Privacy policy

P-1The short version

• FridgeMath stores the financial information you enter, import or authorize it to retrieve, along with information needed to operate and secure your account.
• We do not sell personal information, display advertising in the application, or use budget information to train AI models. The application does not use third-party advertising trackers or analytics. The public website uses Google Analytics 4 only if you opt in, as explained in P-10.
• Our primary application database, uploaded files, backups, and associated encryption keys are stored in AWS ca-central-1 (Montréal, Canada). External service providers, network infrastructure, and authorized access may involve other countries; see P-5 and P-6. We do not promise that every item of personal information remains in Canada.
• You can access, correct, export, and request deletion of your information, subject to shared-budget rights, security requirements, and limited legal retention obligations.

P-2Information we collect

Information you provide. Your email address, display name, a securely stored verification value for your password (not the plain-text password), optional multifactor-authentication information, and preferences such as language, theme and notification settings. In budgets you may supply account names, balances, transactions, merchants and payees, descriptions, categories, rules, recurring payments, forecasts, notes, receipts, statements and other attachments. Please do not include someone else's sensitive information unless you have authority to provide it.

Information from bank connections. If you choose an available connection through Plaid, we receive the account, balance and transaction information you authorize through Plaid and a connection token that enables subsequent permitted retrievals. We store this token encrypted. Bank sign-in information is handled in the Plaid and/or financial-institution authentication process, not collected by FridgeMath. Depending on the bank and connection method, Plaid may receive credentials or other authentication information under its own terms. See P-4.

Technical and operational information. Sign-in and session information, device and browser characteristics, access timestamps, security events, service diagnostics, and server access logs necessary for operation, troubleshooting and abuse prevention. Login sessions expire after seven days of inactivity or 30 days from creation, whichever occurs first. We may receive messages and records when you contact support, security or billing.

Payment information, once plans become available. Paid subscriptions will use Stripe Managed Payments through Stripe's Link merchant-of-record arrangement. Stripe/Link collects payment details, billing addresses and information needed for tax, fraud prevention, order management and receipts under its separate terms and privacy notice. Our intended FridgeMath integration retains only the Stripe customer and subscription identifiers, purchased plan, subscription status, billing period, charged amount, currency and billing country, to manage entitlements and support. We do not intend to collect or retain full billing addresses, complete card numbers, card security codes, or limited card details such as the last four digits. Stripe/Link may retain additional purchase and payment information for its own lawful purposes.

Information from others. If another user invites you into a shared budget, we may receive your email address and invitation and membership details. Shared-budget information may contain personal information about other household members or merchants.

P-3What we use information for and our legal bases

For people to whom the EU or UK GDPR applies, the following are our intended legal bases. Other local privacy laws may require consent or provide different rights.

Our legitimate interests include account security, preventing fraud and misuse, service reliability and handling support. You may object to processing based on legitimate interests, subject to applicable exceptions. We do not use budget profiles to make solely automated decisions producing legal or similarly significant effects.

P-4Optional bank connections

A bank connection is optional. Where supported, Plaid facilitates read-only access to the accounts and data you select. FridgeMath cannot initiate transfers or take possession of money through this feature. Available institutions and data fields vary. Some financial institutions use their own sign-in or consent screens, while others use Plaid's connection experience. Do not assume every flow is hosted by your bank.

Before connecting, review Plaid's End User Privacy Policy, any additional disclosures presented in Plaid Link, and your financial institution's applicable conditions. Plaid has its own practices, retention terms and rights processes. When you disconnect a bank connection in FridgeMath, we will stop synchronization and use Plaid's /item/remove API to revoke that connection and invalidate its access token. A single Plaid connection may cover multiple bank accounts; disconnecting that connection ends data retrieval for all accounts associated with it. Records already imported into your FridgeMath budget, including historical transactions and balances, are not automatically deleted. They stay available under the budget's sharing permissions until an authorized user deletes them, the budget is deleted, or our lawful retention rules otherwise require removal. If you later reconnect, you must authorize a new connection through Plaid. Plaid may retain information independently in accordance with its own privacy notice and legal duties. Some financial institutions may still display the prior connection until separately updated.

P-5Who receives information

• Other budget members: users invited into a budget can access that budget's information according to their assigned roles. A role may limit editing or administration but may not prevent reading shared financial details. Check access before inviting anyone.
• Amazon Web Services: infrastructure, databases, storage, encryption services and related operations.
• Plaid: bank connectivity and associated data handling when you activate it.
• Stripe Managed Payments / Link: merchant-of-record checkout, collection of payments, management of subscriptions (including the Stripe/Link experience opened by Settings > Billing > Manage Subscription in our web and mobile apps), transaction receipts and invoices, fraud prevention, payment disputes and transaction support if paid plans are activated. Stripe handles indirect-tax compliance for eligible transactions in its covered jurisdictions; its tax-liability coverage is not global. We may share the plan purchased, the account contact information needed at checkout, and identifiers necessary to fulfil paid access. Our intended retention is limited to Stripe customer/subscription identifiers, plan, status, billing period, amount, currency and billing country; no full billing address or payment-card details are retained by FridgeMath. Stripe/Link independently processes purchase and payment information under its own policies. We do not intend to send your budgets, bank transactions, receipt files or bank-connection credentials to Stripe to process the FridgeMath subscription. Stripe/Link handles information for its own purposes as described in the Link privacy policy, including when acting independently as a controller.
• Google: Google Analytics 4 for the public website only after consent; see P-10.
• Amazon Simple Email Service (Amazon SES): sends FridgeMath transactional and service-related messages, including account verification, invitations, security notices and optional notification digests. Our Amazon SES sending service is configured in the AWS Canada (Central) Region (ca-central-1, Montréal, Canada). For email delivery, AWS processes recipient email addresses, message content and relevant delivery, bounce or complaint information. We do not intentionally include banking credentials or transaction histories in these messages. The configured sending region is not a promise that email never travels outside Canada: delivery to recipients worldwide, recipient mail services, delivery routes and other systems may involve processing in other jurisdictions.
• Amazon CloudFront (AWS): delivers the public website and web application through a globally distributed content delivery network. CloudFront processes request information such as IP addresses, request paths and browser headers. Our configured cache is limited to public pages and static assets; authenticated API responses, private financial records and private receipt attachments are not cached. CloudFront may still handle requests and related metadata at global edge locations; restricting caching does not mean every request is processed only in Canada. CloudFront access logging is disabled in our configured deployment. We do not use CloudFront Functions or Lambda@Edge in this deployment. Other AWS services, security tools and the application origin may generate operational or security logs independently of CloudFront access logging.
• Authorities and others where required: when legally required, or when reasonably necessary to establish, exercise or defend legal claims, subject to applicable law.

We do not sell or rent personal information or share financial records with advertisers. We require service providers acting on our instructions to protect information and use it only for the agreed services. Some suppliers process personal information in their own right; refer to their notices where relevant.

P-6Storage locations and international data transfers

FridgeMath stores its primary application database, uploaded files, backups and encryption keys in the AWS Canada (Central) Region (ca-central-1, Montréal, Québec, Canada). This statement describes those four storage components, not a guarantee that all information about you stays in Canada. Amazon SES transactional email is sent using our configured AWS Canada (Central) (ca-central-1) sending region. However, delivery of email to recipients and their email providers, as well as other services, may involve processing outside Canada. Depending on the provider and how a feature is used, website and API traffic, support requests, subscription billing, bank connections, optional website analytics, CDN delivery, and account or infrastructure administration may also involve personal information being accessed or processed outside Canada. The countries and providers involved depend on the services used, the recipients and the information involved. Our CDN is Amazon CloudFront, which handles visitor requests through globally distributed edge locations and caches only public pages and static assets in our confirmed configuration. Authenticated API responses, private financial records and private receipt attachments are not cached. Viewer IP addresses, request paths and request metadata may nevertheless be processed at CloudFront edge locations internationally. CloudFront access logging is disabled in our confirmed configuration; we do not use it to maintain routine viewer-request access logs. We do not use CloudFront Functions or Lambda@Edge. Other AWS services and the origin application may still create their own security or operational logs.

Where EU/EEA or UK transfer rules apply, we use a lawful transfer mechanism appropriate to the recipient and transfer. These may include an applicable adequacy decision (the EU's Canadian adequacy finding covers qualifying commercial organizations), European Commission Standard Contractual Clauses, the UK International Data Transfer Addendum or Agreement, and supplementary measures where necessary. You may request further information about relevant safeguards at Show email addressprivacy@fridgemath.com.

For personal information subject to Québec law, we assess out-of-Québec disclosures and service-provider processing as required, including the safeguards and written agreements involved. A Canadian AWS region alone does not avoid these obligations where processing occurs outside Québec.

P-7How we protect information

We use safeguards intended to protect confidential financial information, including encrypted connections, access controls, encrypted backups, and encryption of stored Plaid connection tokens with keys protected through managed key services. We restrict personnel and service-provider access to authorized purposes. No online service can promise absolute security. We assess and notify affected people and regulators about privacy or security incidents as required by applicable law.

P-8How long we keep information

• Active accounts and budgets: while the relevant account or budget remains in use, except when you remove information sooner. Disconnecting a Plaid bank connection does not itself erase already imported bank transactions, account history, or other budget records; those remain subject to the budget's sharing permissions and user-directed deletion.
• Shared budgets: information may remain available to other members after one member leaves or deletes an account, in line with P-9.
• Login session records: retained only while the session is active. When a session expires or is revoked, its session record is deleted immediately, with no additional post-expiry retention period. Separate security and administrative event logs, which may document relevant sign-in or revocation events without retaining an active session, follow the 90-day routine log limit described below, subject to the stated lawful exceptions.
• Routine security, administrative, application and access logs: retained for a maximum of 90 days, then deleted or anonymized in the normal retention cycle. Specific relevant records may be preserved longer only where reasonably necessary and lawful for a documented security incident, investigation, dispute, or legal obligation; we delete or anonymize them once that reason ends. This retention policy concerns logs produced by FridgeMath and its operational systems; CloudFront access logging is disabled. Routine application logs are not intended to include transaction contents or attachments; see the security safeguards in P-7.
• Support messages, subscription entitlements and limited billing records: for the time necessary to respond to requests and satisfy our applicable legal or contractual record-keeping duties. Stripe/Link has its own payment, merchant-of-record tax, receipt and fraud-prevention retention rules.
• Deleted content and backups: when an authorized user confirms deletion of an account or financial records, the data covered by that deletion is removed immediately from active production database and file storage, subject to the shared-budget rules in P-9 and limited lawful-retention exceptions below. This does not mean every copy disappears at once: encrypted rolling AWS backups are retained for a maximum of 30 days, after which they expire and are deleted through the normal backup lifecycle. Individual records in backups cannot ordinarily be erased immediately. If a backup is restored, deletion requests are re-applied where practicable. The application offers up to 30 days of change history for reversing certain ordinary edits, but a confirmed permanent deletion of financial records cannot be undone through change history. Our active change history does not retain a recoverable copy of a record after its permanent deletion has been confirmed.
• Consent, policy-version and Terms acceptance records: as needed to document the notice, accepted terms version, acceptance date/time, and consent preferences applicable to an account, for as long as reasonably necessary to demonstrate compliance with applicable law.

We may preserve specific information for a legal obligation, dispute, fraud prevention, or security incident only to the extent lawful and necessary. At the end of the relevant period, we delete or anonymize it.

P-9Your choices and privacy rights

Export and access. You can export information available to your account in Settings > Your data. The current export is described as a ZIP containing CSV files and related data. You can also request a copy of other personal information we hold about you.

Correction and deletion. You can change budget data and request correction of other information. You can delete your account in Settings > Your account, subject to security checks and the consequences for shared budgets. Budgets for which you are the sole member are intended to be deleted with your account. If other people share a budget, that budget may continue to exist after you leave; you may need to transfer ownership or delete a budget separately. Confirmed permanent deletions cannot be reversed through the 30-day change-history feature. Deletion is subject to the limited exceptions and backup timing explained in P-8.

Consent and bank access. You can switch off optional messages, withdraw website analytics consent, and disconnect supported bank connections. Disconnecting revokes the corresponding Plaid connection and stops new synchronization but does not delete imported history; you can separately remove authorized budget records or delete the relevant budget/account, subject to P-8 and shared-budget rights. Withdrawal affects future consent-based processing, not necessarily data lawfully processed before withdrawal.

Other rights. Depending on where you live, you may have rights to object to or restrict processing, request portability, withdraw consent, obtain information about international safeguards, or lodge a complaint with a regulator. We will explain any lawful refusal or identity-verification step. Email Show email addressprivacy@fridgemath.com to exercise these rights. For EU/EEA complaints, contact your data protection supervisory authority; for UK complaints, the Information Commissioner's Office; for Canadian complaints, the Office of the Privacy Commissioner of Canada and/or the applicable provincial regulator, including Québec's Commission d'accès à l'information.

We normally respond within the deadline applicable to your location; EU/UK GDPR requests generally require a response within one month, subject to lawful extensions.

P-10Cookies, local storage and website measurement

Application. The web application uses an authentication cookie currently named cb_session and browser storage for functions such as recalling the open budget (fm.budgetId). These technologies support the service and are not used for advertising.

Public website, including EU/EEA and UK visitors. fridgemath.com uses Google Analytics 4 only if a visitor affirmatively opts in, regardless of the visitor's country, including when the visitor is in the EU/EEA or UK. GA4 is not a condition of access to the website or FridgeMath. Before opt-in, no GA4 library, analytics cookie, Google analytics request, or analytics-identifying technology should load, run, or transmit information. If accepted, analytics may receive visited pages, interactions, approximate location inferred from IP address and browser/device information; _ga cookies or other GA identifiers may be placed. No budget, payment-card, or account contents are intentionally supplied to GA4. Google Signals and advertising personalization are intended to be disabled.

The consent notice must present Accept and Decline with equally prominent, equally easy choices and must not preselect acceptance. We honor refusal as well as acceptance. You can change or withdraw your choice at any time using Cookie settings on every public-site page, without having to create an account. Declining or withdrawing consent stops future optional analytics requests and removes optional first-party analytics cookies to the extent we control them; withdrawal cannot automatically erase data already received by Google. We store your choice in fm-consent or its confirmed replacement.

P-11Children and account eligibility

You must be at least 18 years old to create an account or use FridgeMath. We do not knowingly invite children to sign up. Contact Show email addressprivacy@fridgemath.com if you believe a person below the minimum age has an account; we will investigate and take appropriate steps.

P-12Changes, privacy responsibility and contact

This Policy takes effect on the effective date identified when the final version is published. Each revised version will identify its effective date and last-updated date. We retain a version history and records of required privacy consents and policy notices, subject to the retention criteria in P-8.

For ordinary material changes to how we collect, use, retain or disclose personal information, we will give at least 30 days' advance notice by email and in the application, or longer if law requires. We will explain the changes and any choices or rights available. A change required urgently to address a security incident or a binding legal obligation may take effect sooner where necessary; we will provide notice as soon as reasonably practicable, subject to applicable restrictions. That exception will not be used for ordinary new marketing or data-use purposes. Where an additional purpose, material change or processing activity legally requires new affirmative consent, we will obtain that consent before the new processing begins. We will not treat silence or continued use alone as consent where affirmative consent is required. A revised policy never retrospectively authorizes processing without an appropriate legal basis.

Controller: Orendasys Inc., a corporation incorporated in Ontario, Canada.
Authorized mailing address for Orendasys Inc. and its Privacy Officer: Orendasys Inc., Show address7163 Yonge Street, Unit 103, Thornhill, Ontario L3T 0C8, Canada. This is a correspondence address; Orendasys Inc.'s registered office remains in Vaughan, Ontario, and the mailing address is not a claim that FridgeMath's day-to-day business is conducted there.
Privacy Officer / Person in Charge of Personal Information: Privacy Officer, Orendasys Inc.
Privacy Officer email: Show email addressprivacy@fridgemath.com.
Business telephone (shared correspondence line, calls directed to Orendasys): Show number+1 905-763-9696.
General privacy requests: Show email addressprivacy@fridgemath.com.