Cerebral Wealth Inc. ("Cerebral," "we," "us," or "our") is a Canadian company that provides an AI-powered financial awareness platform. Our registered address is in Canada. For privacy inquiries, contact us at contact@cerebralwealth.app.
This Privacy Policy applies to our mobile application, web application, and website at cerebralwealth.app (collectively, the "Service").
When you connect your bank accounts, we use Plaid, an open banking provider, to securely retrieve:
This access is read-only. Cerebral cannot initiate transfers, make payments, or move money in any way. Your banking credentials are never stored by Cerebral — they are handled entirely by Plaid under their own security standards.
Cross-border data transfer: Plaid is a U.S.-based company, so the financial data Plaid retrieves on our behalf is processed and stored in the United States. By connecting your bank accounts through Cerebral, you consent to this cross-border transfer of your financial information. U.S. privacy laws may differ from Canadian law and U.S. authorities may, in limited circumstances, be able to access information held by U.S. service providers. See Plaid's End User Privacy Policy for details.
We may ask for your general location (city or region) during onboarding to surface relevant financial insights (e.g., TFSA contribution room, local HYSA rates). We do not track your real-time or precise GPS location.
We process your personal information on the following grounds under applicable Canadian privacy law (PIPEDA and provincial equivalents):
We share limited data with trusted providers who help us deliver the Service. All providers are bound by data processing agreements.
Used to connect to your bank accounts with read-only access. Plaid handles your banking credentials and retrieves account and transaction data on our behalf. Plaid is a U.S.-based company; financial data retrieved through Plaid is processed and stored in the United States and is therefore subject to U.S. law. Plaid maintains SOC 2 Type II, ISO 27001, and ISO 27701 certifications. Plaid End User Privacy Policy →
Your financial data (account balances, transaction summaries, goals) is included in prompts sent to OpenAI's API to power the AI assistant and generate insights. OpenAI may process this data on servers outside Canada. We do not send your name, email, or banking credentials to OpenAI — only anonymized financial context. OpenAI Privacy Policy →
Used to process subscription payments. Stripe collects and stores your payment card details — Cerebral never sees or stores your full card number. Stripe Privacy Policy →
Used to send transactional emails (waitlist confirmations, account notifications). Your email address is shared with Resend for this purpose only. Resend Privacy Policy →
Used for product analytics — understanding how users interact with the app so we can improve it. Data is de-identified and aggregated. PostHog Privacy Policy →
Our backend runs on Railway and our web app is hosted on Vercel. Your data is stored on servers within these platforms. We configure these services to encrypt data at rest and in transit.
Your data is stored on servers in Canada and the United States. We implement the following security measures:
No method of electronic storage or transmission is 100% secure. While we use commercially reasonable measures, we cannot guarantee absolute security.
Under PIPEDA and applicable provincial privacy laws (including Quebec's Law 25), you have the right to:
To exercise any of these rights, email us at contact@cerebralwealth.app. We will respond within 30 days.
Cerebral is not directed at individuals under the age of 18. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us with personal information, please contact us and we will delete it promptly.
Some of our service providers (including OpenAI and Stripe) process data in the United States. By using Cerebral, you consent to your information being transferred to and processed in the United States, where privacy laws may differ from those in Canada. We ensure appropriate safeguards are in place through contractual agreements with these providers.
In the event of a breach involving your personal information that poses a real risk of significant harm, we will notify you and the Office of the Privacy Commissioner of Canada as required by PIPEDA. Quebec residents will also be notified in accordance with Law 25 requirements.
We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the app at least 14 days before the changes take effect. Continued use of the Service after the effective date constitutes acceptance of the updated policy.
For any privacy questions, requests, or concerns:
We are committed to resolving privacy concerns promptly and transparently.