How Minori collects, uses, protects and deletes your personal information, and how to exercise your rights.
01
Who we are
Minori is a personal finance app operated by Noriven, a sole proprietorship registered in Québec (enterprise number 2282134685), 40 rue Strasbourg, suite 1002, Candiac, Québec J5R 0B4, Canada.
Person in charge of the protection of personal information: the founder of Noriven, reachable at contact@minorifinance.com.
Minori is intended for people aged 18 and over.
02
Information we collect
Category
Examples
Source
Account
Internal identifier, email address, optional first name, language, preferences
You, and Noriven Auth at registration
Identity and sign-in
Password (stored in protected form by Noriven Auth, never by Minori), verification codes, IP address, browser, activity dates
Institution, accounts, balances and transactions of the accounts you choose to connect
Your bank, through Plaid, only if you turn on syncing
Subscription
Subscription status, customer and subscription references at the payment provider
The payment provider. Minori never receives your card number
Communications
Messages sent to support and requests to exercise your rights
You
Minori never receives your bank credentials. You enter them in Plaid’s secure module, which sends them to your bank.
03
Why we use it
To provide the service: show your finances and calculate your budgets, net worth and reports.
To sync the accounts you have connected automatically, when your subscription allows it.
To share with your partner only what you place in a shared space.
To protect your account: authentication, second factor, abuse detection and service security.
To manage your subscription and answer your requests.
To meet our legal obligations, including tax obligations.
We do not sell your information. We do not use it for advertising, do not rent it, and share it only with the providers listed below, for the purposes described here.
04
Your consent
You accept this policy when you create your account. Connecting a bank requires separate, express consent, given right before Plaid opens. It explains what is read, why, the transfer to Plaid in the United States, and how to withdraw it.
You can withdraw your consent at any time: disconnect a bank from the Accounts page, or close your account from Settings. Withdrawal stops new collection. It does not undo processing that was already lawfully done.
05
Sharing as a couple
Inviting a partner creates a shared space. Your partner sees only the accounts, budgets and transactions you place in that space. Your personal accounts, their balances and their totals stay private, including in reports and exports. Removing a partner’s access does not erase copies they may already have exported.
Communications outside Québec. Before entrusting information to a provider located outside Québec, we carry out a privacy impact assessment and sign a written agreement governing its use, confidentiality and incident notification. This information may be subject to the laws of the provider’s country, including access by foreign authorities.
07
How we protect your information
Encryption of all traffic (TLS 1.2 or newer).
Encryption at rest: database on an encrypted volume, additional encryption of bank access tokens with AWS KMS, encrypted backups.
A second authentication factor for you, and strong authentication for all our administrative access.
Access limited to what is strictly necessary, logged and reviewed every quarter.
Bank access tokens stay on our servers and are never sent to your browser or phone.
No system is infallible. Minori is not end-to-end encrypted: our servers must read your data to calculate your views. Our security policy details these measures.
08
How long we keep it
Data
Retention
Financial data and profile
As long as your account is open, or until you erase it. Deleted within 30 days after account closure
Bank access at Plaid
Removed as soon as you disconnect a bank, your sync entitlement ends or you close your account
Encrypted backups
Rolling 30 days
Technical logs
30 days; security logs 12 months
Billing data
6 years, as required by tax law
Inactive accounts
Email notice after 24 months without sign-in, then deletion 60 days later without a reply
Minori uses no advertising cookies and no audience measurement tools.
A session cookie, unreadable by the page’s JavaScript, keeps you signed in.
After an account closure request, a cookie lets you check its progress for 24 hours.
Your display preferences (theme, animations) are stored locally in your browser.
10
Your rights
You can:
access your information and get a copy;
have it corrected;
withdraw your consent and ask for its deletion;
ask us to stop disseminating it or to de-index it;
get your data in a structured, commonly used format (portability).
Several of these rights can be exercised directly in the app: export, erasure and account closure from Settings, and disconnecting a bank from Accounts. For the others, write to contact@minorifinance.com. We reply within 30 days.
If an incident presents a risk of serious injury, we notify you and the Commission d’accès à l’information without delay, and we take steps to reduce its consequences.
12
Changes
We notify you by email and in the app at least 30 days before any significant change to this policy. The date of the version in force appears at the top of this page.