Privacy Policy

1. Who we are and scope

Klyrr provides an AI-assisted personal finance organization Service for users in Canada. This Policy applies to personal information we process as an organization responsible for the Service. It does not apply to third-party websites or services that we do not control, even if linked from the Service.

By using the Service, creating an account, or submitting information, you acknowledge this Policy. Where consent is required, we obtain it through account registration, in-product controls, or other clear notices. Our Terms of Service govern use of the Service and should be read together with this Policy.

2. Personal information we collect

We collect information in the following categories, depending on how you use the Service:

• Account and profile: name, email address, phone number (optional), password (stored hashed), locale/language preference, province/territory, city, household and onboarding answers, theme preference, and similar profile fields.
• Authentication: session identifiers and cookies; Google OAuth identifiers and profile basics if you sign in with Google.
• Financial Data you provide: transactions and balances from imports; descriptions; merchants; categories; tags; budgets; recurring items; receipt photos and bank screenshots; uploaded CSV/Excel/PDF/statement files; manual entries; chat messages to the assistant; and related metadata (e.g., upload time, file name).
• Shared-file data: information about invitations, roles, and activity within shared finance files.
• Billing: subscription plan, status, trial dates, and Stripe customer/subscription identifiers. Payment card details are collected and processed by Stripe — we do not store full card numbers on Klyrr servers.
• Usage and device: approximate technical logs such as IP address, browser type, pages viewed, feature usage, referring URLs, and error diagnostics needed to operate and secure the Service.
• Communications: messages you send via the Contact form or support channels.
• Analytics: if Google Analytics is enabled, aggregated or pseudonymous usage metrics (we configure IP anonymization where supported).

We do not require your bank login password for current receipt and file-import features. Do not submit passwords, one-time codes, or full payment-card security data in uploads or chat.

3. How we use personal information

We use personal information to:

• Provide, maintain, personalize, and improve the Service;
• Authenticate users and secure accounts;
• Import, parse, categorize, search, and display Financial Data;
• Power AI features (categorization, receipt/OCR-style extraction, insights, budgets, recurring detection, assistant answers, and related automation);
• Enable shared household/finance files you configure;
• Process subscriptions, trials, invoices, and customer-portal management via Stripe;
• Send transactional emails (verification, security, billing) and, where permitted, service announcements;
• Respond to contact and support requests;
• Monitor abuse, debug errors, and protect against fraud or security threats;
• Comply with law, enforce our Terms, and establish, exercise, or defend legal claims;
• Create aggregated or de-identified statistics that do not reasonably identify you, to understand product usage and improve the Service.

4. AI processing and third-party AI providers (important)

Core features of Klyrr rely on artificial intelligence. When you use those features, we transmit relevant inputs — which may include transaction text, merchant names, amounts, categories, condensed financial summaries, receipt or screenshot images, and your assistant questions — to third-party AI providers so they can return model outputs to us.

Our primary AI provider is OpenAI, L.L.C. (and its affiliates/subprocessors). We may use additional AI or cloud processing vendors as needed to operate the Service. These providers process data as our service providers / processors for the purposes described above. They may process data on servers outside Canada, including in the United States.

We aim to send only what is reasonably needed for the requested task. We may remove or avoid sending certain direct identifiers when feasible, but Financial Data and images you upload can still be sensitive and may remain identifiable (for example, a receipt photo can show a store, location clues, card truncations, or household habits). You should assume that content sent to AI providers is processed according to those providers' enterprise/API terms and data policies in effect at the time.

We do not sell your personal information or Financial Data. We do not allow AI providers to use your Financial Data to train their general public models where our contractual terms with them prohibit that; if a provider's terms change, we will take commercially reasonable steps to maintain appropriate protections or adjust our integration. Absolute guarantees about a third party's internal systems are not possible.

By uploading Financial Data or using AI features, you consent to this cross-border AI processing. If you do not want AI processing, do not use those features and request account deletion as described below.

5. When we disclose information

We may disclose personal information to:

• Service providers / processors that host or operate the Service (for example cloud hosting such as Heroku and related infrastructure, managed PostgreSQL and Redis, email delivery, error monitoring if used, Stripe for payments, Google for OAuth/Analytics if enabled, and AI providers as described above);
• Other users you invite to a shared finance file, to the extent the file contents and permissions allow;
• Professional advisors (lawyers, accountants) under confidentiality obligations when needed;
• Authorities, courts, or counterparties when required by law, valid legal process, or to protect rights, safety, and security;
• A successor entity in a merger, acquisition, financing, or sale of assets, subject to appropriate confidentiality and continued protection consistent with this Policy.

We do not sell personal information. We do not share personal information for cross-context behavioural advertising in exchange for money. If that practice ever changes, we will update this Policy and obtain any consent required by law.

6. Cross-border transfers

Personal information may be transferred to, stored in, or processed in countries other than Canada (notably the United States), including by OpenAI, Stripe, Google, and hosting providers. While in another jurisdiction, information may be subject to the laws of that jurisdiction, including lawful access by foreign courts or authorities. We use contractual and organizational measures we consider appropriate in the circumstances, but no transfer mechanism can eliminate all residual risk.

7. Cookies, sessions, and analytics

We use essential cookies and similar technologies for authentication, security, locale preference, and session management (including across klyrr.ca and app.klyrr.ca when configured).

If Google Analytics is enabled for our properties, it may set cookies or collect usage data to help us understand traffic and feature adoption. We enable IP anonymization where the tool supports it. You can also use browser controls to block analytics cookies; essential cookies may still be required for login.

We do not currently operate a separate non-essential cookie consent banner beyond disclosures in this Policy; if regulations applicable to you require additional consent UI, we will implement it.

8. Retention

We retain personal information only as long as reasonably necessary for the purposes described in this Policy, including to provide the Service, comply with legal obligations, resolve disputes, enforce agreements, and maintain security backups. Retention periods vary by data type (for example, billing records may be kept longer than routine logs).

When you delete your account or request deletion, we will delete or de-identify personal information in our active systems within a reasonable period, except where retention is required or permitted by law (including backups that rotate on a delayed schedule, fraud prevention, or legal claims). Residual copies in third-party processor backups may persist for a limited time according to those providers' schedules.

9. Security

We implement administrative, technical, and organizational measures designed to protect personal information, which may include encryption in transit (HTTPS), encryption at rest where provided by our infrastructure, hashed passwords, access controls, and least-privilege practices.

No method of transmission or storage is 100% secure. We cannot guarantee absolute security. You are responsible for using a strong unique password and protecting your devices and email inbox. Notify us promptly of suspected unauthorized access.

10. Your privacy rights

Subject to applicable law (including PIPEDA and Quebec Law 25 where applicable), you may have the right to:

• Access personal information we hold about you;
• Request correction of inaccurate information;
• Withdraw consent where processing is based on consent (this may limit features);
• Request deletion of your account and associated personal information, subject to legal exceptions;
• Request information about categories of data, purposes, and third parties;
• File a complaint with us and, if unresolved, with the Office of the Privacy Commissioner of Canada or your provincial privacy commissioner (including the Commission d'accès à l'information du Québec for Quebec residents).

To exercise rights, use the Contact form on our website or account settings where available. We may need to verify your identity before fulfilling a request. We will respond within the timelines required by applicable law.

11. Children

The Service is intended for adults 18 years or older. We do not knowingly collect personal information from children. If you believe a child provided personal information, contact us and we will take appropriate steps to delete it.

12. Automated decision-making

Klyrr uses automated systems, including AI, to categorize transactions, extract receipt data, generate insights and scores, and answer questions. These outputs are assistive and informational. They are not used to make legally significant decisions about credit eligibility, employment, or similar regulated determinations. You can typically edit categorizations and data within the product.

13. Marketing emails

We send transactional messages related to your account. If we send promotional emails, we will do so in accordance with Canada's Anti-Spam Legislation (CASL) and provide an unsubscribe mechanism where required.

14. Changes to this Policy

We may update this Privacy Policy from time to time. We will post the revised version with a new "Last updated" date and, for material changes, provide additional notice where required by law. Continued use of the Service after the effective date constitutes acceptance of the updated Policy to the extent permitted by law.

15. Contact and privacy inquiries

For privacy questions, access or deletion requests, or complaints, contact us through https://klyrr.ca/contact (localized French URL available). We will direct inquiries to the person responsible for personal information within our organization.

Service websites: https://klyrr.ca (marketing) and https://app.klyrr.ca (application).