Privacy Policy

Marifmax is operated by Hashim Qasim, a sole proprietor based in Quebec, Canada. For the purposes of Quebec’s Act respecting the protection of personal information in the private sector (Law 25) and Canada’s federal PIPEDA, Hashim Qasim is the person responsible for the protection of personal information collected through Marifmax — our privacy officer. You can reach the privacy officer directly at support@marifmax.com.

This policy explains what personal information Marifmax collects through marifmax.com and the Marifmax progressive web app (together, the "Service"), why we collect it, who we share it with, and the rights you have over it.

• Account information — the name and email address you give us when you sign up.
• Financial data, via Plaid — once you explicitly choose to connect a bank or credit card account, Plaid shares your account balances, transaction history, and basic institution/account metadata with us on a read-only basis. We never receive or store your bank login credentials.
• Sign-up IP address — we record the IP address an account was created from, for account security and fraud prevention only. We do not resolve it to a location, and we do not send it to any third-party service.
• Budget and goal inputs — the budget amounts, savings goals, and category labels you set inside the app.

We do not currently use third-party analytics, advertising, or tracking services on the Service.

We use this information only to run the Service you asked for:

• To create and secure your account, and send you sign-in codes and account notifications.
• To retrieve and display your balances, transactions, budget progress, and savings goals.
• To send you balance and spending notifications you’ve opted into.
• To detect fraud, abuse, or security incidents.
• To respond to your support requests.
• To meet legal and regulatory obligations.

Because financial account data is sensitive, we ask for explicit, opt-in consent at two separate points: once when you create your account (agreeing to this policy and our Terms), and again, specifically, when you choose to connect a bank account through Plaid. We don’t connect any account, or collect any financial data, until you take that second, separate action.

We don't sell your personal information, and we don't share it for anyone else’s marketing or advertising purposes. We do share it with a small number of service providers ("sub-processors") who help us run the Service, each bound to use it only to provide that service to us:

• Plaid Inc. (United States) — aggregates your bank and credit card data on our behalf.
• Stripe (United States) — processes subscription payments.
• Resend (United States) — delivers transactional email (sign-in codes, notifications).
• Amazon Web Services — hosts our infrastructure and stores your data. Our primary database, file storage, and compute run in AWS’s Canada (Central) region; Plaid, Stripe, and Resend, described above, process data in the United States.

We may also disclose information if required by law, to protect our legal rights, or in connection with a sale or transfer of the business (in which case you’d be notified).

Plaid, Stripe, and Resend are US companies, so using Marifmax means some of your personal information — including financial account data handled by Plaid — is processed and stored outside Canada, in the United States. That data becomes subject to the laws of the jurisdiction it’s processed in, including lawful access requests by that jurisdiction’s authorities. By using the Service, you consent to this transfer. We select providers who maintain security and privacy commitments comparable to what we require of ourselves.

• Data is encrypted in transit (TLS) and at rest.
• Plaid access tokens — the credentials that let us fetch your account data — are encrypted with AWS KMS and are only ever decrypted by the application itself, never by anyone with direct database or command-line access.
• Access to production data is limited to what’s needed to operate the Service, following the principle of least privilege.
• Sign-in uses one-time email codes rather than passwords, so there’s no password database to leak.

No system is perfectly secure, but this is how we work to keep your data safe.

We keep your account and financial data for as long as your account is active. If you delete your account, we disconnect your linked bank accounts from Plaid and delete your personal and financial data from our systems within 30 days, except where we’re required to keep limited records for legal, tax, or fraud-prevention purposes.

Subject to applicable law, you have the right to access, correct, or request deletion of your personal information, to receive a copy of it in a portable format, and to withdraw consent for us to process it (which may mean we can no longer provide the Service to you). To exercise any of these rights, email support@marifmax.com. We’ll respond within 30 days. If you’re in Quebec and aren’t satisfied with our response, you can complain to the Commission d’accès à l’information; elsewhere in Canada, you can contact the Office of the Privacy Commissioner of Canada.

Because we handle sensitive financial account data, we evaluate the privacy risk of how we collect, store, and share that data before introducing changes to it, and we’re committed to conducting a formal Privacy Impact Assessment under Law 25 as our user base grows past its earliest stage.

If a security incident results in a real risk of serious harm to you, we’ll notify both you and the Commission d’accès à l’information (and, where applicable, the Office of the Privacy Commissioner of Canada) without undue delay, as required under Law 25 and PIPEDA.

We use a session cookie to keep you signed in, and your browser’s local storage to remember your light/dark theme preference. We don’t use third-party advertising cookies or trackers.

Marifmax is not directed to, and isn’t intended for use by, anyone under 18. We don’t knowingly collect personal information from anyone under 18.

We may update this policy as the Service evolves. If we make a material change, we’ll post the updated policy here with a new effective date and, where practical, notify you by email.

Questions, requests, or concerns about your personal information can go to our privacy officer, Hashim Qasim, at support@marifmax.com. See our Terms of Service for the terms governing your use of Marifmax.