy

Overview

habitt Technologies Inc. is a Canadian fintech, app-first company. habitt ("habitt," "we," "us," or "our") is a personal finance app that gives you one place to see your credit, net worth, cards, bills, and rewards. This policy explains what information we collect, why, where it is kept, who can see it, and the choices you have. habitt is not a bank, lender, or insurer, and does not transfer, hold, or lend money on your behalf. This policy is written to meet our obligations under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and the provincial privacy laws that apply where you live, including Quebec's Law 25.

What we collect and why

We collect only what the features you use need. Each item below is tied to the reason we need it. Items marked "only if" are off until you turn them on, and you can turn them off again in the app at any time.

• Account details: your name, email address, phone number and a login.

  Why: To create and secure your account and to contact you about it.

• Identity verification: the details and document images you submit to our verification provider, Stripe.

  Why: To confirm you are who you say you are before we connect financial accounts.

• Linked-account data: balances, transactions and holdings from the banks, cards and brokerages you connect.

  Why: To show your net worth, bills, spending and rewards in one place.

• Card details, limited to the card name, issuer and last four digits. We never store full card numbers, expiry dates or security codes.

  Why: To tell your cards apart and work out which one to use.

• Credit report data from the credit bureaus you authorize us to check.

  Why: To show your credit score and what is affecting it.

• Phone contacts, only when you choose to find friends on habitt. The app sends a scrambled version (a hash) of each number, never the number itself, and we keep no copy. You appear in other members' matches only if "Let contacts find me" is on.

  Why: To show you friends who are already on habitt.

• Documents you choose to store in your Vault, such as a driver’s licence or passport.

  Why: To keep them in one secure place for you. We do not read or use them for anything else.

• Approximate location, only if you turn on nearby merchant recommendations.

  Why: To suggest the best card for where you are.

• Device and usage information: device model, operating system, app version, IP address and crash reports.

  Why: To keep the app working reliably, to prevent fraud and to fix problems.

• Waitlist and contact details: the email address you give us on this website, and anything you send us by email.

  Why: To tell you about your invitation and to answer your questions.

How we connect to your accounts

All account, card, and brokerage connections made through habitt are read-only. habitt can see balances and activity on connected accounts but can never move your money, open credit in your name, or make changes to your accounts. Credit score checks initiated through habitt use soft inquiries only, which do not affect your credit score, and only happen after you explicitly authorize a specific check.

How we use your information

We use your information to run and improve the habitt app, to show you your money in one place and suggest the smartest next move, to communicate with you about your account, the waitlist, and product updates, and to keep the app secure and prevent fraud. We use it only for the purposes described in this policy. If we ever want to use it for something new, we will ask you first.

We do not sell personal information, and we do not share it with advertisers.

Where we store your information

Your personal information is stored in Canada. habitt's production database, file storage and backups run in our hosting provider's Montréal, Canada region. Canadian data residency is our default for everything we add.

A small number of service providers process some of your information for us under contract. Depending on the provider, that processing can take place outside Canada, including in the United States. Information processed outside Canada may be accessible to the courts, law enforcement, or national security authorities of that country under its laws. Wherever your information is processed, habitt remains responsible for it and requires each provider to protect it to a standard consistent with this policy and to use it only to provide services to habitt. The providers are:

• Supabasehosts our database and your Vault documents (Montréal, Canada)
• Stripeverifies your identity when you sign up
• Flinksconnects your bank accounts and cards
• SnapTradeconnects your brokerage accounts
• Resenddelivers our emails
• Vercelhosts this website and counts visits
• Cloudflareprotects our waitlist form from bots (Turnstile)

Beyond these providers, we share information only with the financial institutions, credit bureaus and brokerages you ask us to connect to, or when the law requires it.

This website, cookies and analytics

makeahabitt.com does not use advertising or tracking cookies, and we do not run any third-party analytics or ad scripts. Three things run on this site. First, we count visits with Vercel Web Analytics, which works without cookies and does not identify you: it stores no identifier on your device and does not follow you to other sites. Second, our waitlist form is protected from automated abuse by Cloudflare Turnstile, which checks that a submission comes from a real browser. Cloudflare may set a short-lived cookie for that check and processes your IP address and browser signals to perform it. When you submit the form, we also use your IP address at that moment to limit repeat submissions; it is not saved with your email. Third, your browser remembers that you dismissed our cookie notice, so we do not show it again. If you contact us by email, we keep the correspondence for as long as needed to deal with your request.

How long we keep your information

We keep your personal information until you delete your account. When you delete it, the information tied to it is removed from our live systems and from our backups within 30 days. We keep information longer only where the law requires it, to resolve a dispute, or to enforce our agreements, and we tell you if that applies. One case applies today: as a payment business, habitt must keep hPay payment records and the results of identity checks for five years after your account is deleted (Canada's anti-money-laundering law). Those records are held in a locked store that only our compliance officer can read, and are deleted when the five years are up. Nothing else is kept. Waitlist email addresses are deleted when you ask to be removed (reply to the email) or when the waitlist closes, whichever comes first.

How we protect your information

We use 256-bit encryption to protect data at rest and in transit. Access to your data within habitt is restricted to what is needed to operate and support the app. If we become aware of a security breach that poses a real risk of significant harm to you, we will notify you and the Office of the Privacy Commissioner of Canada as required by law.

Your rights and choices

Under PIPEDA you have the right to:

• Access the personal information we hold about you and learn how it has been used and who it has been shared with.
• Correct anything that is inaccurate or incomplete.
• Delete your account and the personal information tied to it, apart from the payment records the law makes us keep (see above). You can do this from the app or by emailing us.
• Withdraw consent to our collection or use of your information at any time, subject to legal or contractual restrictions. Disconnect a linked account, turn off contact matching or location, or unsubscribe from emails, from within the app or by replying to the email. Withdrawing consent may mean some features stop working.

To exercise any of these rights, contact our privacy officer at privacy@makeahabitt.com. We reply within 30 days. We may ask you to confirm your identity first so we do not hand your information to someone else.

How to reach us

Our privacy officer is responsible for this policy and for how habitt handles personal information.

Questions or complaints

If you have a question or concern about how we handle your personal information, please contact us first at privacy@makeahabitt.com. If you're not satisfied with our response, you have the right to file a complaint with the Office of the Privacy Commissioner of Canada.

Changes to this policy

We may update this policy as habitt grows. We will update the date above when we do, and if a change is material we will let you know before it takes effect.