Privacy Policy

This Privacy Policy describes how Luum Wealth ("Luum", "we", "us", or "our") collects, uses, discloses, and protects personal information in connection with the Luum Wealth portfolio analytics platform (the "Platform").

We are committed to compliance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable Canadian provincial privacy legislation, including Quebec's Act respecting the protection of personal information in the private sector as amended by Law 25.

Not investment advice. Luum is a portfolio analytics and educational tool. Nothing on the Platform is personalized investment advice, a suitability assessment, or a recommendation to buy or sell any security. See our Investment Disclosures for the full statement.

1. Who we are

Luum is a Canadian company offering portfolio analytics software to retail investors. The Platform lets you record, import, connect, and analyze your investment holdings.

Privacy Officer contact: privacy@luumwealth.com

2. Scope

This Policy applies to personal information we collect through the Platform, our website at luumwealth.com, our marketing site, and related services. It does not apply to third-party services you reach from links on the Platform, or to your brokerage's own handling of your data.

3. Information we collect

3.1 Account information

Name and email address.
Authentication credentials, managed on our behalf by Clerk. We never see or store your password.
A mobile phone number, if you choose to complete phone verification. This is held by Clerk, not in our database. Clerk is a best in class authentication and user management solution. See Clerk's Privacy Policy: https://clerk.com/legal/privacy.
Subscription and billing information, processed by Stripe. We never receive or store your full card number.

3.2 Financial data you provide or connect

Portfolio holdings and positions, entered manually, imported by CSV, or synchronized from a brokerage account you connect.
Transaction history — purchases, sales, dividends, contributions, and withdrawals.
Cash flow records used to calculate your returns.
Account types and registration status (for example TFSA, RRSP, FHSA, RESP, LIRA, or, for US users, 401(k), IRA, Roth IRA, HSA).
Manually tracked assets and liabilities you add to your net worth — for example a property value, a vehicle, a mortgage, or a loan balance.
Portfolio goals, target allocations, named savings goals, contribution room figures, and scheduled contributions you configure.
Watchlists and price alerts you create.

You control what we hold. You choose what to enter, upload, or connect. We do not acquire your financial data from any brokerage, credit bureau, or data broker without an action by you.

3.3 Investor profile

During onboarding and in Settings, we ask for:

Your tax country and base currency.
Your primary investment goal and risk tolerance.
Optionally, your age range, net worth range, and self-described investing skill level.

We use these to set sensible defaults, tailor the analytics we show you, and choose which educational content is relevant. We do not use them to assess your suitability for any investment, and they are not shared with any third party for marketing.

3.4 Technical and usage data

Your IP address, stored only as a salted one-way hash. We do not retain raw IP addresses in our audit records.
Browser type, operating system, and user agent string.
API request logs — method, path, response code, and latency.
Security audit events — sign-ins, data exports, portfolio creation and deletion.

3.5 Device identification for fraud prevention

We generate a device identifier when you use the Platform, and store it together with your browser's user agent string. We use this solely to detect abuse — for example, many accounts created from one device.

This identifier is not used for advertising, is not shared with advertisers or data brokers, and is not used to track you across other websites. It is retained for the life of your account and deleted when your account is deleted.

3.6 Product analytics

We collect product analytics in two layers. Only the second depends on your consent.

Baseline analytics — anonymous, and part of operating the Platform. We record page views, named feature-usage events (for example, that a portfolio was created or a CSV was uploaded), errors and empty screens shown to you, and page performance timings.

Nothing is written to your device. No analytics cookie and no browser storage, so the record cannot be joined to a previous or later visit.
You are not identified. No account identifier and no email address is attached, and no profile is created.
Page addresses are reduced to their shape before they are sent, so a page about a particular security or portfolio is recorded as the kind of page it was, not as the address you visited.
This layer also carries error diagnostics, which is how we learn the Platform has broken.

This layer is described in our Terms of Service and is part of providing and securing the Platform. It is not switched off by the setting below.

Linked analytics — only if you opt in. If, and only if, you give consent, the same events are associated with your account identifier and email address, and analytics storage is written to your device, so your activity can be recognised across sessions and devices.

Consent is off by default, you are asked during onboarding, and you can change your choice at any time in Settings → Investor Profile → Analytics.
Withdrawing consent clears the analytics identity on your device and returns you to baseline analytics.
If your browser sends a Global Privacy Control signal, linked analytics stays off regardless of this setting, and the setting is shown as unavailable for that reason.

In neither layer do we collect autocaptured clicks, keystrokes, session recordings, or the contents of your portfolio — no holdings, balances, or transaction amounts.

3.7 AI assistant conversations

When you use the AI assistant, your questions and the assistant's responses are stored in our database, associated with your account, and processed by Anthropic (the Claude API) in the United States. Based on your chat messages, relevant figures from your portfolio are supplied to the AI model so it can answer about your actual holdings.

We use these stored exchanges to bill correctly, to investigate faults, and to review the quality and safety of the assistant's answers. Quality review is done on a small random sample, and every viewing of it is recorded in our internal audit log.

We keep the text of an exchange for 90 days. After that, the question, the answer and the record of what the assistant looked up are erased automatically, and only the metering details of the call remain — those are kept longer because they form part of your billing record. If you delete your account, all of it goes on the timetable in Section 9, whether or not the 90 days have elapsed.

We do not use your conversations to train AI models, and our agreement with Anthropic does not permit them to train models on data submitted through their commercial API.

You can turn AI off. If your plan includes AI, Settings → AI has a switch that stops it entirely: no question, and none of your holdings, transactions or balances, is sent to an AI provider while it is on. It also stops the features that use AI without being asked — the weekly strategy analysis, insight explanations and IPO analysis — and hides them, so the Platform does not keep offering you something you have declined. Your price does not change, and your plan keeps everything else it includes; the AI answers you would have had simply go unused.

This switch covers AI that reads your portfolio. It does not cover the help assistant, which answers questions about how to use Luum and only ever receives the question you type — never your financial data. That is said on the same screen rather than left for you to work out, and the help assistant keeps working either way.

Turning it off does not delete what AI has already written for you, because a switch you flip to see what it does should not destroy work you have paid for. Deleting it is a separate button on the same screen: it removes the strategy summaries, analysis cards, insight explanations and IPO analyses AI has produced for you, and erases the stored text of your AI conversations ahead of the 90 days above. What survives is the record of what each request cost — how many answers, how many tokens — because that is what explains your credit balance, and your Monte Carlo projections, which are calculated rather than written by AI.

3.8 Support requests

If you contact support, we retain your message and our reply. Support cannot see your financial data — see Section 5.

4. How we use your information

We use personal information to:

Provide, operate, secure, and improve the Platform.
Calculate portfolio analytics, allocation, drift, returns, income, fees, and tax summaries.
Generate AI insights grounded in your own portfolio data.
Process billing, manage your subscription, and meter AI credits.
Send you the transactional and service messages described in Section 8.
Respond to support, access, and privacy requests.
Detect and prevent fraud, abuse, and unauthorized access.
Meet legal, tax, and regulatory obligations.

We do not sell your personal information. We do not use your financial data for advertising, and we do not disclose it to advertisers or data brokers.

5. Our own staff cannot see your financial data

This is a deliberate design constraint, not only a policy commitment:

Luum support staff and engineering staff cannot view, access, adjust, or modify your holdings, positions, transactions, cash flows, goals, watchlists, or manually tracked assets and liabilities. No administrative tool lists, displays, searches, or edits those records.
Your brokerage connection credentials are encrypted. Decryption capability is not available to support or engineering staff.
The only account-data action our staff can take is deletion of an entire account, which removes the associated financial data as a consequence.
Because of this, we cannot answer questions about the contents of your portfolio, correct a figure on your behalf, or recover data you have deleted. Requests of that kind are outside what support is able to do.

One exception, which we would rather state than leave you to discover. As described in Section 3.7, quality review of the AI assistant involves reading a small random sample of stored exchanges, and an answer the assistant gave you may quote figures from your portfolio. So that review can incidentally show portfolio figures belonging to an identifiable account. It is limited to a bounded random sample, it is not a way to look up a chosen person's portfolio, each viewing is recorded in our internal audit log, and the underlying text is erased after 90 days. Everything above remains true: there is no administrative screen that shows your holdings.

We collect and process personal information on the basis of:

Your consent, given when you create an account, when you connect a brokerage, and separately for optional product analytics and non-essential email.
Performance of our contract with you — providing the service you signed up for.
Our legitimate interests in operating a secure, reliable, non-fraudulent platform.
Legal obligation, for example the retention of billing records under Canadian tax law.

You may withdraw consent at any time. Withdrawing consent for essential processing means closing your account — see Section 10.

7. Where your data is stored, and who processes it

Your personal and financial data is stored on Amazon Web Services infrastructure in Canada. All data is encrypted at rest and in transit.

Some categories of data are processed outside Canada by the service providers below. Each is bound by a data processing agreement or equivalent contractual data protection commitment, and may use your data only as we direct.

Provider	Purpose	Data shared	Processing location
AWS	Hosting, database, storage, email delivery	All Platform data	Canada
Clerk	Authentication and session management	Email, name, phone number if provided, session tokens	United States
Stripe	Subscription billing and payments	Email, billing address, subscription tier, payment method	United States (Stripe Canada entity)
Snaptrade	Brokerage account connection	Brokerage OAuth credentials, and holdings data in transit	Canada & United States
Anthropic	AI assistant (Claude API)	Your AI questions and the portfolio figures needed to answer	United States
Voyage AI	Help centre search (embeddings)	The text of your help centre search query	United States
PostHog	Product analytics (Section 3.6)	Page views, feature-usage events, errors, performance timings — anonymous by default; account identifier and email only if you opt in	United States
Sentry	Error and performance monitoring	Diagnostic data about failures — error messages, stack traces, the request path. Configured not to attach your IP address, headers or account identifier	United States
EODHD	Market data	No personal information — symbol queries only	European Union / United States
Resend	Delivering messages sent through the website contact form	The name, email address and message text you type into that form	United States
Bank of Canada	Foreign exchange rates	No personal information — currency-pair queries only	Canada

We do not use Google Analytics, Meta Pixel, or any advertising or ad-tech network.

We will disclose personal information where required by law or valid legal process — a court order, search warrant, or regulatory demand — and will notify you where we are legally permitted to do so.

8. Email and other messages (CASL)

Canada's Anti-Spam Legislation governs the commercial electronic messages we send you.

Messages we always send while your account exists, because each one is a record of a transaction or a warning that you are about to lose access, money, or data:

Billing events — receipts and payment failures.
Notice that an unused account is about to become read-only (Section 9.3).
Notice that an unused account has become read-only, and later that it has been suspended.
Notice before your data is permanently deleted.

Messages you can switch off individually in Settings → Notifications, including brokerage sync failures, stale-data warnings, allocation drift, goal tracking, price moves, watchlist and IPO alerts, and AI credit warnings.

Every notification-category email includes an unsubscribe link — including the always-sent ones above, since some (the notice before deletion, for instance) can carry a call to action to subscribe or reactivate — and supports one-click unsubscribe from your mail client. The only emails with no unsubscribe link are ones with nothing to unsubscribe from: account creation, email verification, a requested data export becoming ready, and AI credit top-up receipts. You can also switch off all non-essential email at once from Settings. An unsubscribe takes effect on confirmation and does not affect the always-sent messages above — clicking it stops future optional email, not the transaction records and account-status notices you can't opt out of.

9. How long we keep your data

Data	Retention
Holdings, transactions, cash flows, goals, watchlists, manual assets	For the life of your account, then 60 days after you request deletion. An unused free account is closed on the schedule in Section 9.3
AI assistant conversations (Section 3.7)	The text of each exchange for 90 days, then erased automatically. Metering details of the call are kept as part of your billing record.
Brokerage credentials	Until you remove the connection, then deleted and the key disabled
Your account record	60 days after a deletion request, then permanently deleted. Also deleted 150 days after the last use of an unused free account (Section 9.3)
Billing and payment records	7 years, as required by Canadian tax law (Income Tax Act s. 230)
Security audit log, including hashed IP addresses	2 years. Contains access events, not financial data
API and application logs	90 days
Uploaded CSV files as submitted	1 year from upload
Data export files you request	7 days, then automatically deleted
Device identifiers (Section 3.5)	Life of the account

9.1 If you delete your account

Deletion begins a 60-day grace period. Your financial data becomes inaccessible immediately, and you can reverse the deletion during those 60 days by contacting us. After 60 days everything is permanently deleted except the billing records and audit entries above.

9.2 If you stop paying for a plan

Your account returns to the free Starter tier. Nothing is deleted: your portfolios, transactions and history stay in your account, and the retention periods in the table above continue to apply to them. The Investor and Wealth features are switched off until you subscribe again.

Export is available on every plan, including Starter, at Settings → Your Data → Export.

9.3 If you stop using a free account

We do not keep the financial records of an account nobody uses indefinitely. Holding personal information after the purpose for collecting it has ended is precisely what PIPEDA Principle 4.5.3 requires us not to do, so a free account that goes unused is retired on a fixed schedule:

Days since the account was last used	What happens
83	We email a warning, seven days before anything changes
90	The account becomes read-only. It can still be read and exported
120	The account is suspended. Signing in offers to restore it
143	We email a final warning, seven days before deletion
150	The account and its financial data are permanently deleted

Four points define the limits of this:

It applies only to accounts on the free Starter tier. A paid plan is never treated as unused, however long you leave it.
Using the Platform resets the schedule. The clock measures your last authenticated use of the Platform, not your last sign-in.
Every step before deletion is reversible by you, in one action. From day 90 the Platform offers Restore my account, which clears the whole schedule including the deletion date. Restoring costs nothing and does not require contacting us.
Export remains available throughout, in both the read-only and the suspended phase, at Settings → Your Data → Export.

Deletion under this section is the same erasure described in Section 9.1: your financial data is destroyed, and only the billing records and de-linked security audit entries listed in the table above survive, for the periods stated there. Unlike Section 9.1 there is no 60-day reversal window afterwards, because the 60 days of read-only and suspension, and the two emails, come before it.

10. Your rights under PIPEDA

Access. You may ask what personal information we hold about you. You can download much of it yourself at any time from Settings → Your Data → Export, which produces a machine-readable file containing your portfolios, positions, transactions, cash flows, goals, upload history, and security audit events.
Correction. You may ask us to correct inaccurate or incomplete personal information. You can edit your profile and financial records directly in the Platform.
Withdrawal of consent and deletion. You may withdraw consent and delete your account and associated data at any time from Settings, subject to the grace period and the billing retention requirement in Section 9.
Explanation. You may ask us how your information is used and who it has been disclosed to.
Declining AI processing. If your plan includes AI, you may switch it off from Settings → AI without changing your plan or your price, and separately delete the AI-generated content held for you. See Section 3.7.
Complaint. You may complain to us, and if you are not satisfied, to the Office of the Privacy Commissioner of Canada at priv.gc.ca.

To exercise any of these rights, email privacy@luumwealth.com. We will respond within 30 days.

10.1 If you are in Quebec

Quebec law gives you additional rights, including the right to data portability, the right to be informed when personal information is used to render a decision based exclusively on automated processing, and the right to request that such processing be reviewed by a person.

The Platform's analytics, projections, and AI observations are informational and are not used to make decisions about you — we do not use automated processing to accept or refuse you as a customer, set your price, or assess your creditworthiness or suitability.

Separately from that, and whether or not it is required of us: if your plan includes AI, you can decline the automated processing of your portfolio by AI altogether, at no cost, from Settings → AI. Section 3.7 describes what the switch covers and what it does not.

You may complain to the Commission d'accès à l'information du Québec.

11. Cookies and browser storage

What	Type	Purpose	Consent
Clerk session cookies	Cookie (`httpOnly`, `Secure`, `SameSite=Lax`)	Keeps you signed in	Strictly necessary — none required
Onboarding state	Cookie (`httpOnly`)	Remembers that you finished onboarding	Strictly necessary — none required
Theme preference	Local storage	Remembers light or dark mode	Strictly necessary — none required
Cookie notice dismissal	Local storage	Stops us showing the notice again	Strictly necessary — none required
Analytics storage	Cookie / local storage	Linked analytics (Section 3.6)	Only written after you opt in

We use no advertising or cross-site tracking cookies.

12. Security

We employ encryption at rest and in transit, network isolation, least-privilege access controls, envelope encryption of brokerage credentials, secret scanning and continuous vulnerability scanning, rate limiting, audit logging, and periodic security review.

No method of transmission or storage is completely secure. If a breach of security safeguards creates a real risk of significant harm, we will notify affected individuals and report to the Office of the Privacy Commissioner of Canada as PIPEDA requires, and to the Commission d'accès à l'information where Quebec residents are affected.

13. Children

The Platform is not directed at anyone under 18, and we do not knowingly collect personal information from minors. If you believe a minor has given us personal information, email privacy@luumwealth.com and we will delete it.

14. Changes to this Policy

We may update this Policy. Material changes will be communicated by email and by posting the updated Policy with a revised effective date, before the change takes effect. Where a change requires your consent, we will ask for it rather than rely on your continued use.

15. Contact and complaints

Luum — Privacy Officer Email: privacy@luumwealth.com