1001536620 Ontario Corp., an Ontario corporation carrying on business as WealthY (“WealthY”, “we”, “us”) provides a wealth-management platform used by Canadian securities dealers, portfolio managers, financial advisors and their clients. This policy explains what personal information we collect, why we collect it, how we use it, and the rights you have under the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation.
This policy applies to WealthY’s SaaS platform, mobile applications, marketing website, and any related services (collectively, the “Service”). For client and prospect information that a firm or advisor puts into the Service, the firm is responsible for that information and WealthY processes it on the firm’s behalf, as described in section 5. WealthY is responsible for its own information: the account and sign-in details of the people who use the Service, its own sales contacts and visitors to its website.
WealthY collects a Social Insurance Number only where a firm’s account-opening or tax form requires it by law, such as tax reporting for registered accounts, and never uses it as a general identifier. A SIN is entered at the moment a form is completed, is encrypted at rest, and is visible only to the roles at the firm that need it for that form.
We rely on your consent (express for sensitive information, implied for basic contact information necessary to deliver a service you have requested), and on statutory exceptions where PIPEDA permits (fraud prevention, legal compliance, existing business relationships). Advisors and firms rely on their own legal basis when uploading client data; WealthY acts as a processor for that data.
In the WealthY apps, the first time you use a feature that sends content to an AI provider, WealthY shows you what will be sent and to which providers, and asks for your permission. Nothing is sent until you allow it. Your permission is recorded with the date. You can withdraw it at any time in your profile, under AI processing, or by writing to privacy@wealthy.to; the next AI feature then asks again.
Text is redacted before it is sent to an AI provider: in prompts, notes, email content, meeting and call transcripts, and PDFs that have a usable text layer, social insurance and social security numbers, dates of birth, full account numbers (the last four digits stay), phone numbers and email addresses are replaced with placeholders. Names, amounts, holdings and the rest of the content are sent as written, because the feature needs them. Ask WealthY’s lookups into the firm’s records go through the same redaction.
Some content is sent whole, without redaction, so it reaches the provider with every identifier it contains:
These providers process in the United States (see section 7).
When an advisor connects their Google account, WealthY accesses their Gmail messages and Google Calendar events only to provide advisor-facing features inside their own workspace: inbox triage and summaries, sending replies the advisor composes, keeping read state and labels in sync, and two-way meeting sync. WealthY's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, Google user data is never used for advertising, never sold, never used to train generalized AI or machine learning models, and is only read by humans with the user's affirmative consent, for security purposes, or where required by law. Disconnecting Google in Settings deletes the stored Google tokens and asks Google to end WealthY's access, unless the same Google account is still connected elsewhere in WealthY (on another seat, or for contact import).
The optional WealthY Form Filler extension for Chrome fills a custodian's or an account-opening web form from a client's WealthY record, on the advisor's own computer, when the advisor asks it to. It signs in with the advisor's WealthY account through the same consent as any connected app, and the firm owner or the advisor can revoke that connection at any time under Settings, API access.
Personal information is stored in Canada, in the Montréal region of our database provider. Some of it is also sent to service providers in the United States, as section 6 and the sub-processor page describe: AI reading, drafting and transcription (Google, Anthropic, OpenAI), meeting recording (Recall.ai), e-signature (Documenso), phone calls (Twilio), email delivery (Resend) and our hosting provider’s edge network (Vercel). Google’s Gemini API terms also allow short-term storage in any country where Google has facilities. Information handled outside Canada is subject to the laws of the country where it is handled, and may be accessed by its courts and authorities. Each provider is bound by its own published terms; no separate data processing agreement with a provider is on file yet. We do not sell personal information.
We retain personal information only as long as necessary for the purposes above or as required by law. Where CIRO / FINTRAC / tax rules mandate a minimum retention period (typically 7 years for regulated records), we retain accordingly. The deletion and anonymization schedule is in our data retention policy. Copies held by vendors are covered on the sub-processor page: once WealthY’s own copy is stored and checked, WealthY can delete meeting recordings at Recall.ai and call recordings at Twilio, and remove signed documents from WealthY’s Documenso account (Documenso keeps the removed file hidden rather than erasing it). These deletes are switched on vendor by vendor; until one is switched on, that vendor keeps its copy under its own terms.
Under PIPEDA and provincial privacy laws you have the right to:
To exercise these rights contact us at the address in Section 12. We respond within 30 days as required by PIPEDA.
We use technical and organizational safeguards: TLS 1.2+ in transit, AES-256 at rest, field-level encryption for social insurance numbers and other sensitive numbers, row-level security policies for tenant isolation, an authenticator app required on WealthY administrator, platform support and dealer admin seats, and audit logging of privileged actions. Details are in our security whitepaper.
In the event of a breach of security safeguards that creates a real risk of significant harm, we will notify the Office of the Privacy Commissioner of Canada and affected individuals in accordance with PIPEDA’s mandatory breach reporting requirements, and any applicable provincial rules (including Québec Law 25). We keep a written incident-response plan; its customer commitments are summarized in our security whitepaper.
1001536620 Ontario Corp.
carrying on business as WealthY
Attn: Privacy Officer
Washago, Ontario, Canada
Email: sales@wealthy.to
We will post updates to this policy on the Service and, where changes are material, provide reasonable advance notice.