Privacy Policy

Last updated: August 12, 2026

1. Introduction

PennySlice (“the Service”) is operated by Zednest Tech Ltd. (“we”, “us”, “our”), registered in British Columbia, Canada. We are committed to protecting your privacy and handling your data transparently. This policy explains what information we collect, how we use it, who we share it with, and your rights regarding your data.

2. Information We Collect

2.1 Account Information

When you register, we collect:

Display name and email address
Password (stored as a one-way hash using Argon2id — we never store your plain-text password)
If you register via Google or Apple Sign-In: your name, email, and provider account identifier. We do not receive or store your third-party password.

2.2 Financial Data

When you use the Service, you may provide the following financial data:

Transactions: Merchant names, amounts, dates, categories, descriptions, and notes — entered manually or imported from bank statements
Bank statements: Files you upload (CSV, XLS, XLSX, OFX, QBO, QFX, PDF) containing transaction data
Receipts: Images you upload (PNG, JPG, JPEG, HEIC, WebP, PDF) which are processed using OCR to extract store names, items, amounts, and barcodes
Accounts: Account names, types (e.g., checking, savings, credit card), institution names, last four digits, and currency
Budgets: Monthly budget plans with per-category spending limits and income expectations
Bank-linked transactions and balances (optional, paid tiers): When you choose to link a bank account via Plaid, we receive transaction history and account balances for the accounts you select. This is entirely optional; you can instead upload your own exported bank statements at any time. See Section 2.6 (Bank-Linked Data via Plaid) for details.

What we do not collect: We never ask for or store bank login credentials, full account numbers, routing numbers, sort codes, or credit card numbers. When you link a bank via Plaid, you authenticate directly with your bank — PennySlice never receives or stores your bank password, only a revocable read-only token.

2.3 Lifestyle and Preference Data

During onboarding, you may optionally provide:

Lifestyle indicators (whether you own a car, home, have children, pets, or travel frequently) — used solely to pre-configure relevant spending categories
Preferred currency, timezone, and date format preferences
Expected monthly income
Notification delivery preferences (email, in-app, or both) for alerts, reports, and product updates
Legal consent timestamps (Terms of Service acceptance, Beta Program terms acceptance, data training opt-in preference)

2.4 Usage and Device Data

Product analytics: Page views, feature usage events, and session data (see Section 9, Analytics)
Device information: Browser type, operating system, and screen resolution — collected through analytics
IP address: Logged temporarily for security purposes (rate limiting, abuse prevention) and recorded in audit logs for security events (logins, password changes, account actions)

2.5 Payment Data

Payment processing is handled entirely by Stripe. We do not receive, process, or store your credit card number, CVV, or full billing address. We receive and store only:

Stripe customer and subscription identifiers
A card fingerprint (a Stripe-generated token, not your card number) used to prevent trial abuse across multiple accounts
Billing interval, currency, and subscription status

2.6 Bank-Linked Data via Plaid (Optional, Paid Tiers)

On paid subscription tiers (Insight, Predict, and Partner), you may optionally link one or more bank accounts directly to PennySlice using Plaid, a third-party bank connectivity provider. Bank linking is available to users in the United States and Canada at launch and requires two-factor authentication (2FA) to be enabled on your account.

When you use Plaid to link a bank account:

How it works (OAuth): You authenticate directly with your bank through Plaid’s secure interface — PennySlice never receives or stores your bank login credentials. Your bank login stays with your bank.
What we receive: A revocable, read-only access token from Plaid, and through that token: transaction history and account balances for the accounts you choose to link. We use Plaid’s Transactions and Balance products only — no money movement, payments, or identity products.
Retention: The Plaid access token is encrypted at rest and deleted immediately when you disconnect the linked account (the Plaid Item is also removed via Plaid’s /item/remove endpoint, so Plaid stops delivering data). Bank-linked transaction and balance data is deleted within 30 days of disconnection or account deletion.
Your control: You may revoke bank access at any time from your PennySlice account settings or directly through your bank. Revocation is immediate.
Plaid’s role: Plaid is a disclosed sub-processor under a Data Processing Agreement (DPA). For information on how Plaid handles your data, see Plaid’s Privacy Statement.

Bank linking is entirely optional — you can always upload your own exported bank statements instead, with no standing access granted to any third party.

2.7 Support and Communications Data

Issue reports: When you report a problem, we collect your description, the feature area, and relevant context (which may include sample transaction data, chat history, or browser information) to diagnose the issue
Contact forms: Name, email address, and message content when you contact us through our website

3. How We Use Your Information

We use your information to:

Provide the Service: Process and categorize your transactions, generate budgets, produce reports, and respond to your natural language queries
Power AI features: Generate spending predictions (Penny Spotter), what-if analysis (Penny Pulse), monthly narratives (Penny Reports), and scan receipts — all using your financial data as context
Improve categorization accuracy: Use anonymized, aggregated merchant category corrections to improve categorization for all users (see Section 6, Community AI Learning)
Send transactional communications: Email verification, password resets, two-factor authentication codes, payment receipts, subscription updates, and account security notifications
Respond to support requests: Investigate and resolve issues you report
Enforce usage limits: Track AI feature usage against your subscription tier’s allowance
Prevent fraud and abuse: Detect multi-account trial abuse, rate-limit API requests, and block disposable email addresses
Improve the Service: Analyse anonymous usage patterns to inform product decisions (see Section 9, Analytics)

4. AI Processing

PennySlice uses large language models (LLMs) to power its AI features. When you use AI-powered features, portions of your financial data are sent to our AI processing provider for real-time analysis. Here is exactly what is and is not sent:

Sent to AI provider:

Merchant names, transaction amounts, and category names
Spending summaries and patterns (e.g., totals by category)
Your chat messages (questions and follow-ups you type in the AI chat)
Receipt OCR text (extracted text from receipt images, for parsing into structured data)
Bank statement column headers and sample rows (for format detection during import)

Never sent to AI provider:

Your name or email address
Bank account numbers, routing numbers, or sort codes
Payment card details
Bank login credentials (we don’t have these)
Your IP address or device identifiers

Our AI provider processes requests in real time and does not store your data or use it to train their models. We may change AI providers over time, but the data boundaries described above will always apply.

4.1 AI Caching and Internal Model Improvement (RAG)

PennySlice uses retrieval-augmented generation (RAG) — an AI caching technique — to improve the accuracy and speed of AI responses over time. This works by storing anonymized patterns derived from how transactions are categorized and how queries are answered, so that similar future queries can be resolved faster and more accurately.

Specifically:

What is cached: Merchant-to-category mappings, transaction pattern fingerprints, and AI response patterns — not raw transaction data or personal details
Scope: AI caching is internal to PennySlice only. Cached patterns are not shared with any third party.
Future use: We may use this internally cached data to train our own private, self-hosted open-source AI models. This would allow us to reduce or eliminate reliance on external AI providers entirely, keeping more of your data within our own infrastructure. If and when we make this transition, we will notify registered users in advance.

4.2 AI Conversation Logging

We store your AI chat conversations (your messages and the AI’s responses) in our database to provide conversation history and enable you to resume chats. To request deletion of your chat history, contact us at support@pennyslice.ai. Deleting your account removes all chat history within 30 days.

4.3 Service Improvement Metadata

We log metadata about AI interactions — including feature used, processing time, and token usage — internally in our own systems to monitor service quality, enforce fair usage limits, and improve performance. This metadata does not contain your financial data or chat content; it is never forwarded to analytics providers. The link between this metadata and your user account is removed from our internal logs after 12 months.

5. What We Do NOT Do

We do not sell your personal or financial data to third parties — not to advertisers, data brokers, or anyone else
We do not require bank login credentials — you may upload your own exported bank statements, or link your bank via Plaid’s OAuth flow (where your login stays with your bank and we never receive your bank password)
We do not share your data with advertisers or use it for ad targeting
We do not share your individual financial data with external parties for model training — any AI caching or training is done internally within PennySlice’s own infrastructure
We do not share your individual transaction data with Partners — they can see budget summaries and health scores, but not your individual transactions, merchants, or receipts
We do not use third-party tracking cookies or advertising pixels

6. Community AI Learning

PennySlice uses a community-powered merchant categorization system to improve accuracy for all users. When you correct a transaction’s category:

Only the merchant name pattern and category assignment are used — no amounts, dates, account details, or personal information
A community rule is only created when multiple independent households make the same correction, ensuring no single user’s data determines a rule
You can always override community categorizations for your own account

This is the only way your usage contributes to improving the Service for others, and it is strictly limited to anonymous merchant-to-category mappings.

You may opt out of community AI learning at any time through Settings > Privacy > AI Data Training. When opted out, your category corrections and import file structures will not contribute to community rules. Your personal categorization experience remains unaffected — your individual merchant overrides continue to work normally.

7. Third-Party Services

We use a limited number of third-party services to operate PennySlice. Here is every external service, what data they receive, and what they do not:

Cerebras and Groq (AI Processing Providers)

AI inference is served by one of two providers — Cerebras or Groq. Both receive the same categories of data, are bound by the same restrictions, and may be used interchangeably; we may switch between them for availability, performance, or cost reasons without changing what is sent.

Receives: Merchant names, transaction amounts, category names, spending summaries, your chat messages, receipt OCR text, bank file column headers
Does not receive: Your name, email, bank account numbers, payment card details, IP address
Retention: Processes in real time and does not store data for training

Stripe (Payment Processing)

Receives: Payment card details (entered directly into Stripe’s hosted form), billing email, billing address
Does not receive: Your transaction data, spending patterns, or uploaded files
Purpose: Subscription billing, payment processing, invoice management

Resend (Transactional Email)

Receives: Your email address and email content (verification codes, password resets, payment receipts, account notifications)
Does not receive: Your transaction data, spending patterns, or uploaded files

Google Identity Services / Apple Sign-In (Authentication)

Receives: Authentication requests when you choose to sign in with Google or Apple
We receive from them: Your name, email, and provider account identifier
They do not receive: Any PennySlice data — the integration is authentication-only

Plaid (Bank Connectivity — Optional, Paid Tiers)

Receives: An OAuth token request and, on your behalf, retrieves transaction history and account balances for the accounts you choose to link. Plaid facilitates the authentication flow between you and your bank.
Does not receive: Your bank login credentials (you authenticate directly with your bank through Plaid’s interface — we never see your bank password). Plaid does not receive your PennySlice transaction data, uploaded files, or personal information beyond what is necessary to connect your bank account.
Products used: Transactions and Balance (read-only). No money movement; no payments or identity products.
Retention: The Plaid access token is encrypted at rest and deleted immediately upon disconnection. Bank-linked data is deleted within 30 days of disconnection or account deletion.
Lawful basis: Contract performance (you actively opt in to bank linking; consent is per-connection and revocable at any time).
Data Processing Agreement: Plaid is a disclosed sub-processor under a signed DPA. See Plaid’s Privacy Statement.

Open Exchange Rates (Exchange Rates)

Receives: Currency rate requests only — no user data is transmitted
Purpose: Providing daily exchange rates for multi-currency support
Provider: Open Exchange Rates (UK) Ltd — Privacy Policy

All self-hosted services — including our database (PostgreSQL), file storage (MinIO), caching (Redis), background processing (Celery), and OCR service (PaddleOCR) — run on our own infrastructure. Your uploaded files and financial data are not stored on third-party cloud storage services.

8. Household Data Sharing

If you create or join a household group, all members of that household share access to:

Transactions, accounts, categories, and budgets
Imported bank statement data and receipt scans
AI-generated insights and reports
Any household member may download the household’s transaction history as a CSV file or request a full data export. Because household members share access to the same financial data, any member’s export will include all household transactions.

The household owner controls who can join and whether members can edit data. If you are removed from a household, you lose access to that household’s data but retain your own account. If you are concerned about shared access, discuss permissions with your household owner before joining.

9. Analytics

We use product analytics to understand how the Service is used and to inform improvements:

Amplitude (Product Analytics)

Used on: Consumer web app, partner portal, and marketing website
Data collected: Anonymous usage events (page views, feature usage), session data, and attribution. We do not track individual element clicks or interactions.
User identification: We associate analytics events with your anonymous user ID and subscription tier for product analysis. We do not track your email address, display name, or individual financial data. We do not share analytics data with advertisers.
Financial data: No transaction data, amounts, merchant names, or budget information is sent to Amplitude

Google Analytics 4 (Marketing Website Only)

Used on: Marketing website (pennyslice.ai) only — not the consumer web app or portals
Data collected: Page views, traffic sources, geographic region, and device type
Purpose: Understanding marketing website traffic and effectiveness

We do not use advertising pixels, retargeting cookies, or any analytics that track you across other websites.

10. Data Storage and Security

All data is encrypted in transit using TLS (HTTPS)
Passwords are hashed using Argon2id (an industry-leading hashing algorithm) and are never stored in plain text
Authentication uses short-lived access tokens (15 minutes) and rotating refresh tokens, both transmitted via secure HTTP-only cookies
Two-factor authentication (TOTP and email-based) is available for additional account security
Rate limiting protects against brute-force attacks on login, registration, and password reset
Uploaded files (receipts, bank statements) are stored on our self-hosted infrastructure with access controls
Receipt images are stripped of EXIF metadata (which can contain GPS location data) before storage
Administrative access is restricted to authorised personnel and protected by role-based access controls and two-factor authentication

While we take reasonable measures to protect your data, no system is completely secure. We cannot guarantee absolute security against all threats, including but not limited to widespread breaches affecting third-party infrastructure providers, hosting services, or authentication providers (e.g., Google or Apple sign-in services) that are beyond our reasonable control.

11. Cookies and Local Storage

Cookies

Authentication cookies: HTTP-only, secure cookies for JWT access and refresh tokens. These are essential for the Service to function and cannot be disabled.
Analytics cookies: Google Analytics sets cookies on the marketing website only. These are not set on the consumer web app or portals.
We do not use third-party advertising or tracking cookies.

Local Storage

We use your browser’s local storage to remember UI preferences (e.g., selected month, collapsed sections). This data is scoped to your user account, stored only in your browser, and is not transmitted to our servers.

12. Partner Portal Data Access

If you are a client of a coach or advisor (“Partner”) on PennySlice, this section explains what personal data is shared with your coach/advisor and how it is protected.

12.1 Data Shared with Your Coach/Advisor

When you accept a partner invite, the following aggregated, non-identifiable financial data becomes visible to your coach/advisor through the Partner Portal:

Monthly budget summaries (total budgeted vs. total spent)
Spending totals aggregated by category (e.g. “Groceries: $420”)
AI-generated financial health scores
Co-branded monthly reports
Coaching notes your coach/advisor has written for you

12.2 Data NOT Shared with Your Coach/Advisor

The following personal and financial data is never visible to your coach/advisor:

Individual transaction records, amounts, or dates
Merchant names or transaction descriptions
Receipt images, scanned receipt data, or OCR text
AI chat history or conversation transcripts
Bank account details, account numbers, or institution names
Your email address, password, or login credentials
Your notification preferences or privacy settings
Import history, uploaded bank statement files, or file contents

12.3 Lawful Basis for Sharing

Data sharing with your coach/advisor is based on your explicit consent, given when you accept the partner invitation. You may withdraw this consent at any time by ending the partner relationship through your account settings. Withdrawal is immediate — your coach/advisor loses access to all your data instantly upon disconnection.

12.4 Coach/Advisor Data Modifications

Your coach/advisor may edit your budget limits for the current and future months. They cannot modify past budget data, transaction records, categories, accounts, or any other personal data. You may override any budget changes your coach/advisor makes at any time.

12.5 Coach/Advisor Obligations

Partners are bound by the Partner Terms of Service which require them to:

Treat all client data as strictly confidential
Not export, screenshot, copy, or share your financial data outside PennySlice without your explicit written consent
Not use your data for any purpose other than providing coaching services to you within PennySlice
Not retain your data outside of PennySlice after the relationship ends

PennySlice enforces these obligations through platform-level access controls. Partners cannot extract raw data — all access is through the Partner Portal interface which shows only aggregated summaries.

12.6 Ending the Relationship

When you end the partner relationship (or your coach/advisor removes you):

All coach/advisor access to your data is revoked immediately and permanently
You retain all your financial data in full — nothing is deleted
Your account moves to the free Track plan (you may upgrade independently at any time)
Coaching notes created by your coach/advisor remain visible to you as a historical record
PennySlice does not notify the coach/advisor of any data you subsequently add, modify, or delete after the relationship ends

13. Data Retention

We retain your data as follows. We reserve the right to update these retention periods with at least 30 days’ prior notice to registered users.

Account and financial data: Retained for as long as your account is active
Bank-linked data (Plaid): Transaction and balance data received via Plaid is retained while your account is active and the connection remains linked. If you disconnect a linked bank account, that data is deleted within 30 days. If you delete your account, all bank-linked data is deleted within 30 days.
Plaid access tokens: Encrypted at rest and deleted immediately upon disconnection (the Plaid Item is removed via /item/remove so Plaid also stops delivering data).
AI chat history: Retained for the duration of your account. You may request deletion of chat history by contacting support.
AI usage logs: Metadata about AI feature usage (feature name, token count, timestamp — no financial data content) is retained for up to 12 months for billing verification and service monitoring, then anonymized or deleted
Security audit logs: Records of security-relevant events (logins, password changes, account actions) including IP address and browser information are retained for up to 12 months for security and fraud prevention purposes, then deleted
Issue reports: Retained until the issue is resolved and for up to 90 days afterwards for quality assurance, then deleted
Uploaded files: Bank statements and receipt images are retained for as long as your account is active. They are deleted within 30 days of account deletion.
Payment records: Billing history and subscription records are retained for up to 7 years after your last payment as required for tax and accounting compliance
Account deletion: When you delete your account, we remove your personal and financial data within 30 days, except for data we are required to retain by law (see Payment records above)

14. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

Access: Request a copy of the personal data we hold about you
Correction: Request correction of inaccurate personal data
Deletion: Delete your account and all associated data through your account settings, or request deletion by contacting us
Data portability: Request an export of your data in a machine-readable format
Data training opt-out: You may opt out of your data being used for AI improvements through Settings > Privacy. This controls whether your category corrections and import structures contribute to community learning.
Opt out of analytics: You may use browser-level opt-out mechanisms (e.g., Do Not Track, ad blockers) to prevent analytics data collection
Withdraw consent: Where processing is based on consent, you may withdraw it at any time
Restrict processing: Request that we temporarily freeze the processing of your personal data while a dispute or accuracy concern is being resolved (GDPR Article 18)
Object to automated decisions: Our AI features analyse your financial data to provide categorization, predictions, and insights. You have the right to request human review of any significant decision made solely by automated processing, and to contest the outcome (GDPR Article 22). To request a review, contact us at privacy@pennyslice.ai

To exercise these rights, contact us at contact@pennyslice.ai. We will respond within 30 days.

14.1 Canadian Privacy Law (PIPEDA)

As a Canadian company, we comply with the Personal Information Protection and Electronic Documents Act (PIPEDA). You have the right to access your personal information, challenge its accuracy, and withdraw consent for its collection or use.

14.2 California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act and the California Privacy Rights Act (CCPA/CPRA), including:

Right to know: What personal information we collect, the categories of sources from which it is collected (directly from you, from OAuth authentication providers, from receipt images you upload, and from your browser via analytics), and how it is used
Right to delete: Request deletion of your personal information
Right to correct: Request correction of inaccurate personal information
Right to opt out of sale/sharing: We do not sell or share your personal information with third parties for cross-context behavioural advertising. Because we do not sell or share personal information, there is no need to opt out — but we provide a Do Not Sell or Share page for transparency
Right to limit use of sensitive personal information: Financial data is classified as sensitive personal information under CPRA. We use your financial data only to provide and improve the Service as described in this policy. You may request that we limit the use of your sensitive personal information to what is strictly necessary for providing the Service by contacting privacy@pennyslice.ai
Non-discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights

14.3 European Residents (GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom, you have rights under the General Data Protection Regulation (GDPR), including access, rectification, erasure, restriction of processing, data portability, and the right to object. Our lawful bases for processing are: contract performance (providing the Service), legitimate interests (security, fraud prevention, service improvement), and consent (analytics, optional features).

In accordance with GDPR Article 35, we have conducted a Data Protection Impact Assessment (DPIA) for our AI-powered financial analysis features, including automated transaction categorization, spending prediction (Penny Spotter), and what-if analysis (Penny Pulse). This assessment evaluates the risks associated with automated profiling of financial data and documents the safeguards we have in place, including AI accuracy disclaimers, user override capabilities, opt-out mechanisms, and the right to request human review. The DPIA is maintained internally and is available to supervisory authorities upon request.

15. Data Export

You can export your transaction history at any time through Settings > Privacy > Export Your Data. The export generates a CSV file containing all your transactions with dates, merchants, amounts, categories, and account names. You can also download filtered transactions directly from the Transactions page. Export files are retained on our servers for 30 days and then automatically deleted. For a complete data access request beyond transaction data, contact us at support@pennyslice.ai and we will respond within 30 days.

16. Account Deletion

You may delete your account at any time from your account settings. When you delete your account:

Your active subscription is cancelled immediately
All personal and financial data (transactions, budgets, categories, receipts, AI chat history, uploaded files, and any bank-linked data) is permanently removed within 30 days; any linked Plaid bank connections are also disconnected at this time
Referral credits associated with your account are forfeited
If you are a household owner, your household is dissolved and members lose access to shared data
Billing records are retained as required by tax law (see Data Retention)

PennySlice also offers a “Start Fresh” option that deletes all your financial data while preserving your account, subscription, and preferences.

17. Children’s Privacy

PennySlice is not directed at children under 18 and we do not knowingly collect personal information from anyone under 18. If we learn that we have collected information from a child under 18, we will delete it promptly.

18. International Data Transfers

PennySlice is operated by Zednest Tech Ltd., registered in British Columbia, Canada. Our servers and infrastructure are hosted in Canada, in Beauharnois, Quebec. Your account, transactions, budgets, uploaded files and any bank-linked data are stored at rest in Canada and are not subject to United States jurisdiction by virtue of where they are hosted.

Some of our third-party service providers do process data in the United States: Stripe (payments), Resend (email), Groq and Cerebras (AI processing), Amplitude (product analytics), Plaid (bank linking) and New Relic (application monitoring). These transfers are limited to what each provider needs to perform its function, and appropriate safeguards — including Standard Contractual Clauses where required — are in place for them. See the sub-processor disclosures above for what each provider receives.

If you are located in the European Economic Area (EEA): Canada holds an adequacy decision from the European Commission for organisations subject to PIPEDA, which was reaffirmed in January 2024. Transfers of your data to our Canadian infrastructure therefore do not require additional transfer mechanisms. Where data reaches the United States through the third-party providers listed above, we rely on appropriate transfer mechanisms such as Standard Contractual Clauses.

19. Data Breach Notification

In the event of a data breach that poses a real risk of significant harm to you, we will:

Notify affected users by email as soon as practicable, and no later than 72 hours after becoming aware of the breach
Report the breach to the Office of the Privacy Commissioner of Canada and any other applicable regulatory authorities as required by law
Provide a clear description of what happened, what data was affected, what steps we are taking to address the breach, and what you can do to protect yourself
Maintain a record of all breaches, including those that do not meet the notification threshold, as required by PIPEDA

20. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes via email at least 14 days before the changes take effect. The “last updated” date at the top of this page indicates when the policy was last revised.

21. Contact and Privacy Officer

Zednest Tech Ltd. has designated a Privacy Officer who is accountable for our compliance with applicable privacy legislation, including PIPEDA. If you have questions about this Privacy Policy, wish to exercise your data rights, or want to file a privacy complaint, contact us at:

Privacy Officer: privacy@pennyslice.ai
General inquiries: contact@pennyslice.ai
Support: support@pennyslice.ai
Mailing address: Zednest Tech Ltd., British Columbia, Canada

If you are not satisfied with our response, you may file a complaint with the Office of the Privacy Commissioner of Canada, or your local data protection authority.