Mizen Privacy Policy

Last updated: September 9, 2026

1. Who we are and how to contact us

Mizen ("Mizen", "we", "us", or "our") provides a household money-understanding service for people who want to coordinate shared finances without making all of their financial information visible to one another.

Mizen's Privacy Officer is responsible for our privacy program. Questions, access or correction requests, complaints, consent withdrawals, and deletion requests may be sent to privacy@mizen.money. We may need to verify your identity before acting on a request. Do not email passwords, bank credentials, full account numbers, or copies of identity documents unless we give you a secure way to provide them.

2. Scope

This policy explains how Mizen collects, uses, discloses, retains, and protects personal information when you use our websites, applications, support channels, and related services (collectively, the "Service"). It does not govern a financial institution, payment provider, identity provider, or other third party operating under its own privacy policy.

3. Information we collect

Depending on the features you use, we may collect:

• Account and identity information: email address, preferred name, authentication method, password hash, passkey and multi-factor authentication records, locale, province, time zone, and account status.
• Household information: household membership, invitations, roles, sharing choices, contribution agreements, decisions, goals, bills, follow-ups, and activity records.
• Financial information: linked institution and account identifiers, account type and limited account details, balances, transactions, merchants, categories, recurring items, currency information, and information you import or enter manually. Mizen does not ask you to give us your online banking password directly; an authorized bank-data provider handles institution authentication when you connect an account.
• Privacy and consent information: Mine/Yours/Ours classifications, account and transaction visibility, partner-sharing approvals, AI permissions, notification preferences, consent records, and audit history.
• Advisor information: messages you submit, authorized financial context used to answer them, saved memory you approve, feedback, and technical records needed to operate and safeguard the Advisor.
• Billing information: plan, subscription status, payer identity, provider customer identifier, invoices, tax status, and limited payment-method details such as brand and last four digits. Payment-card numbers are handled by the payment provider and are not stored by Mizen.
• Support information: messages and files you choose to send to support or the Privacy Officer.
• Technical and security information: IP address, browser and device information, session and security events, service logs, error and performance information, and fraud or abuse signals.

4. How we collect information

We collect information:

• directly from you when you register, enter information, choose settings, contact us, or use the Service;
• from a household partner only when they invite you, create shared household information, or share information under the Service's permission rules;
• from institutions and bank-data providers when you authorize a connection;
• from identity, payment, hosting, email, security, and AI service providers used to operate features you choose; and
• automatically through strictly necessary cookies, browser storage, server logs, and similar technologies used for authentication, security, preferences, and reliable operation.

We do not use third-party advertising cookies or sell personal information for targeted advertising. If this changes, we will update this policy and obtain any consent required by law before the new practice begins.

5. Why we use personal information

We use personal information only for identified and appropriate purposes, including to:

• create and secure your account;
• connect or import financial data at your direction;
• categorize and reconcile records, identify recurring activity, and produce household summaries;
• apply your Mine/Yours/Ours and granular partner-visibility choices;
• provide bills, goals, contribution, decision, notification, export, and deletion features;
• provide Advisor responses using only the context permitted for the current user and household;
• process subscriptions, taxes, invoices, cancellations, and customer support;
• detect, investigate, and prevent security incidents, fraud, misuse, and technical failures;
• maintain records of consent, privacy changes, and actions affecting another household member;
• meet legal, regulatory, accounting, and dispute-resolution obligations; and
• improve reliability and usability using minimized or aggregated operational information.

We will seek fresh consent before using personal information for a materially different purpose unless the law permits or requires the use without consent.

6. Mine, Yours, and Ours

Privacy is a core part of Mizen. Your partner does not automatically receive access to all of your financial information.

• Mine information is personal to you unless you make a specific sharing choice.
• Yours identifies information belonging to the other household member and does not grant you access to their private details.
• Ours is information intentionally used for the shared household experience.

More detailed settings may allow balance-only, category-total, selected-transaction, or fully shared access. Mizen applies those permissions to screens, exports, notifications, search, and Advisor context. A household role or responsibility for payment does not itself grant access to another person's private financial records. Changing a Mizen classification does not change legal ownership of an account, debt, asset, or transaction.

7. When we disclose information

We may disclose personal information:

• To your household partner: only as directed by your sharing choices or as needed for clearly shared household records. We do not disclose a private merchant, note, account, or transaction merely because two people belong to the same household.
• To service providers: only as needed to provide hosting, databases, bank connections, authentication, payment processing, email or push delivery, customer support, security, and AI functionality. Providers must process information for contracted purposes and protect it appropriately.
• For legal and safety reasons: when we reasonably believe disclosure is required by law, valid legal process, or necessary to protect rights, safety, security, or the integrity of the Service.
• For a business transaction: in connection with a proposed or completed financing, reorganization, sale, or transfer, subject to confidentiality and applicable legal requirements.
• With your direction or consent: when you ask us to export, share, or send information to a third party.

We do not sell or rent personal information. We do not let one household member purchase access to another member's private information.

8. Bank connections, payments, and AI providers

When you connect an institution, the bank-data provider receives the information needed to authenticate and maintain that connection under its own terms and privacy policy. Mizen receives the financial information you authorize the provider to return. Disconnecting stops future retrieval after the provider and Mizen complete the request, but it does not automatically erase records that must be retained for an identified purpose.

Payment checkout and payment-method management are hosted by our payment provider. Mizen receives subscription, invoice, tax, and limited payment-method information rather than full card details.

When you use the Advisor, Mizen sends your message and only the financial context authorized for that request to the configured AI service provider. We apply permission checks before and during the request. Private information belonging to another household member must not be included without the required sharing permission. Advisor output is informational and may be inaccurate; review important facts against their source.

9. Processing outside your province or country

Some service providers may process information outside your province or outside Canada, where it may be subject to the laws of that location. Before transferring personal information outside Quebec when Quebec law applies, Mizen must assess privacy factors and use contractual and other safeguards appropriate to the sensitivity of the information. Contact the Privacy Officer for current information about material processing locations and providers relevant to your account.

10. Consent and your choices

Where consent is required, the form of consent depends on the sensitivity of the information and the reasonable expectations of the user. Financial information and partner sharing receive heightened treatment and, where appropriate, express confirmation.

You may:

• choose whether to connect a financial institution or enter information manually;
• change partner-visibility settings, subject to safeguards for information already legitimately shared or relied upon;
• control optional notifications and withdraw consent to commercial messages;
• manage or withdraw eligible Advisor permissions;
• disconnect an institution;
• request an export, correction, or deletion; and
• withdraw consent for optional processing, subject to legal or contractual restrictions and reasonable notice.

Withdrawing consent may make a feature or the Service unavailable when the information is necessary to provide it. Essential security, billing, service, and legal notices are not marketing messages.

11. Retention and deletion

We keep personal information only as long as reasonably necessary for the purposes described in this policy, to provide the Service, protect users, resolve disputes, and meet legal, accounting, or regulatory obligations. Retention depends on the kind of record, its sensitivity, household and sharing dependencies, and legal requirements.

When you request account deletion, Mizen uses the cancellation window and status process shown to you in the Service. During that period, collection and access may be restricted. After the applicable period, Mizen deletes or de-identifies information that no longer needs to be retained. Some records may remain where required for security, fraud prevention, billing, tax, legal claims, consent evidence, or the rights of another household member. Shared records are handled carefully so deleting one account does not reveal or improperly destroy another person's information. Backup copies are removed or rendered inaccessible through controlled lifecycle processes.

Disconnecting a bank account, leaving a household, cancelling a subscription, and deleting a Mizen account are different actions and may have different effects. The Service explains the effect before a sensitive action is confirmed.

12. Safeguards and incidents

We use administrative, technical, and physical safeguards appropriate to the sensitivity of financial and identity information. Measures include access controls, encryption in transit, credential and session protection, permission checks, audit records, provider restrictions, and testing designed to prevent one household member from accessing another's private information.

No system is perfectly secure. If a privacy breach creates a real risk of significant harm or otherwise requires notice, Mizen will notify affected people and regulators as required by applicable law.

13. Access, correction, portability, and complaints

You may ask whether we hold personal information about you, request access to it, ask how it has been used or disclosed, and challenge its accuracy or completeness. You may also request correction, deletion, withdrawal of consent, or a portable copy where applicable. We will respond within the period required by applicable law and explain any lawful limitation or refusal.

Start by contacting privacy@mizen.money. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada or, where applicable, the Commission d'accès à l'information du Québec.

14. Children

The Service is intended for adults who have reached the age of majority where they live. We do not knowingly offer household financial accounts to children. Contact the Privacy Officer if you believe a child has provided personal information to Mizen.

15. Changes to this policy

We may update this policy to reflect changes to the Service, providers, or law. We will post the updated version with a new date. If a change materially affects how we collect, use, or disclose personal information, we will provide additional notice and obtain any consent required by law before the change takes effect.