Private by architecture. Clear by design.

• Account and identity information: name, email, phone number, address, authentication records, and account settings.
• Financial information: account names, institutions, balances, holdings, transactions, liabilities, income patterns, financial goals, planning inputs, and tax and benefits information.
• Documents: statements, notices of assessment, insurance policies, wills, powers of attorney, property documents, benefits letters, and other records you upload or connect.
• Household and planning information: household members, dependants, beneficiaries, property, insurance, estate information, and other details you choose to provide.
• Usage, device, and security information: logs, browser and device data, authentication events, diagnostics, cookie preferences, error reports, and security events.
• Support and communications: messages, feedback, requests, complaints, consents, and records needed to assist you.

OWN uses personal information to provide and secure the service, link read-only accounts, build dashboards and insights, generate Atlas guidance where enabled, organize documents, provide alerts and exports, support users, improve reliability, prevent fraud and unauthorized access, comply with law, resolve disputes, and communicate service-related information. OWN does not sell personal information.

OWN distinguishes between information required to provide the service and optional uses that require separate consent. You may withdraw optional consent, including certain Atlas permissions and marketing preferences, subject to legal limits and the fact that some features may no longer work without the information required to provide them.

Atlas may use the financial, document, household, and planning information you permit it to use to generate guidance, summaries, explanations, alerts, and scenarios. OWN does not use private member documents or connected financial profiles to train general AI models unless the member gives explicit opt-in consent. If third-party AI processors are used, they process information only on OWN's instructions and under contractual confidentiality, security, retention, deletion, and use restrictions. OWN's production Atlas integration uses Anthropic's Claude API under Anthropic's Commercial Terms of Service, not a consumer Claude account. Under those terms, Anthropic states that retained data is not used to train its models without the customer's express permission, and that conversation content is not retained beyond what processing requires except for a small set of specific models with a mandatory 30-day retention window. OWN is evaluating whether a zero-data-retention arrangement is available for its configuration.

Atlas is guidance and decision support, not a solely automated binding decision-maker. If OWN later makes decisions based exclusively on automated processing, OWN will provide Québec-specific notice, explanation, correction, and review rights before launch of that feature.

OWN may disclose personal information to service providers that support account linking, hosting, cloud storage, analytics, security, identity verification, communications, support, professional services, payment processing, and AI processing. OWN may also disclose information where required by law, to protect users or the service, in connection with a financing, merger, acquisition, sale, or restructuring, or with your consent. Service providers are contractually restricted from using information for their own purposes except where permitted by law and disclosed to you.

Some service providers may store or process personal information outside your province or outside Canada. In those cases, information may be subject to the laws of the jurisdiction where it is processed. OWN's hosting and processing providers — including Vercel, Railway, Supabase, and Anthropic — operate in the United States. For Québec residents, OWN uses contractual and technical safeguards designed to provide appropriate protection, and is completing the transfer and privacy-impact assessments Law 25 requires for this processing.

OWN retains personal information only as long as necessary for the purposes described in this policy, to provide the service, meet legal, tax, accounting, security, and regulatory obligations, resolve disputes, enforce agreements, and maintain business records. When information is no longer required, OWN securely deletes, de-identifies, or anonymizes it, subject to legal holds and backup-cycle limitations. The binding policy will include a category-level retention schedule once OWN's operational retention table is finalized.

You may request access to personal information, correction of inaccurate information, withdrawal of consent where available, deletion where applicable, information about service providers and cross-border processing, and information about automated decisions where required by Québec law. OWN provides in-product controls wherever possible and a formal privacy-request channel for statutory requests.

If a member is incapable or has died, applicable law may allow a legally authorized representative to exercise certain privacy rights or request specified information. Depending on the province and circumstances, this may include a guardian, attorney, mandatary, executor, administrator, estate trustee, liquidator or other person recognized by law. OWN verifies the requester's identity and legal authority before disclosing personal information, and limits disclosure to the scope of that authority. We may redact or withhold information about other individuals, including other household members. Requests should be directed to OWN's Privacy Officer (see Contact, below).

Québec. Québec law provides specific rights and limits for representatives, heirs, successors, liquidators and, in limited circumstances, a spouse or close relative of a deceased person. OWN assesses those requests under the applicable Québec requirements rather than granting general account access.

Retention after death or incapacity. Notice of death or incapacity does not automatically cause immediate deletion or indefinite preservation. OWN may place a temporary hold on a member's information while a representative request, dispute, or legal obligation or hold is resolved, after which the ordinary category-based retention and secure-destruction schedule (see Retention, deletion and anonymization, above) applies.

OWN maintains administrative, technical, and physical safeguards proportionate to the sensitivity of financial and household information. Controls include encryption, access controls, audit logging, least-privilege permissions, vendor diligence, confidentiality obligations, staff training, monitoring, backups, vulnerability management, and incident response. If a confidentiality incident or breach creates legally reportable risk, OWN notifies affected individuals and regulators as required and maintains required incident records.

OWN's general consumer service is not directed to children. The one exception is OWN Youth, a financial-literacy program intended to be used by a minor under the supervision of a parent, guardian, teacher or school. An OWN Youth account is set up and administered by a supervising adult — a parent or guardian, or an educator acting for their institution — who must have the authority and any consent required under applicable law (including Québec's Law 25 and other Canadian privacy legislation) to enrol a minor and provide their information. Information about a minor in OWN Youth is used only to deliver the educational program — lessons, progress tracking and classroom features — and is not sold or used to train AI models. A supervising adult may review, correct or remove a minor's information at any time; if you believe a minor's information was provided without proper authority, contact us and we will remove it.

If an account holder enters information about household members, dependants, beneficiaries, or other people, the account holder must confirm they have authority or a lawful basis to provide it. OWN limits use of that information to the household-planning purposes for which it was provided.

Privacy Officer / Person in Charge of the Protection of Personal Information, OWN Financial Inc., Toronto, Canada. Email: privacy@ownfinancial.ca. OWN's Chief Executive Officer is the individual accountable for privacy compliance, including for Québec residents under Law 25. You can make privacy requests through this channel, receive information about expected response timing, escalate concerns, and receive notice of material policy changes.