Privacy Policy

Zenny Books Inc. ("Zenny", "we", "us", or "our") operates the Zenny financial management platform accessible at zennybooks.com. This Privacy Policy explains how we collect, use, disclose, and protect personal information when you use our services.

We are incorporated in British Columbia, Canada, and serve users across Canada and the United States. Because we transfer personal information to third-party processors located in the United States in the course of providing our services, Canada's federal Personal Information Protection and Electronic Documents Act (PIPEDA) applies to our data handling practices. We also comply with the California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA) for California residents.

By using Zenny, you acknowledge that you have read and understood this Privacy Policy. If you do not agree, please do not use our services.

We use your personal information only for the following purposes:

• Providing, maintaining, and improving the Zenny platform
• Processing your subscription and payments through Stripe
• Connecting your bank accounts and retrieving financial data through Plaid
• Generating AI-powered financial insights, categorizations, and analytics
• Communicating with you about your account, service updates, and support requests
• Detecting and preventing fraud, abuse, and security incidents
• Complying with legal obligations
• Generating de-identified, aggregated analytics about how the service is used (we never sell or share individually identifiable data)

We will not use your personal information for any purpose not listed above without obtaining your prior consent.

Under PIPEDA, we process personal information on the basis of your informed consent (which you provide when you create an account and agree to these terms), and where processing is necessary to perform our contractual obligations to you. Some processing is required to comply with legal obligations such as tax and financial recordkeeping requirements.

For California residents, the CCPA categories of personal information we collect include: identifiers, financial information, commercial information, internet/network activity information, geolocation data (limited, from IP), and inferences drawn from the above to create a profile about your financial preferences and habits.

We do not sell or rent your personal information. We share your information only as follows:

• Service providers: We share information with the third-party processors listed in Section 7 solely to provide our services. Each processor is bound by a Data Processing Agreement restricting their use of your data.
• Legal requirements: We may disclose your information if required by law, court order, or regulation, or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
• Business transfers: If Zenny is involved in a merger, acquisition, or sale of assets, your information may be transferred. We will notify you before your personal information becomes subject to a different privacy policy.
• With your consent: We may share your information for any other purpose with your prior consent.

California residents: We do not "sell" or "share" your personal information as defined under the CCPA/CPRA, including for cross-contextual behavioral advertising. You may submit a request to confirm this or to exercise your rights at support@zennybooks.com.

We retain your personal information for as long as your account is active or as necessary to provide our services. Upon account deletion:

• Account and financial data are deleted within 30 days, subject to legally required retention periods
• Payment records may be retained for up to 7 years for tax and accounting purposes
• Security incident and breach logs are retained for 24 months as required under PIPEDA
• Anonymized, aggregated analytics data may be retained indefinitely as it cannot be used to identify you

The following service providers process personal information on our behalf. Each is bound by contractual data protection obligations consistent with PIPEDA and, where applicable, CCPA.

All processors are located in the United States. Transfers of personal information outside Canada are made subject to contractual protections as required by PIPEDA Principle 4.1.3.

We use industry-standard security measures including TLS encryption in transit, encryption at rest for sensitive data, access controls, and regular security reviews. However, no system is completely secure. If you become aware of any security issue, please notify us immediately at support@zennybooks.com.

In the event of a security breach that creates a real risk of significant harm to you, we will notify you and, where required, the Privacy Commissioner of Canada "as soon as feasible" as required under PIPEDA. For California residents, we will notify you within 30 days of discovering a breach involving your personal information. If more than 500 California residents are affected by a single breach, we will also notify the California Attorney General within 15 days.

Depending on your jurisdiction, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate information
• Deletion: Request deletion of your personal information (subject to legal retention requirements)
• Portability: Export your data in a machine-readable format through Settings → Account
• Opt-out of secondary processing: Object to your data being used for analytics or product improvement beyond service delivery
• California residents (CCPA/CPRA): Right to know, right to delete, right to correct, right to opt out of sale/sharing, right to limit use of sensitive personal information, and right to non-discrimination

To exercise any of these rights, contact us at support@zennybooks.com. We will respond within 30 days. We may need to verify your identity before processing your request.

We use session cookies required for authentication and security. Vercel Analytics collects anonymized usage data to help us improve the service. We do not use cookies for targeted advertising. You can control cookies through your browser settings; disabling session cookies may prevent you from logging in.

Zenny is not directed at children under 13 years of age. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us immediately at support@zennybooks.com.

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by displaying a prominent notice in the application. Continued use of Zenny after the effective date of the updated policy constitutes your acceptance of the changes.

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

You also have the right to lodge a complaint with the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, for California residents, the California Privacy Protection Agency (cppa.ca.gov).