Effective Date: June 07, 2026

Last Updated: June 07, 2026

 

IMPORTANT NOTICE: This Privacy Policy governs the collection, use, and disclosure of your personal information by aara Inc. ("aara", "we", "us", or "our") in connection with the aara mobile application and website. By accessing or using the aara app or website, you acknowledge that you have read, understood, and agree to the practices described in this Privacy Policy. If you do not agree, please do not use our services.

1. Introduction Aara Invest Inc. is a Canadian company dedicated to helping individuals, with a particular focus on women, build healthier, more confident relationships with money through behavioural science-backed financial wellness tools. We are committed to protecting your privacy and handling your personal information responsibly, transparently, and in compliance with applicable Canadian privacy laws. This Privacy Policy applies to: The aara mobile application ("App") available on the Google Play Store and Apple App Store The aara website located at www.aarainvest.com ("Website") Any related services, features, or communications we provide This Privacy Policy is governed by the Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, provincial privacy legislation including Alberta's Personal Information Protection Act (PIPA) and British Columbia's Personal Information Protection Act (PIPA BC).

 

1. About aara aara is a behavioural science-backed financial wellness application designed to help users understand their money habits, track their spending, build financial confidence, and make informed financial decisions. The App connects to users' bank accounts via the Plaid API to retrieve transaction data, which is then analyzed to provide personalized insights and guidance. aara invest Inc. is incorporated in Canada and operates its services from Canada. Our contact information is provided in Section 18 of this Privacy Policy.

 

1. Scope of This Policy 3.1 Mobile Application This Privacy Policy applies in full to the aara mobile application, including all features, content, and services accessible through the App on both Android (Google Play Store) and iOS (Apple App Store) platforms. The App is intended for users who are 18 years of age or older. 3.2 Website A separate, limited data collection framework applies to the aara Website (www.aarainvest.com), as described in Section 15 of this Privacy Policy. The Website does not require account creation or the submission of personal information, and data collection on the Website is limited to technical information such as IP addresses for operational and security purposes.

 

1. Personal Information We Collect – Mobile Application We collect personal information that is necessary to provide, maintain, and improve the aara service. We collect two categories of personal information: mandatory information required to create and operate your account, and optional information that enriches your experience but is not required. 

4.1 Mandatory Information The following information is required to create an aara account and access the core features of the App: 

1. Full Name We collect your full name to personalize your experience within the App and to identify your account. Your name is used to address you within the application and in any communications we send to you. 

2. Email Address We collect your email address to create and manage your account, to communicate important service-related information (such as security alerts, updates to this Privacy Policy, and account notifications), and, where you have consented, to send you marketing communications. Your email address serves as your primary account identifier. 

3. Country of Residence We collect your country of residence to ensure we are providing services appropriate to your jurisdiction, to comply with applicable laws and regulations, and to tailor financial content and guidance relevant to your location.

4. Bank Transaction Data (via Plaid) We collect your financial transaction data through our integration with Plaid Technologies, Inc. ("Plaid"). This data is the foundation of aara's core service and includes: Transaction history (merchant name, amount, date, and category) Account balances Account type and institution name Spending patterns and categorized expenditures This data is retrieved through a secure, read-only connection established via Plaid. aara does not have access to your banking login credentials. You will be prompted to authorize this connection through Plaid's secure interface, and you may revoke this access at any time through your account settings or directly through your financial institution. The use of Plaid means your banking credentials and authentication are handled directly by Plaid in accordance with Plaid's own privacy policy, available at https://plaid.com/legal/. We strongly encourage you to review Plaid's privacy policy to understand how Plaid handles your information.

4.2 Optional Information The following information is not required to use the App, but providing it helps us offer more personalized and relevant financial guidance: 

1.  Gender You may optionally provide your gender identity. This information helps us tailor content, insights, and guidance to better reflect your experience. aara is designed with a focus on women's financial wellness, and gender data helps us understand and serve our community. This field is entirely voluntary and does not affect your access to any feature of the App. 

2. Age You may optionally provide your age or date of birth. This information allows us to provide age-appropriate financial guidance, contextualize your financial journey relative to life stages, and ensure compliance with any age-related legal requirements. You must be at least 18 years old to use the aara App.

3. Annual Salary / Income You may optionally provide information about your income or salary. This information enables us to provide more accurate and personalized budgeting recommendations, savings targets, and financial benchmarks. Your income information is treated with the highest level of sensitivity and is used solely to enhance the quality of your personalized financial insights.

 

1. How We Collect Your Information We collect personal information through the following means: Directly from you, when you create an account, complete your profile, or interact with features of the App Through Plaid, when you authorize the connection between the aara App and your financial institution Automatically, through the operation of the App (e.g., device information, usage patterns, crash reports) From your device, subject to permissions you have granted (e.g., push notification permissions) We do not collect personal information from third-party data brokers or purchase personal data from external sources.

 

1. How We Use Your Personal Information We use your personal information only for the purposes for which it was collected and for purposes that a reasonable person would consider appropriate in the circumstances. These purposes include: 

6.1 Providing and Operating the Service Creating, maintaining, and authenticating your aara account Retrieving and processing your bank transaction data to generate spending insights, habit analyses, and financial summaries Personalizing your in-app experience based on your profile information Sending you service-related notifications, security alerts, and important account communications 

6.2 Improving and Developing Our Services Analyzing aggregated, de-identified usage patterns to improve the App's features, content, and user experience Conducting internal research and analytics to better understand financial wellness needs Testing and developing new features or services 

6.3 Legal and Compliance Purposes Complying with applicable laws, regulations, legal processes, or governmental requests Enforcing our Terms of Service and other agreements Detecting, preventing, and addressing fraud, security breaches, and technical issues Protecting the rights, property, and safety of aara, our users, and the public 

6.4 Communications and Marketing Responding to your inquiries, comments, or requests Sending you marketing communications about aara products, features, and offers, where you have provided your consent Administering surveys, contests, or promotional activities, subject to your consent We will not use your personal information for any new purpose that is incompatible with the purposes set out in this Privacy Policy without first notifying you and, where required by law, obtaining your consent.

1. Plaid API Integration – Detailed Disclosure aara uses Plaid Technologies, Inc. to facilitate the secure connection between the App and your financial institution. Understanding this integration is important for your privacy. 

7.1 What Plaid Does Plaid is a financial technology company that acts as an intermediary between financial applications like aara and your financial institution. When you link your bank account, you interact directly with Plaid's secure interface. Plaid retrieves your financial data from your institution and transmits it to aara in a standardized format. 

7.2 What aara Receives from Plaid aara receives, through Plaid, read-only access to your transaction history, account balances, and account information as described in Section 4.1(d). aara does not receive, store, or have access to your banking username, password, PIN, security questions, or any authentication credentials. 

7.3 Plaid's Own Privacy Policy Plaid is an independent data processor governed by its own privacy practices. By linking your account, you also agree to Plaid's privacy policy and terms of use. We encourage you to review Plaid's privacy policy at https://plaid.com/legal/ to understand how Plaid processes your information. 

7.4 Revoking Plaid Access You may revoke aara's access to your bank account data at any time by: Going to Settings > Linked Accounts within the aara App and disconnecting your account Contacting your financial institution directly to revoke third-party access Contacting Plaid directly to remove your data from their systems Revoking access will limit or prevent aara from providing certain core features of the service that rely on transaction data.

1. Data Storage and Security 

8.1 Storage Location – Canada All personal information collected through the aara mobile application is stored exclusively in Canada. aara uses Amazon Web Services ("AWS"), a cloud infrastructure service provided by Amazon.com, Inc., to store and manage user data. Our AWS instance is configured to store data in Canadian data centres (AWS Canada (Central) region), ensuring your personal information remains within Canada's jurisdiction and subject to Canadian privacy laws. In the event that any data is temporarily processed outside of Canada (for example, by Plaid, whose servers may be located in the United States), such transfers are governed by appropriate contractual safeguards, including standard contractual clauses or equivalent protections, and are conducted in compliance with PIPEDA. 

8.2 Security Measures We implement a comprehensive set of technical, administrative, and organizational safeguards to protect your personal information against unauthorized access, disclosure, alteration, and destruction, including: Encryption of data in transit using TLS (Transport Layer Security) 1.2 or higher Encryption of data at rest within our AWS infrastructure using AWS Key Management Service (KMS) AWS Cognito for secure user account authentication and management Role-based access controls limiting internal access to personal data Regular security assessments and vulnerability monitoring Secure API key management and environment variable practices Incident response procedures to address any data security breaches Despite our efforts, no method of data transmission or storage is 100% secure. If you become aware of any security vulnerability or have concerns about the security of your data, please contact us immediately at the address provided in Section 18. 

8.3 Data Breach Notification In the event of a data breach that poses a real risk of significant harm to you, we will notify you and the Office of the Privacy Commissioner of Canada as required by PIPEDA's breach of security safeguards provisions. We will provide notification without unreasonable delay and will include information about the nature of the breach, the information involved, and steps you can take to protect yourself.

1. Data Retention We retain your personal information only for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law. Account information (name, email, country): Retained for the duration of your account, plus 2 years following account deletion to fulfill any legal obligations Bank transaction data: Retained for the duration of your account, and deleted within 90 days of account deletion Optional profile data (gender, age, salary): Retained for the duration of your account, and deleted within 30 days of account deletion or upon your request Aggregated and de-identified analytics data: May be retained indefinitely, as it cannot be used to identify you When personal information is no longer required, we securely destroy or de-identify it in accordance with our data retention procedures.

 

1. Disclosure of Your Personal Information We do not sell your personal information to third parties. We do not disclose your personal information to third parties for their independent marketing or advertising purposes. We may share your information in the following limited circumstances: 

10.1 Service Providers We share personal information with trusted third-party service providers who assist us in operating the App and delivering our services, including: Plaid Technologies, Inc. – for bank account connectivity and transaction data retrieval Amazon Web Services, Inc. (AWS) – for data storage, authentication, and application infrastructure Email service providers – for transactional and marketing communications Analytics providers – for aggregated, de-identified usage insights All service providers are required to handle your personal information in a manner consistent with this Privacy Policy and applicable law. We enter into data processing agreements with all service providers. 

10.2 Legal Requirements We may disclose your personal information if required to do so by law, or if we believe in good faith that such disclosure is necessary to: (a) comply with a legal obligation, court order, or governmental request; (b) protect and defend the rights or property of aara; (c) prevent or investigate possible wrongdoing in connection with the App; or (d) protect the personal safety of users of the App or the public. 

10.3 Business Transfers In the event of a merger, acquisition, reorganization, sale of assets, or bankruptcy, your personal information may be transferred to a successor entity. We will notify you prior to any such transfer and the successor will be required to honour this Privacy Policy or obtain your consent to any material changes. 

10.4 With your consent we may share your personal information with other third parties where you have given us your express consent to do so.

1. Your Privacy Rights Under PIPEDA and applicable provincial privacy legislation, you have the following rights with respect to your personal information: Right of Access You have the right to request access to the personal information we hold about you. Upon a valid request, we will provide you with a copy of your personal information within 30 days, or explain why we are unable to do so. Right of Correction You have the right to request that we correct any inaccurate or incomplete personal information we hold about you. You may update most of your profile information directly within the App's settings. For other corrections, please contact us. Right to Withdraw Consent Where we rely on your consent to process your personal information, you have the right to withdraw that consent at any time. Withdrawal of consent may affect our ability to provide certain features of the App. Withdrawal of consent does not affect the lawfulness of processing conducted prior to the withdrawal. Right to Delete Your Account You may request the deletion of your aara account and associated personal information at any time. You can do this through the account settings in the App or by contacting us. Please note that certain information may be retained as required by law or for legitimate business purposes, as described in Section 9. Right to Lodge a Complaint If you believe we have not complied with our privacy obligations, you have the right to lodge a complaint with the Office of the Privacy Commissioner of Canada at www.priv.gc.ca, or with the applicable provincial privacy commissioner in your province. To exercise any of your rights, please contact our Privacy Officer at the details in Section 18. We may need to verify your identity before processing your request.

 

1. Consent By creating an aara account and using the App, you provide your express, informed consent to the collection, use, and disclosure of your personal information as described in this Privacy Policy. For optional information (gender, age, salary), you provide consent by voluntarily submitting this information. Where we process your personal information based on your consent, you may withdraw that consent at any time by contacting us or by adjusting your settings within the App. Please note that withdrawing consent may limit your ability to use certain features of the App. We will not, as a condition of providing the service, require you to consent to the collection or use of personal information beyond what is necessary to provide the App's core features.

 

1. Children's Privacy The aara App is intended solely for individuals who are 18 years of age or older. We do not knowingly collect personal information from anyone under the age of 18. If you are a parent or guardian and believe that your child under 18 has provided personal information to us, please contact us immediately at the address provided in Section 18 and we will take steps to delete such information.

 

1. Automated Processing and Profiling aara uses automated processing of your financial transaction data to generate spending insights, financial habit profiles, and personalized recommendations. This automated analysis is a core feature of the App and is used to provide you with meaningful, actionable financial guidance. Automated processing within aara is used to provide information and insights to you; it is not used to make legally significant decisions about you or to profile you for external purposes. All financial guidance provided by aara is intended to be informational and educational. aara does not provide regulated financial advice, and you should consult a qualified financial professional for advice tailored to your specific financial situation.

 

1. Website Privacy – www.aarainvest.com The aara Website (www.aarainvest.com) operates under a separate, more limited data collection framework. The Website does not require account creation and does not collect any personal information such as your name, email address, or financial data. 

15.1 What the Website Collects The only information automatically collected when you visit the aara Website is your IP address. Your IP address is a numerical label assigned to your device by your internet service provider and is technically necessary for your device to communicate with our web server. This information is collected automatically as part of the standard operation of web servers. 

15.2 How We Use Your IP Address We use IP address information collected on the Website solely for the following operational and security purposes: Delivering the website content to your device Diagnosing and resolving technical issues Detecting and preventing malicious activity, bot traffic, or security threats Generating aggregated, non-identifiable analytics about website traffic (e.g., number of visitors, geographic region at a country level) We do not use your IP address to identify you personally, to build profiles about you, or for marketing purposes. We do not combine IP address data from the Website with personal information from the App unless you are logged into an App account via a web interface. 

15.3 Cookies and Tracking Technologies The aara Website may use cookies and similar tracking technologies (such as session cookies) that are technically necessary for the website to function. We do not currently use cookies for advertising or behavioural tracking purposes. If this changes, we will update this Privacy Policy and, where required, obtain your consent. 

15.4 Third-Party Website Services The Website is hosted on Wix and may use third-party services (such as embedded social media feeds or analytics tools) that may independently collect certain technical information. We encourage you to review the privacy policies of those third-party services.

1. Links to Third-Party Services The App and Website may contain links to third-party websites or services, including social media platforms (Instagram, LinkedIn) and the Plaid financial connectivity interface. This Privacy Policy does not apply to those third-party services. We encourage you to review the privacy policies of any third-party services you access through our App or Website, as we have no control over their privacy practices and are not responsible for their content or data handling.

 

1. Changes to This Privacy Policy We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or for other operational, legal, or regulatory reasons. When we make material changes to this Privacy Policy, we will: Update the "Last Updated" date at the top of this document Notify registered App users by email or in-app notification prior to the change taking effect Post the updated Privacy Policy on our Website Where changes are material and require your consent under applicable law, we will seek your renewed consent before the changes take effect. Your continued use of the App or Website after the effective date of any updated Privacy Policy constitutes your acceptance of the revised Policy. If you do not agree to the changes, you should discontinue using the App and may request deletion of your account.

 

1. Contact Us If you have any questions, concerns, or requests regarding this Privacy Policy or our privacy practices, or if you wish to exercise any of your rights described in Section 11, please contact us at: Hello@aarainvest.com Website: www.aarainvest.com Jurisdiction: Canada We will respond to all privacy-related inquiries within 30 days of receipt. If we require additional time to respond (up to a maximum of 60 days), we will notify you of the extension within the initial 30-day period.

 

1. Governing Law This Privacy Policy is governed by and construed in accordance with the laws of Canada, including the Personal Information Protection and Electronic Documents Act (PIPEDA), and the laws of the province in which aara Inc. is incorporated. Any disputes arising in connection with this Privacy Policy shall be subject to the exclusive jurisdiction of the courts of Canada.

 

1. Artificial Intelligence and Automated Insights 

20.1 Overview of AI Use aara uses artificial intelligence ("AI") technology to deliver core features of the App, including personalized financial insights, spending analysis, behavioural pattern recognition, and contextual guidance. This AI functionality is powered by Amazon Bedrock, a fully managed AI service provided by Amazon Web Services, Inc. ("AWS"), a third-party AI infrastructure provider. This section explains what data is shared with Amazon Bedrock, how it is used, how it is protected, and what this means for your privacy. We are committed to ensuring that our use of AI technology respects your privacy and complies with applicable Canadian law. 

20.2 What Personal Information Is Shared with Amazon Bedrock To generate AI-powered insights, aara transmits certain elements of your data to Amazon Bedrock as part of structured prompts. The information shared may include: Anonymized or pseudonymized transaction data (e.g., spending categories, amounts, and dates) without directly identifying merchant names where technically feasible Aggregated spending summaries and financial habit indicators derived from your transaction data Optional profile attributes you have provided (such as age range, salary range, or gender), used to contextualize AI-generated recommendations Any text you enter into AI-powered chat or query features within the App We implement data minimization practices when constructing prompts sent to Amazon Bedrock. We do not send your full name, email address, or raw banking credentials to Amazon Bedrock. Where technically feasible, we anonymize or pseudonymize data before transmission. However, because financial transaction data is inherently personal in nature, you should be aware that some information shared with Amazon Bedrock may allow a person with sufficient context to identify patterns associated with your financial life. 

20.3 How Amazon Bedrock Processes Your Data aara accesses AI capabilities through Amazon Bedrock, a managed service within the AWS platform. Under AWS's data processing terms, data submitted through Amazon Bedrock is subject to AWS's privacy and data handling policies, which provide that: AWS does not use customer data processed through Amazon Bedrock to train foundation models by default Data processed through Amazon Bedrock is not shared with third-party model providers without your consent AWS acts as a data processor on behalf of aara for all Amazon Bedrock transactions aara enters into a data processing agreement with AWS as required under applicable privacy law. You are encouraged to review AWS's privacy policy and Amazon Bedrock data handling practices at https://aws.amazon.com/privacy/ to understand how AWS handles your information. 

20.4 Cross-Border Data Transfer to Amazon Bedrock Amazon Web Services is a United States-based company. While aara configures its AWS infrastructure to use Canadian data centres where available, certain Amazon Bedrock model inference services may process data in the United States or other AWS regions. By using the AI-powered features of the aara App, your data (as described in Section 20.2) may be transferred to and processed in the United States. Under PIPEDA, transfers of personal information to third parties, including those in foreign jurisdictions, are permitted where appropriate safeguards are in place. aara ensures that such transfers are governed by contractual protections, including data processing agreements with AWS that require AWS to protect the information to a standard comparable to PIPEDA. You acknowledge and consent to this potential cross-border transfer of data as a necessary part of using the AI-powered features of the App. Please be aware that once your data is transferred to the United States, it may be subject to access by U.S. government authorities under U.S. law, including the Foreign Intelligence Surveillance Act (FISA) and other national security legislation. aara has no control over such access and cannot guarantee the same level of protection that applies in Canada. 

20.5 Purpose and Limitations of AI-Generated Insights AI-generated insights within the aara App are used exclusively to provide you with personalized financial wellness guidance, including spending analysis, habit identification, budgeting suggestions, and educational content. We do not use AI to: Make lending, credit, or financial eligibility decisions about you Share your data with financial institutions, advertisers, or data brokers Produce outputs that constitute regulated financial advice under applicable Canadian securities or financial services legislation Discriminate against you based on protected characteristics such as gender, age, or income level All AI-generated content within the App is informational and educational in nature. aara is not a licensed financial advisor, investment advisor, or financial planner. Nothing generated by the AI constitutes personalized financial advice, and you should consult a qualified financial professional before making significant financial decisions. 

20.6 AI Accuracy, Limitations, and Human Oversight AI-generated responses are produced by large language models accessed through Amazon Bedrock and may not always be accurate, complete, or appropriate to your specific circumstances. You should review all AI-generated insights critically and use your own judgment before acting on any recommendations. aara is not liable for any financial decisions you make based on AI-generated content within the App. aara monitors AI outputs on an ongoing basis to identify and address inaccuracies, biases, or inappropriate responses. We maintain human oversight of AI-generated content and implement quality controls to ensure the AI operates within the intended scope of providing financial wellness support. If you receive an AI-generated response that you believe is inaccurate, harmful, or inappropriate, please report it to us using the contact details in Section 18. 

20.7 Opting Out of AI-Powered Features Because AI-powered analysis is central to the aara App's core functionality, opting out of AI processing will significantly limit the features and insights available to you. If you wish to limit or opt out of AI-powered features, please contact us at privacy@aarainvest.com. We will work with you to identify what limitations can be applied without fully disabling your account. Note that basic account functions (such as account management and manual data entry) may remain available without AI processing. 

20.8 Your Consent to AI Processing By creating an aara account and using the App, you provide your express, informed consent to the processing of your personal information by Amazon Bedrock for the purposes described in this Section 20. This consent includes your acknowledgment that data may be transferred to the United States for processing by AWS, as described in Section 20.4. If aara changes its AI provider or substantially changes how AI is used in the App in a manner that materially affects your privacy, we will update this Privacy Policy and notify you as required by Section 17, and will seek your renewed consent where required by law.