Privacy Policy

At Chexy, we take your privacy seriously. This Privacy Policy explains what personal information we collect, why we collect it, and how we use and share it. It covers your use of the Chexy mobile application (the “App”), website (the “Website”), and all related features and services (collectively, the “Services”).

This Policy remains in effect for as long as we hold your information, even after you stop using the Services. By using our Services and providing us with your personal information, you consent to the collection, use, and disclosure of your personal information as described in this Policy.

This Policy does not apply to information you submit directly to third parties, including the organizations and individuals with which you connect on the Services. Please refer to our Terms of Use for additional context.

We collect only the personal information necessary to provide and improve our Services, and we use that information only for the purposes described in this Policy.

What Information We Collect and When We Collect It

Personal Information

“Personal Information” is any information provided to us or generated within our Services or Website that personally identifies or could be used to identify an individual, such as your name or email address. We may combine Personal Information with other information we collect; when we do, we treat the combined information as Personal Information.

Examples of the personal information we collect include:

• Identifiers: Name, date of birth, phone number, email address, and mailing or billing address

• Identity verification information: Government-issued photo ID and Social Insurance Number (collected only where required to process tax-related payments or to comply with regulatory obligations such as those under FINTRAC)

• Financial information: Bank account details, credit and debit card data (tokenized via Evervault; we handle all payment card data in accordance with PCI DSS standards), and transaction history

• Device and usage data: Device type, operating system, IP address, session interactions, push notification tokens, and product usage

• Biometric data: If you enable biometric login on the App (e.g., Face ID or fingerprint), your biometric data is processed locally on your device and never stored on our servers. Because biometric information is sensitive, we ask for your explicit consent before enabling this feature, and you can disable it at any time in your device settings

• Rewards information: Your Aeroplan number, if you choose to provide it

• Communications: Any information you share when contacting us

Some of this information is collected on our behalf by third-party service providers. See the “Where We Send Your Personal Information” section for more detail.

Other Information

Other Information is data that does not directly identify you on its own. When we combine Other Information with Personal Information, we treat the combined data as Personal Information. We, and our third-party service providers, collect information automatically through our Services.

This may include:

• Product interaction data: Features used, pages visited, and actions taken within the App and Website

• Log data: IP address, browser type, operating system, device identifiers, and referring URLs

• Cookies and tracking technologies: See the “Cookies and Tracking Technologies” section below

• Approximate location: Inferred from your IP address

How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our Services, including processing household bill payments (e.g., rent, utilities, property taxes) and supporting credit building

• Verify your identity and prevent fraud and financial abuse

• Process transactions and send related communications, including payment confirmations and receipts

• Administer your account and fulfill the terms of any agreement with us

• Communicate with you, including sending security alerts, support messages, and service updates

• Send you personalized marketing communications by email, where you have consented

• Where you have given your consent, underwrite and assess your eligibility for Chexy Flex and determine appropriate terms, based on the financial data we retrieve from your connected bank account through Flinks

• Where you have given your consent, analyze your financial data to send you promotional materials and recommend Chexy products and offers that may be relevant to you. We use this data only to promote our own products and services, and you can withdraw this consent at any time

• Analyze usage patterns and product interactions to improve the App and Website

• Report your payment history to credit bureaus (e.g., Equifax) with your consent, as part of our credit building feature

• Comply with legal obligations, including our obligations as a registered Money Services Business (MSB) under FINTRAC and the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA)

• De-identify your information for internal reporting and trend analysis

Connecting Your Bank Account (Plaid and Flinks)

For certain Services that require a verified bank account — such as mortgage payments — we connect to your bank through trusted third-party providers, Plaid and Flinks. This lets you link your account in seconds instead of manually entering your account details and uploading a void cheque. We may use either provider depending on which offers the best experience for your bank at the time you connect.

When you connect through Plaid or Flinks, you log in directly with your bank — Chexy never sees or stores your banking username or password. Your data is tokenized and encrypted in transit and at rest, and both Plaid and Flinks have passed SOC 2 audits. Chexy receives the information needed to set up and process your payments (for example, your account and transit numbers, the name on the account, and confirmation that the account is in good standing). Where you have given your consent, we also use the financial data we retrieve through Flinks to underwrite and assess your eligibility for our Chexy Flex product, and to tailor promotional materials and product recommendations for Chexy's own products and services. We use this financial data only for these purposes, and we never sell or share it with third parties for their marketing purposes. You can withdraw your consent to these uses at any time (see “How We Use Your Information” and “Your Rights”).

Connecting through Plaid or Flinks is required only for specific products; you can continue to use Chexy’s other payment products without connecting your bank account, and you can disconnect a linked account at any time in your Account settings. For a full explanation of how this works, see our help article, How Chexy retrieves your financial information using Plaid or Flinks.

Automated Decision-Making

We use automated systems, including machine learning models, in several parts of our Services. These systems help us:

• Detect and prevent fraud and suspicious activity

• Comply with anti-money laundering (AML) and Know Your Customer (KYC) obligations

• Assess eligibility for certain features or transaction limits

• Underwrite and assess your eligibility for credit-based products such as Chexy Flex, using the financial data retrieved from your connected bank account

• Personalize aspects of your in-app experience

In some cases, these automated decisions may have a significant effect on you — for example, declining a transaction, limiting access to a feature, or flagging your account for review. Where this happens, you have the right to:

• Be informed when a decision affecting you is based exclusively on automated processing

• Request information about the main factors and parameters that led to the decision

• Request that the decision be reviewed by a human

To exercise these rights, contact us at [email protected].

Where We Send Your Personal Information

We do not sell, rent, or trade your personal information. We share it only where necessary to deliver our Services, and never for third-party advertising or profit.

We may share your information with:

• Payment Processors: We share your financial information with Zum Rails, Peoples Trust Company (PTC), Worldpay, and American Express to process bill payments on your behalf. These providers handle your data solely for payment processing purposes.

• Identity Verification and Authentication: We use Plaid for identity verification and bank account connection, Flinks for bank account connection, Trulioo for business identity verification (Chexy for Business), and Clerk for authentication and account management. All data collected through these third parties is handled in accordance with their respective privacy policies.

• Credit Reporting: With your consent, we share your payment history with Equifax for the purpose of rent reporting and credit building. You may withdraw your consent at any time.

• Communications and Support Providers: We use SendGrid and Customer.io for transactional and marketing email communications, respectively, and Intercom for customer support. These providers may have access to your name, email address, and interaction history for the purpose of delivering these services.

• Analytics and Monitoring: We use Google Analytics and BigQuery for analytics and reporting, Statsig for feature flagging and experimentation, and Datadog for application monitoring and performance tracking. Datadog may collect IP address, device information, and session data that can be linked to individual accounts through real user monitoring (RUM). We limit logging of personal information where possible, though during troubleshooting we may temporarily capture additional data.

• Rewards: If you provide your Aeroplan number, we share your name, Aeroplan number, and eligible transaction information with Air Canada to facilitate reward redemption.

• Regulatory Authorities: As a registered MSB, we are required to report certain transactions and information to FINTRAC, including suspicious transaction reports, large cash transaction reports, and electronic funds transfer reports, in accordance with the PCMLTFA.

• Legal Obligations: We may also disclose your information if required by law, court order, or a valid request from a government authority, or where we believe disclosure is necessary to prevent fraud, protect safety, or enforce our Terms of Use.

• Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction, in accordance with applicable law.

Where We Store Your Data

Your information is stored on servers maintained by our cloud service providers, predominantly located in Canada and the United States. Some of our service providers may also operate from other jurisdictions.

While we use appropriate safeguards to keep your information secure — including contractual protections with our service providers — the laws in other jurisdictions may differ from those in Canada, and authorities in those jurisdictions may access your information in accordance with their local laws.

Before transferring personal information outside of Quebec, we conduct a privacy impact assessment as required under Quebec's Act Respecting the Protection of Personal Information in the Private Sector (“Law 25”).

Cookies and Tracking Technologies

We and our service providers use cookies, pixels, and similar technologies to operate the Website and improve your experience. These fall into the following categories:

• Strictly necessary: Required for core functionality such as authentication and security. These cannot be disabled

• Analytics and performance: Used to understand how visitors interact with our Website (e.g., Google Analytics). These help us improve the product

• Functional: Remember your preferences and settings

We do not use cookies for third-party advertising. You can manage cookie preferences through your browser settings, and you can opt out of Google Analytics specifically by installing the Google Analytics Opt-out Browser Add-on.

How We Protect Your Information

We maintain appropriate administrative, technical, and physical safeguards designed to protect your personal information from unauthorized access, use, modification, and disclosure. These include compliance with PCI DSS standards for handling payment card data and an annual SOC 2 Type 2 audit covering the security, availability, and confidentiality of our systems. While we take all reasonable steps to protect your data, no transmission over the internet is completely secure.

Data Retention

We retain your personal information for as long as necessary to fulfill the purposes described in this Policy, or as required by law:

• Active account data: Retained for the duration of your account

• Financial and identity records: Retained for 7 years after account closure, in accordance with CRA and FINTRAC requirements

• Marketing data: Once you opt out, we will not send you any further marketing communications

• All other data: Deleted or de-identified when no longer necessary

If you request deletion of your personal data, it may not be possible to completely remove all information due to technological or legal constraints. We will take all reasonable steps to securely destroy or de-identify your information where full deletion is not possible.

Your Rights

You have the right to:

• Access the personal information we hold about you

• Correct or update inaccurate information

• Request deletion of your personal data

• Withdraw your consent to certain uses of your data, including credit bureau reporting, the use of your financial data for Chexy Flex underwriting, and the use of your financial data to personalize promotional materials

• Object to or restrict our processing of your data

• Request a review of any automated decision that significantly affects you

• Request that your personal information be provided to you in a structured, commonly used technological format (data portability), where applicable

• Lodge a complaint with us, the Office of the Privacy Commissioner of Canada, or (for Quebec residents) the Commission d'accès à l'information du Québec.

If you are a Quebec resident, Law 25 also provides you with the right to request that we cease disseminating your personal information or that we de-index any hyperlink that provides access to your information by technological means, where the conditions set out in Law 25 are met.

To exercise any of these rights, log into your account and visit your profile settings, or contact our Privacy Officer at [email protected]. We will respond within 30 days and aim to do so as quickly as possible.

If you require this Policy or any related information in an accessible format, please contact us and we will provide it.

Privacy Officer

We have designated a Privacy Officer who is responsible for our compliance with this Policy and applicable privacy laws. You can reach our Privacy Officer with any questions, concerns, or requests regarding your personal information at:

Email: [email protected]

Data Breach Notification

We maintain internal procedures to detect, contain, and respond to privacy breaches in a timely manner. In the event of a breach involving your personal information:

• Where the breach poses a real risk of significant harm to you, we will notify you and the Office of the Privacy Commissioner of Canada (OPC) as required under PIPEDA.

• Where the breach poses a risk of serious injury to a Quebec resident, we will also notify the Commission d'accès à l'information du Québec (CAI) and the affected individuals as required under Law 25.

• As required under Law 25, we maintain an internal register of confidentiality incidents.

Children's Privacy

The Services are intended for individuals who are 18 years of age or older. We do not knowingly collect personal information from anyone under 18. If you believe someone under 18 has provided us with information, please contact us and we will promptly delete it. We do not market to minors under any circumstance.

Marketing Communications

From time to time, we may send you email communications about Chexy products, services, or promotions in accordance with Canada's Anti-Spam Legislation (CASL). Where you have given your consent, we may tailor these promotional materials and product recommendations based on your financial data; we use this data only to promote our own products and services and never share it with third parties for their marketing purposes. You can opt out at any time by clicking the unsubscribe link in any marketing email or by contacting us at [email protected]. Please note that transactional and account-related messages are not subject to opt-out.

Governing Law

This Policy is governed by the laws of the Province of Ontario and the federal laws of Canada applicable therein, including the Personal Information Protection and Electronic Documents Act (PIPEDA). If you are a resident of Quebec, additional rights apply under Quebec's Act Respecting the Protection of Personal Information in the Private Sector (Law 25).

Changes to This Policy

We may update this Privacy Policy periodically. If we make material changes, we will notify you by email or through a notice on our Services before they take effect. Continued use of the Services after that date means you accept the updated Policy.

Contact Us

If you have questions, wish to exercise your rights, or want to make a complaint about how we handle your personal information, please contact our Privacy Officer:

Email: [email protected]

Website: www.chexy.co