Privacy Policy

Thrive Technologies Inc. ("Thrive," "we," "us," or "our") is a Canadian corporation that operates the Thrive personal finance application, including our mobile app, website, and related services (collectively, the "Services"). We are committed to protecting your privacy and handling your personal information responsibly in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation.

This Privacy Policy describes how we collect, use, disclose, and safeguard your information when you use our Services. By accessing or using Thrive, you consent to the practices described in this policy.

We collect information you provide directly to us, information we obtain automatically through your use of our Services, and information from third-party sources you authorize.

Information You Provide

• Account information: Your full name, email address, and password when you create a Thrive account.
• Profile information: Any optional information you choose to add to your profile, such as financial goals or preferences.
• Communications: Any messages you send us through support channels or feedback forms.

Financial Information via Plaid

To connect your financial accounts, we use Plaid Technologies, Inc. ("Plaid") as our financial data aggregation partner. When you link a bank account or financial institution through Thrive, you authenticate directly with your institution through Plaid's secure interface. We receive and store:

• Account balances and account type/name information
• Transaction history (amount, date, merchant name, category)
• Account numbers (last four digits only for display purposes)
• Institution name and logo

Thrive uses read-only access only. We cannot move money, initiate transfers, or make changes to your financial accounts. Your banking credentials are never stored on Thrive servers.

Automatically Collected Information

• Device information (device type, operating system, app version)
• Log data (IP address, access times, pages/screens viewed, app crashes)
• Usage analytics (features used, session duration, navigation patterns)
• Push notification tokens (to send you alerts you've opted into)

We use the information we collect for the following purposes, all of which are necessary to provide and improve our Services:

• Provide core features: Display your account balances, transactions, spending summaries, budget tracking, and registered account (TFSA/RRSP/FHSA) contribution room calculations.
• Power AI features: Generate personalized financial insights, spending analysis, and recommendations through our AI co-pilot. Your financial data is used to train and refine these models in aggregated, de-identified form only.
• Account management: Create and maintain your account, authenticate your identity, and provide customer support.
• Communications: Send you transactional emails, security notifications, and — if you opt in — product updates and financial tips.
• Security and fraud prevention: Monitor for suspicious activity, enforce our Terms of Service, and protect the security of our platform.
• Legal compliance: Fulfill our obligations under applicable Canadian law, respond to lawful requests, and exercise our legal rights.
• Service improvement: Analyze usage patterns, diagnose technical issues, and develop new features.

We do not sell, rent, or trade your personal information. We share your information only in the following limited circumstances:

• Service providers: We engage trusted third-party vendors who process data on our behalf under strict contractual obligations (e.g., cloud hosting, analytics, email delivery). These vendors may only use your data to provide services to us.
• Plaid: To connect your financial accounts, data is shared with Plaid pursuant to Plaid's own Privacy Policy. You can review Plaid's privacy practices at plaid.com/legal.
• Legal requirements: We may disclose your information if required by law, court order, or government authority, or when we believe disclosure is necessary to protect rights, property, or safety.
• Business transfers: If Thrive is acquired, merged, or undergoes a restructuring, your information may be transferred as part of that transaction. We will notify you of any such change and your continued rights.
• With your consent: We may share information for any other purpose with your explicit consent.

Any third parties we work with are contractually required to handle your information securely and in accordance with PIPEDA and this Privacy Policy.

Canadian Data Residency: All personal data collected from Thrive users is stored on servers located in Canada. We do not transfer your personal data outside of Canada for storage.

Encryption: All data is encrypted at rest using AES-256 encryption and in transit using TLS 1.3 or higher. Financial data connections through Plaid use bank-grade encryption at all stages.

Access Controls: Access to personal data is restricted to Thrive employees and contractors who require it to perform their job functions. All staff with data access undergo privacy training and are bound by confidentiality obligations.

Security Practices: We employ industry-standard security measures including:

• Regular third-party security audits and penetration testing
• Multi-factor authentication for internal system access
• Continuous monitoring for unauthorized access attempts
• Incident response procedures to address any data breaches promptly

Data Retention: We retain your personal information for as long as your account is active or as needed to provide our Services. If you delete your account, we will delete or anonymize your personal data within 30 days, except where retention is required by law (e.g., tax records, fraud prevention).

Despite our efforts, no security system is impenetrable. If you believe your account has been compromised, contact us immediately at customerservice@thethriveapp.net.

As a Canadian resident, you have the following rights regarding your personal information under PIPEDA:

• Right of Access: You may request a copy of the personal information we hold about you, along with information about how it has been used and disclosed.
• Right to Correction: If your personal information is inaccurate or incomplete, you may request that we correct it.
• Right to Withdraw Consent: You may withdraw consent to our collection, use, or disclosure of your personal information at any time, subject to legal or contractual restrictions. Note that withdrawing consent may affect our ability to provide some or all Services.
• Right to Deletion: You may request the deletion of your account and associated personal data. We will process such requests within 30 days.
• Right to Complain: If you believe your privacy rights have been violated, you may file a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca.

To exercise any of these rights, contact our Privacy Officer at customerservice@thethriveapp.net. We will respond to all requests within 30 days. In some cases, we may need to verify your identity before fulfilling a request.

Our website uses cookies and similar tracking technologies to enhance your browsing experience and analyze usage. We use:

• Essential cookies: Required for the website to function properly (e.g., session management, security tokens). These cannot be disabled.
• Analytics cookies: Help us understand how visitors interact with our website. We use privacy-respecting analytics that do not track you across other websites.
• Preference cookies: Remember your settings and preferences across visits.

Our mobile application does not use cookies. It uses mobile device identifiers and analytics SDKs as described in Section 2.

You can control cookie settings through your browser settings. Disabling certain cookies may impact the functionality of our website.

Our Services integrate with or link to third-party services. These third parties have their own privacy policies, and we encourage you to review them:

• Plaid Technologies: Financial account connectivity. Plaid's privacy policy governs how they handle your banking credentials and financial data during the connection process.
• Apple App Store / Google Play Store: App distribution platforms with their own data practices.
• Cloud Infrastructure Providers: We use Canadian-based cloud infrastructure. Our providers are bound by data processing agreements consistent with PIPEDA.

Thrive is not responsible for the privacy practices of third-party services. We encourage you to read the privacy policies of any third-party services you use in connection with Thrive.

Thrive is intended for users who are 18 years of age or older. We do not knowingly collect personal information from individuals under 18. If we become aware that we have inadvertently collected personal information from a minor, we will take immediate steps to delete such information. If you believe a minor has provided personal information to us, please contact us at customerservice@thethriveapp.net.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will:

• Update the "Effective Date" at the top of this policy
• Send a notification to your registered email address
• Display a prominent notice in the Thrive app

Your continued use of the Services after the effective date of any changes constitutes your acceptance of the updated policy. We encourage you to review this policy periodically.

If you have any questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact our Privacy Officer:

If you are not satisfied with our response, you have the right to file a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca or by calling 1-800-282-1376.