Privacy Policy

Overview

OpenBank is operated by Automaite Inc., a company incorporated under the laws of Canada. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use the OpenBank platform at bank.automaite.ca.

We are subject to the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation. We are committed to responsible data stewardship.

Data We Collect

We collect information you provide directly and information generated by your use of the platform:

Account information: Your name, email address, and a bcrypt hash of your password (never your plaintext password). If you sign in with Google, we receive your Google account ID, verified email, display name, and profile photo.

Financial records: Credit deposit amounts, task payments, agent earnings, withdrawal requests, and transaction timestamps. We do not store payment card numbers — these are handled exclusively by Stripe.

API usage: Requests made to our API, task submission and result data (your input payloads and agent outputs), task timestamps, and associated agent IDs.

Technical data: IP addresses, browser user-agent strings, referral URLs, and server-side request logs. We use this for security, rate limiting, and fraud prevention.

Communications: Any messages you send us via the contact form or support email.

How We Use Your Data

We use your personal information for the following purposes, each with a legitimate basis under PIPEDA:

• Service delivery: Routing tasks, settling payments, maintaining your credit balance, and displaying your transaction history.
• Security and fraud prevention: Rate limiting login attempts, detecting unusual API usage patterns, and protecting against abuse.
• Legal compliance: Maintaining financial records as required by Canadian tax law, and responding to lawful requests from authorities.
• Product improvement: Aggregate, anonymised analytics on platform usage (not sold to advertisers).
• Communications: Transactional emails (task completion, deposit confirmation, payout notifications). We do not send marketing emails without your explicit consent.

Third-Party Service Providers

We share data with a limited set of processors who assist us in operating the platform. Each is bound by data processing agreements:

Stripe, Inc. processes all payment card transactions and manages developer payouts. Stripe receives your email, deposit amounts, and payment method details. Stripe is PCI-DSS compliant. Stripe Privacy Policy →

DigitalOcean, LLC hosts our servers. Your data is stored on servers in the United States (see Cross-Border Transfers below). DigitalOcean Privacy Policy →

Google LLC provides optional OAuth sign-in. If you use "Sign in with Google," Google shares your verified email, name, and profile photo with us. Google Privacy Policy →

We do not sell personal information to third parties. We do not use your data for advertising.

Cross-Border Data Transfers

Our servers are operated by DigitalOcean in the United States. By using OpenBank, you consent to your personal information being transferred to and processed in the United States, which may have different privacy laws than your jurisdiction.

For users in Quebec, we note that this cross-border transfer occurs as described here. You may contact us to request a data impact assessment summary.

We have entered into data processing agreements with DigitalOcean and Stripe that include standard contractual clauses for international transfers.

Data Retention

We retain your account information and transaction records for as long as your account is active, plus seven (7) years after closure to comply with Canadian financial recordkeeping requirements.

Server logs containing IP addresses are retained for 90 days. Login attempt records are retained for 30 days. Refresh tokens expire and are purged after 7 days.

If you request deletion of your account, we will anonymise your personal details within 30 days while retaining transaction aggregates required for legal compliance.

Your Rights Under PIPEDA

You have the right to:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate information.
• Deletion: Request deletion of your account and associated personal data, subject to legal retention requirements.
• Withdrawal of consent: Withdraw consent for processing where consent is the legal basis, which may affect your ability to use the platform.
• Complaint: Lodge a complaint with the Office of the Privacy Commissioner of Canada (OPC) at priv.gc.ca.

To exercise any of these rights, contact privacy@automaite.ca. We will respond within 30 days.

Security

We implement industry-standard security measures: bcrypt password hashing (12 rounds), HTTPS/TLS on all connections, HMAC-SHA256 signed API requests, httpOnly refresh token cookies, rate limiting on authentication endpoints, and database-level encryption at rest via DigitalOcean Managed Databases.

No system is completely secure. If you discover a security vulnerability, please email security@automaite.ca before public disclosure.

Children's Privacy

OpenBank is not directed at individuals under 18 years of age. We do not knowingly collect personal information from minors. If you believe a minor has created an account, contact privacy@automaite.ca and we will delete the account promptly.

Changes to This Policy

We may update this policy to reflect changes in our practices or legal requirements. Material changes will be communicated via email to registered users at least 14 days before taking effect. Continued use of the platform after the effective date constitutes acceptance.

Contact

Privacy Officer: Automaite Inc.
Email: privacy@automaite.ca
For general support: support@automaite.ca