Privacy Policy

Pivox respects your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Pivox budgeting and personal finance platform (the "Service"). By using the Service, you consent to the practices described below.

1. Information We Collect

Account Information: Name, email address, country, state or province where relevant, locale, base currency preferences, consent records, and optional profile details.
Financial Data: Account names, balances, transactions, budgets, goals, and related metadata that you enter or authorize us to import via Plaid, Yodlee, or other integrations.
Usage Data: Device identifiers, app version, log files, and analytics events used to monitor performance and improve features.
Support Interactions: Messages, attachments, and feedback you provide to our support team.
Uploaded Documents: Files such as receipts, credit reports, tax documents, or consultation attachments that you choose to upload.
Authentication Data: Credentials used for email/password login, Google Sign-In tokens, and two-factor authentication (2FA) verification codes.
Session Data: Cookies and similar technologies used to maintain your authenticated session and remember your preferences.

2. How We Use Information

We process personal information to:

Deliver core Service functionality (budgeting, reporting, account reconciliation).
Authenticate users and secure access via email/password, Google Sign-In, or two-factor authentication.
Provide customer support and respond to inquiries.
Analyze feature usage and improve the Service (using aggregated, privacy-preserving metrics).
Power optional AI-assisted features, such as financial insights or document analysis, where you choose to enable them.
Present country-aware terminology, disclosures, education, and feature variations.
Comply with legal obligations, enforce Terms of Service, and prevent fraud.

3. Legal Bases and Privacy Rights

We rely on your consent for optional data processing and on contractual necessity to provide the Service. When required, we may also process data to fulfill legal obligations, protect the vital interests of users or third parties, or support legitimate business operations where permitted by law.

Privacy rights and disclosure requirements may vary depending on whether you reside in Canada, the United States, Australia, or another jurisdiction, and in some cases by province or state. We endeavor to comply with applicable privacy legislation including but not limited to Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and its provincial equivalents, applicable US state privacy laws, and Australia's Privacy Act 1988.

4. Cookies and Similar Technologies

We use cookies and similar technologies to:

Maintain your authenticated session.
Remember your preferences and settings.
Collect aggregated usage analytics to improve the Service.

You may configure your browser to refuse cookies; however, doing so may prevent certain features from functioning correctly. We do not use cookies to track you across third-party websites for advertising purposes.

Financial Data Aggregators: We use Plaid and Yodlee to connect your bank accounts and import transactions. Data shared with these providers is governed by their respective privacy policies and is limited to what is necessary for account linking and transaction retrieval.
AI Service Providers: Certain optional AI-powered features are processed via Microsoft Azure OpenAI. When you use these features, relevant data (such as uploaded documents or transaction descriptions) may be transmitted to Microsoft's infrastructure. We do not use your data to train AI models.
Cloud Infrastructure: The Service is hosted on cloud infrastructure (including Microsoft Azure and third-party server providers). These providers have access to infrastructure-level data and are bound by data processing agreements.
Other Service Providers: We engage trusted vendors for analytics, email delivery, and other operational services. These providers are bound by confidentiality and security obligations and are permitted to use your data only to perform services on our behalf.
Legal Requirements: We may disclose information if required by law, regulation, court order, or to protect the rights and safety of Pivox or others.
Business Transfers: In the event of a merger or acquisition, we may transfer information to the acquiring entity subject to this Policy.

We do not sell personal information.

6. International Transfers

Data may be stored or processed outside your province, state, or country of residence, including in Canada, the United States, or the European Union. We apply safeguards such as contractual clauses, access controls, and vendor due diligence to protect your data regardless of location.

7. Data Retention

Account and transaction data are retained while your account is active and up to 30 days after deletion to satisfy legal and disaster recovery requirements.
Export files are automatically purged 30 days after creation.
Support correspondence and audit logs are retained for up to two years unless a longer period is required by law.
Uploaded documents may follow document-specific retention rules. Where legally permitted, you may be offered a retention choice. Where law requires a specific treatment, that legal requirement overrides user preference.

8. Security

We employ technical and organizational measures including encryption in transit and at rest, limited access controls, dependency scanning, and monitoring to protect personal data. No system is 100% secure; we maintain an incident response plan to address potential breaches promptly.

9. Your Rights & Choices

Access, correct, or delete your data via in-app settings or by contacting us.
Withdraw marketing consent at any time via in-app settings or by emailing privacy@pivox.finance.
Request copies of your data exports in CSV/JSON format.
Opt out of optional AI features and manage AI data-retention preferences in-app where those controls are offered.
Manage available analytics preferences in-app.
Lodge complaints with the privacy or consumer-protection regulator that applies in your province, state, or country if you believe your rights have been violated.

We will respond to verified requests within 30 days unless law permits an extension.

10. Children's Privacy

The Service is not directed to individuals under 18. We do not knowingly collect personal information from minors. If we become aware of such data, we will delete it.

11. Updates to This Policy

We may revise this Policy to reflect service updates or legal requirements. Material changes will be notified via email or in-app messaging, and the "Effective Date" will be updated. Continued use of the Service constitutes acceptance of the revised Policy.

For questions or requests regarding this Policy, contact privacy@pivox.finance.

This page is published directly from docs/legal/PrivacyPolicy.md in the Pivox repository, so the text you see here is the reviewed source text.