WealthAgent

WealthAgent Privacy Policy

Effective date: September 27, 2026

This Privacy Policy explains how WealthAgent collects, uses, discloses, protects, retains, and handles personal information when you use WealthAgent websites, applications, retirement planning tools, forecasts, simulations, AI-assisted features, subscriptions, billing flows, and support services.

WealthAgent handles sensitive financial planning information. Do not enter or email Social Insurance Numbers, full account numbers, passwords, identity documents, medical records, tax slips, bank statements, or other documents unless a WealthAgent feature specifically asks for them through a secure workflow.

1. Privacy at a Glance

This summary highlights important points from the full Privacy Policy. The detailed sections below explain the specific collection, use, disclosure, retention, rights, and security terms.

We collect the information needed to provide the planner, forecasts, simulations, AI-assisted planning, billing, support, account security, and legal compliance.

We do not sell personal information. We do not disclose personal information to third parties for their own third-party advertising or marketing lists.

We protect account details such as your name and email address with encryption and avoid keeping searchable copies of email addresses in plain text.

We also add extra protection for plan member names and the names you give to financial items such as accounts, income, expenses, assets, and liabilities.

Plan information sent to our AI provider (currently OpenAI, in the United States) is pseudonymized first: names and direct identifiers are replaced with generic labels and internal references that are not meant to identify you. Financial figures, dates, and assumptions are still sent so that the assistant can answer your questions.

Some planning and forecast information must remain readable to authorized WealthAgent systems so the Services can calculate forecasts, run simulations, check permissions, and work properly.

Your information may be stored or processed outside Canada, including in the United States, by our service providers. See section 12.

WealthAgent does not store full payment card numbers. Stripe handles subscription checkout, payment method updates, invoices, and payment processing.

You can contact the Privacy Officer at [email protected] for access, correction, deletion, consent, portability, or privacy complaint requests.

2. Scope

In this Policy, “WealthAgent”, “we”, “us”, and “our” mean WealthAgent Inc., 1000 Innovation Drive, Suite 500, Ottawa, ON K2K 3E7, Canada, the organization accountable for personal information collected through the Services. “You” and “your” mean the individual who uses the Services or whose personal information is processed through the Services. “Services” means the WealthAgent services described above.

“Personal information” means information about an identifiable individual, including information that can reasonably identify someone on its own or when combined with other information. Financial information, income information, family information, account information, and planning assumptions can be sensitive personal information.

This Policy applies to personal information that WealthAgent controls. If you enter information about members of your household or other people, you are responsible for having the authority and consents described in sections 5 and 19.

3. Canadian Privacy Laws

WealthAgent is designed to comply with applicable Canadian private-sector privacy laws, including the Personal Information Protection and Electronic Documents Act (PIPEDA), Alberta’s Personal Information Protection Act, British Columbia’s Personal Information Protection Act, and Quebec’s Act respecting the protection of personal information in the private sector, as amended by Law 25.

Where a substantially similar provincial private-sector law applies to personal information handled within that province, we apply that law. PIPEDA may still apply to personal information that is handled in interprovincial or international commercial activity, to federally regulated activities, or where no substantially similar provincial private-sector law applies.

Other provincial or territorial laws, professional rules, consumer protection laws, anti-spam rules, tax rules, court orders, or regulatory requirements may also apply to particular uses of the Services. Nothing in this Policy limits rights or obligations that cannot be limited under applicable law.

4. Accountability

WealthAgent is accountable for personal information under its control, including personal information transferred to service providers for processing on our behalf. We use privacy and security controls, internal access restrictions, contractual terms, and service-provider review processes intended to provide a level of protection appropriate to the sensitivity of the information.

Our privacy contact for questions, access requests, correction requests, deletion requests, portability requests, consent withdrawal, and complaints is:

Privacy Officer (and, for the purposes of Quebec law, the person in charge of the protection of personal information), WealthAgent Inc., 1000 Innovation Drive, Suite 500, Ottawa, ON K2K 3E7, Canada. Email: [email protected]

We collect, use, and disclose personal information with your consent, where required, or as otherwise permitted or required by law. Consent may be express or implied, depending on the sensitivity of the information, your reasonable expectations, and the context. Because WealthAgent handles financial planning information, we treat many categories of plan data as sensitive.

Because financial planning information is sensitive, we rely on your express consent rather than implied consent for its collection, use, and disclosure. We ask for your express consent when you create an account (by asking you to accept this Policy), before you first use AI-assisted features (so that you understand that pseudonymized plan information will be sent to a third-party AI provider outside Canada), and when you start a paid subscription. If we add a consent step after you have created your account, we will ask you to complete it the next time you sign in, before we process your information further. We do not require you to consent to any collection, use, or disclosure that is not necessary to provide the Services as a condition of using them. For less sensitive information, such as technical and usage information collected to secure and operate the Services, we may rely on implied consent.

You may withdraw consent, subject to legal or contractual restrictions and reasonable notice. Withdrawal may limit or prevent our ability to provide the Services. For example, we need account identity information to authenticate you, plan information to generate forecasts, and billing information to manage paid subscriptions.

If you provide personal information about a spouse, partner, child, dependent, beneficiary, household member, or any other person, you represent that you have lawful authority and all required consent to provide that information to WealthAgent for the purposes described in this Policy.

6. Information We Collect

We collect the categories of personal information needed to provide the Services.

Account and identity information: name, email address, authentication provider, OAuth or OpenID Connect subject identifiers, account subject ID, profile updates, roles, permissions, and account timestamps.

Plan and household information: plan names, descriptions, household members, relationships, roles, birth dates, retirement dates, projected demise dates, gender where entered, citizenship and residency assumptions, province or territory, locale, currency, inflation assumptions, health-cost assumptions, and life-expectancy assumptions.

Financial planning information: accounts, balances, investment holdings, ticker symbols, adjusted cost base, income sources, pensions, government benefits, expenses, budgets, assets, liabilities, tax treatment, schedules, beneficiaries, successors, survivor benefits, goals, withdrawal strategies, scenario changes, forecast outputs, tax estimates, stress tests, and related assumptions.

AI-assisted planning information: chat session titles, user messages, assistant responses, planning updates, generated artifacts, citations, tool events, token usage, and limited client context needed to continue an assistant session.

Billing and subscription information: billing customer records, access tier, lifecycle state, billing interval, Stripe customer IDs, Stripe subscription IDs, Stripe checkout session IDs, Stripe price and product IDs, invoice status, webhook event identifiers, and related billing event payloads.

Support and communications information: emails, support requests, issue details, error codes, request IDs, feedback, preferences, and communications we exchange with you.

Technical, security, and usage information: IP address, device and browser information, authentication token metadata, request paths, request IDs, timestamps, error logs, security events, usage limits, and service diagnostics.

We may create aggregated, anonymized, or de-identified information from personal information. We use such information only where it no longer reasonably identifies an individual or as otherwise permitted by law.

7. Sources

We collect personal information from these sources:

directly from you when you create an account, enter plan data, or contact us;

from authentication providers when you sign in, including identity claims such as name, email address, subject identifier, roles, and permissions;

from payment and billing providers when you start checkout, manage a subscription, or when billing lifecycle events are sent to WealthAgent;

from household members, collaborators, invited plan users, or other people who have authority to enter your information into a plan;

automatically through server logs, security systems, and essential service tools.

8. How We Use Information

We use personal information for purposes a reasonable person would consider appropriate in the circumstances, including to:

create, authenticate, secure, administer, and support your account;

create, maintain, calculate, forecast, simulate, and display financial plans;

generate retirement projections, cash-flow models, tax estimates, strategy outputs, stress tests, and reports;

operate AI-assisted planning features, including assistant chat, tool execution, and scenario updates;

process subscriptions, checkout, billing, cancellations, invoicing, entitlement checks, and payment-provider webhooks;

invite and manage plan users, permissions, and shared billing access;

respond to support requests, diagnose problems, and communicate service information;

maintain security, prevent fraud, detect misuse, enforce terms, rate limits, and subscription limits;

debug, test, maintain, and improve the Services using appropriate safeguards and minimization;

meet legal, accounting, tax, audit, regulatory, dispute-resolution, and recordkeeping obligations.

We do not use personal information to make credit, insurance, employment, lending, investment suitability, tax filing, legal, or regulated professional decisions about you. Where Quebec law applies, if we make a decision about you based exclusively on automated processing, we will tell you at the time, and you may ask us to explain the decision and to have it reviewed. WealthAgent outputs are informational planning outputs based on the information and assumptions provided through the Services, for you to consider in making your own decisions.

9. AI-Assisted Features

WealthAgent uses OpenAI (United States) to power assistant features. Before plan context is sent to the AI model, WealthAgent replaces display names with placeholder tokens such as member, account, income, expense, asset, liability, budget, goal, and plan placeholders. The AI request metadata uses pseudonymous identifiers, such as plan UUID and session UUID, for operational correlation. Pseudonymized plan information can still be personal information under Canadian privacy law where it could reasonably be re-associated with you, and we treat it as such.

Full AI prompt payloads are not persisted by WealthAgent as prompt records. User chat messages, assistant answers, tool events, generated artifacts, planning updates, token usage, and limited client context may be stored in WealthAgent so the assistant can continue a session, show history, enforce usage limits, and support service operation. Session messages may be pruned according to system limits.

AI service requests are logged by WealthAgent for correlation and system analysis only; those logs contain correlation UUIDs, not your name or contact details. OpenAI processes requests under its business terms and API data controls. Its standard API terms do not permit use of customer content to improve its services unless the customer explicitly agrees. OpenAI may retain prompts, responses and related information in abuse-monitoring logs for up to 30 days by default, with longer retention where required by law or reasonably necessary to protect its services or others from harm. Stored AI responses may also be retained separately as application state to support conversation continuity; under OpenAI’s standard Responses API settings, this data is stored for at least 30 days. We do not represent that AI processing is subject to a zero-data-retention arrangement.

We do not use your User Content or personal information to train artificial-intelligence models, and our AI providers are contractually prohibited from doing so. If we ever want to, we will ask for your consent first.

10. Billing

WealthAgent uses Stripe for subscription checkout, subscription management, payment method updates, invoices, and billing lifecycle events. Stripe may collect and process payment card, bank, tax, address, invoice, and transaction information under its own terms and privacy notices.

WealthAgent stores billing records needed to determine access and reconcile Stripe events, such as Stripe customer IDs, subscription IDs, checkout session IDs, prices, products, subscription status, invoice status, and webhook event payloads. WealthAgent does not store full payment card numbers.

11. Sharing

We disclose personal information only as needed for the purposes described in this Policy or as permitted or required by law. This may include disclosure to:

service providers that provide hosting, databases, encryption key management, authentication, payment processing, billing, AI processing, observability, logging, email, security, support, and infrastructure services;

authorized plan users, collaborators, household members, or billing customer members, according to the permissions and sharing choices in the Services;

payment and billing providers to create checkout sessions, manage subscriptions, process invoices, update payment methods, reconcile events, and prevent fraud;

professional advisers, auditors, insurers, legal counsel, regulators, courts, law-enforcement agencies, or government bodies where reasonably necessary or required;

a successor or prospective successor in connection with a merger, acquisition, financing, reorganization, sale of assets, change of control, insolvency, or similar business transaction, subject to appropriate safeguards.

We do not sell personal information. We do not disclose personal information to third parties for their own third-party advertising or marketing lists.

12. Transfers

Personal information may be processed, stored, or accessed in Canada and in other countries where WealthAgent or its service providers operate, including the United States and countries in the European Union. Personal information handled outside your province, territory, or country may be subject to the laws of that jurisdiction, including laws that permit access by courts, law-enforcement, and national-security authorities. Our service providers that receive personal information include:

The locations above describe primary hosting and known processing locations, not a guarantee that all processing or provider access remains in one country. We will update this list when it changes, and we will give you notice where a change involves a new country or a provider that will receive more personal information than before.

When we transfer personal information to service providers, we use contractual and other safeguards intended to provide comparable protection while the information is being processed. Where Quebec law applies, we assess relevant privacy factors before entrusting personal information outside Quebec and use written arrangements where required.

13. Protection

WealthAgent uses safeguards appropriate to the sensitivity of the information, including technical, organizational, and administrative controls. Current safeguards include:

field-level encryption at rest for direct user identity fields, including name, email, and OAuth identifier;

per-user data encryption keys for identity fields, with key-encryption keys used to wrap those data encryption keys;

deterministic HMAC email lookup digests instead of plaintext email lookup indexes;

pseudonymous subject IDs for plan ownership links so database-only access does not directly resolve plan ownership to plaintext identity;

field-level encryption for plan member names and financial entity display names for accounts, income, expenses, assets, and liabilities;

service-layer decryption so plaintext identity fields are exposed only through authorized application paths and not through general model properties;

authentication token validation through OpenID Connect and scoped plan permission checks for plan access;

redaction of known sensitive fields, tokens, authorization headers, cookies, email addresses, account numbers, Social Insurance Numbers, and similar values from validation and error logs;

pseudonymization of AI prompt context with placeholder tokens before submission to AI providers;

Stripe webhook signature verification and idempotent billing event processing;

environment-based secret management, production key separation, and a prohibition on committing production secrets to repository-managed files.

Some plan and forecast data must remain readable to authorized backend services so WealthAgent can calculate forecasts, run simulations, enforce permissions, and provide the Services without requiring a separate user unlock flow. Field-level encryption does not apply to every field, free-text field, assistant message, generated output, or operational record.

No internet, cloud, or software service can be guaranteed completely secure. You are responsible for protecting your devices, browsers, networks, passwords, exported files, printed reports, screenshots, and any information you choose to share outside WealthAgent.

14. Cookies And Similar Tools

WealthAgent and our identity, payment, hosting, security, and infrastructure providers may use cookies, local storage, session storage, tokens, or similar technologies for essential purposes such as sign-in, security, fraud prevention, session continuity, preferences, checkout, subscription management, diagnostics, and service performance. We do not use technology that identifies, locates, or profiles you for any non-essential purpose; if we ever do, it will be turned off by default and activated only with your consent.

The public marketing website is not intended to use third-party advertising cookies. If we introduce non-essential analytics, advertising, or tracking technologies that require consent, we will provide notice and choices required by applicable law.

15. Retention

We retain personal information only as long as necessary for the purposes identified in this Policy or as otherwise permitted or required by law. Retention periods depend on the type of information, sensitivity, account status, subscription status, legal requirements, dispute risk, security needs, backup cycles, and operational needs.

Account, plan, forecast, assistant, and support information is generally retained while your account or plan remains active or as needed to provide the Services. If you close your account, or if we close it, we delete or anonymize your account and plan information within 90 days, except for records that we are required or permitted to keep for longer, such as billing, transaction, invoice, and tax records (generally seven years), and security, fraud-prevention, and legal records. We preserve information needed to fulfill outstanding access or export requests and related complaints or recourse, or to comply with a legal hold, until those matters are resolved and the information may lawfully be deleted. If your account is inactive for 24 months, we will notify you before deleting it.

When personal information is no longer required, we delete, erase, or anonymize it using reasonable processes. Where Quebec law applies, anonymization follows the standards prescribed by regulation. Some information may remain temporarily in backups, logs, or disaster-recovery systems until those records expire or are overwritten.

16. Your Rights

Subject to legal limits, identity verification, and applicable exceptions, you may request:

confirmation of whether WealthAgent holds personal information about you;

access to your personal information and information about how it has been used or disclosed;

correction of inaccurate, incomplete, or outdated personal information;

deletion, erasure, or anonymization of personal information that is no longer required or that was not lawfully handled;

withdrawal of consent, subject to legal and contractual restrictions;

a copy of certain computerized personal information in a structured, commonly used technological format where required by law;

information about automated processing that produces an output about you, where required by law;

review of a privacy concern or complaint by WealthAgent’s Privacy Officer.

Quebec residents may have additional rights under Quebec’s private-sector privacy law, including portability rights for certain computerized personal information collected from them, rights related to automated decision processing, and rights to require cessation of dissemination, de-indexing, or re-indexing in limited circumstances. WealthAgent does not generally publish personal plan information to public search indexes.

Where a self-service setting is available, you may update certain information in the Services. For other requests, contact the Privacy Officer at [email protected]. We may ask for information needed to verify your identity and locate your records. We will respond within 30 calendar days. Outside Quebec, where the law allows us more time, we will tell you in writing before the 30 days end why we need it and when you will hear from us. We do not charge for access requests except where the law permits a reasonable fee, and we will tell you the fee before proceeding.

17. Complaints

If you have a privacy concern, contact the Privacy Officer first so we can review and respond. Please include enough detail for us to understand the issue, but do not send passwords, full account numbers, Social Insurance Numbers, or sensitive documents by email.

If you are not satisfied with our response, you may have the right to complain to the Office of the Privacy Commissioner of Canada or to the privacy commissioner or regulator in your province or territory, including the Alberta OIPC, the B.C. OIPC, or Quebec’s Commission d’accès à l’information where applicable.

18. Privacy Incidents

If we become aware of a breach of security safeguards or confidentiality incident involving personal information under our control, we will take reasonable steps to contain the incident, reduce the risk of harm, investigate, preserve required records, and prevent similar incidents. We keep a record of every breach of security safeguards as required by PIPEDA and a register of confidentiality incidents as required by Quebec law. Federal breach records are kept for at least 24 months after the day we determine that the breach occurred, and Quebec incident records for at least five years after we become aware of the incident.

Where required by law, we will notify affected individuals and applicable regulators as soon as feasible, which may include the Office of the Privacy Commissioner of Canada, Quebec’s Commission d’accès à l’information, Alberta’s Office of the Information and Privacy Commissioner, or another regulator with jurisdiction. We assess reportability by considering factors such as sensitivity of the information, probability of misuse, risk of significant harm or serious injury, and legal requirements in the relevant jurisdiction.

19. Minors

The Services are not directed to children. You must be at least the age of majority in your province or territory of residence to create an account. If you enter information about a minor as part of a household, dependent, or beneficiary plan, you must have lawful authority and any consent required from a parent, tutor, guardian, or other authorized representative. In Quebec, personal information about a minor under 14 may be entered only with the consent of the person having parental authority or the tutor.

20. Household and Other Third-Party Information

If you enter information about your spouse, partner, dependants, beneficiaries, or other household members, you are responsible for having the authority and consents described in sections 5 and 19. WealthAgent processes that information to provide the Services to you, and processes account, billing, security, legal, and service records for its own business and compliance purposes as described in this Policy.

21. Communications

We may send service, account, billing, security, legal, and support communications that are necessary or reasonably related to the Services. Where we send commercial electronic messages that require consent under Canada’s Anti-Spam Legislation or other applicable law, we will obtain consent or rely on another permitted basis and provide an unsubscribe mechanism where required.

22. Changes

We may update this Policy from time to time. The updated Policy will be posted on this page with an updated effective date. If a change is material, we will provide notice as required by applicable law or through reasonable service channels. Where required, we will seek consent before using or disclosing personal information for a new purpose that is materially different from the purposes described when the information was collected.

23. Contact

Questions, requests, and complaints about this Policy or WealthAgent privacy practices can be sent to the Privacy Officer at [email protected] or by mail to WealthAgent Inc., 1000 Innovation Drive, Suite 500, Ottawa, ON K2K 3E7, Canada.

For general support, email [email protected]. Do not send passwords, full account numbers, Social Insurance Numbers, or sensitive financial documents by email.