The short version
- Tanto is a budgeting app. To work, it stores the financial information you choose to enter or import. We use it for one thing: running your budget.
- No ads. No selling or renting your data. No third-party analytics or trackers. We're paid by subscriptions, not by your information. We count how Tanto's features are used, in aggregate, with our own systems in Canada.
- Your data is stored in Canada (Montréal). A few service providers process specific pieces outside Canada: Stripe (payments), Anthropic (AI features, only if you turn them on), Resend (email delivery) and Cloudflare (network security) — all in the United States. This policy says exactly what each one sees.
- Tanto does not ask for your bank login and does not connect to your bank.
- You can export everything and delete your account yourself, any time. Deletion is immediate; backups clear within 30 days.
- Questions, access requests, or complaints: privacy@tantobudget.ca. We answer within 30 days.
- Who is responsible for your information
- What we collect
- Why we use it, and on what basis
- AI features
- Who processes your information, and where
- Cookies and browser storage
- How we protect it
- How long we keep it
- Your rights
- If something goes wrong
- Children
- Automated decisions
- Changes to this policy
- Contact and complaints
1. Who is responsible for your information
Wharfside Digital Inc., doing business as Tanto Budget, PO Box 462, Salmon Arm Stn Main, Salmon Arm, British Columbia V1E 4N6, Canada, is responsible for the personal information collected through the Tanto web application (app.tantobudget.ca), this website, and our support channels.
Our Privacy Officer — the person in charge of the protection of personal information, in the language of Quebec's law — is our Director. Contact: privacy@tantobudget.ca, or by mail at the address above. The Privacy Officer's name is available on request.
This policy is written to meet the Personal Information Protection and Electronic Documents Act (Canada), British Columbia's and Alberta's Personal Information Protection Acts, and Quebec's Act respecting the protection of personal information in the private sector. Where those laws give you different rights, you get the strongest one that applies to you.
2. What we collect
We collect only what the Service needs. Nothing below is collected from anywhere but you and your own use of Tanto.
| Category | What, specifically | Where it comes from |
|---|---|---|
| Account | Name, email address, password (stored only as a one-way hash — we cannot read it), language and theme preferences, the version and language of the Terms you accepted and when. | You, at sign-up and in Settings |
| Budget data (sensitive financial information) | Categories, goals, monthly allocations, budgeting accounts (name, type, institution name, balances, credit limits), transactions (date, payee, amount, memo, category), recurring transactions, pay schedule and take-home pay, registered-account (TFSA/RRSP/FHSA) contribution limits and contributions, GST/HST credit payments. | You, by entering it or importing a statement |
| Imported documents | CSV and OFX/QFX statement files, and — only if you turn AI features on — PDF bank statements and receipt photos. Files are processed in memory, never written to disk. The parsed rows are held encrypted (AES-256-GCM) only until you confirm the import, then destroyed; the file itself is never stored. We never store full account numbers. | You, when you import |
| Subscription | Whether you have a subscription, which plan, its status and renewal date, and Stripe's identifiers for your customer and subscription records. We do not receive or store your card number. Your billing address and card are held by Stripe. | Stripe, when you subscribe |
| Sign-in and security | Session tokens; the IP address and browser identifier (user-agent) of each active session; email-verification and password-reset tokens; short-lived rate-limiting counters keyed by IP address. | Your browser, automatically |
| AI usage | A count of AI requests and the number of tokens processed per month, for the fair-use limits. We do not keep the content of AI requests or responses. | Generated when you use an AI feature |
| Server logs | Standard request logs (time, method, path without search terms, status, IP address). Passwords, session cookies and tokens are redacted; request bodies and your financial data are not logged. | Your browser, automatically |
| Product usage | Counts of which features are used and when (for example "import completed", "goal created"), kept as aggregate totals. No page-by-page tracking, no IP address, no third parties, and never used to profile you. | Generated as you use Tanto |
| Support | What you send us when you email us. | You |
| Launch waitlist | Your email address, the language you chose, and when you confirmed and the wording you agreed to. No IP address is stored with it. | You, if you join the waitlist on this website |
What we don't collect: bank login credentials (not asked for, not collected); your card number; your location; contacts; advertising identifiers; or anything from data brokers or social networks. There are no third-party analytics, advertising or tracking scripts in Tanto.
3. Why we use it, and on what basis
| Purpose | What we use | Basis |
|---|---|---|
| Providing the Service — storing and displaying your budget, calculating balances, room and reports | Account, budget data, imported documents | Necessary for the agreement you accepted; your consent to the Terms |
| AI features (parsing statements and receipts, suggesting categories) | The document you scan or the transactions you select; your category names | Your express consent, given in the app before first use and revocable any time (section 4) |
| Billing and tax | Email, subscription status; Stripe holds card and billing address | Necessary for the subscription; legal obligations (tax records) |
| Security — sign-in, verification, password reset, detecting abuse, rate limiting | Sign-in and security data, server logs | Necessary for the Service; our legitimate need to keep it safe |
| Service messages — verification, receipts, renewal and trial reminders, security and legal notices | Email address | Necessary for the agreement; required by consumer protection law |
| Understanding how Tanto is used, so we can improve it | Aggregate feature-usage counts (no content, no IP address) | Our legitimate need to improve the Service; kept in Canada, never shared |
| Support and complaints | What you send us | Your request |
| Launch waitlist — an email when Tanto launches and occasional product news, which you asked for | Waitlist details | Your express consent, confirmed by email. Withdraw it any time with the unsubscribe link in every message |
| Legal compliance and defending claims | Records relevant to the matter | Legal obligation |
We do not use your information to advertise to you, build a profile of you for anyone else, or train AI models. We do not send marketing email unless you have separately opted in, and you can opt out with one click.
Withdrawing consent. You can withdraw consent to AI features in Settings at any time. Because the rest of the information is needed to run your budget, the way to withdraw consent to that is to delete your account (section 9), which you can do yourself at any time.
4. AI features
PDF statement parsing, receipt scanning and category suggestions are provided by Anthropic, PBC (San Francisco, United States) through its commercial API. These features are off by default. The first time you try one, Tanto shows a dialog explaining this section and asks for your consent; nothing is sent until you agree.
What is sent: for statement parsing, the PDF you upload; for receipt scanning, the photo; for category suggestions, the payee, amount and date of the transactions you selected, together with the names of your categories. What is never sent: your name, email address, password, or any data you did not choose to process.
What Anthropic does with it: under Anthropic's commercial terms, it does not use your content to train its models. It deletes API inputs and outputs within 30 days, except content its automated safety systems flag, which it may keep for up to two years for safety and abuse investigation. While in the United States, the data may be accessible to United States courts and authorities. We keep only a count of requests and tokens — not the content.
What Tanto does with the result: shows it to you as a suggestion. You confirm imported transactions before they are saved and accept or reject each category suggestion. No decision about you is made automatically.
5. Who processes your information, and where
Your budget data is stored on servers located in Montréal, Quebec, Canada. To run Tanto we use a small number of service providers, each bound by contract to protect your information and to use it only to provide their service to us. Some of them process specific information outside Canada (and outside Quebec). Where that happens, the information may be accessible to the courts, law-enforcement and national-security authorities of that country under its laws. We chose each provider after assessing the sensitivity of the information, the purpose, and the protections in place, and we keep a written record of that assessment.
| Provider | Role | Information | Location |
|---|---|---|---|
| Supabase, Inc. (on Amazon Web Services) | Database hosting and encrypted backups | All account and budget data | Canada (Montréal — AWS ca-central-1) |
| Google Cloud (Cloud Run) | Runs the Tanto application server | All data, in transit through the application | Canada (Montréal — northamerica-northeast1) |
| Upstash, Inc. | Rate-limiting counters | IP addresses and user identifiers, kept for minutes | Canada (Montréal — AWS ca-central-1) |
| Microsoft Corporation (Microsoft 365) | Our business email: support, privacy and other messages you send us, and our replies | Your email address and the content of your message | Canada (Toronto and Quebec City) |
| Cloudflare, Inc. | Network security, DDoS protection and delivery of the web app; hosting of this website, including the bot check on its waitlist form (Turnstile) | Traffic metadata (IP address, browser) and encrypted traffic passing through its network to reach our servers; on the waitlist form, signals from your browser used only to tell people from bots | Global network; requests are handled at the data centre nearest you, including in the United States |
| Stripe, Inc. | Payments, subscription billing, sales-tax calculation, receipts | Email, name, billing address, payment card, transaction history. Stripe is an independent controller of this information for its own fraud-prevention and legal obligations; see Stripe's privacy policy | United States (with operations in Canada) |
| Anthropic, PBC | AI features (section 4), only with your consent | The document you scan or the transaction details you select | United States |
| Resend, Inc. | Delivery of transactional email; the launch waitlist (storing the list and sending its emails) | Email address, the content of service emails (which contain no financial data); for the waitlist, your language and consent record | United States |
We do not share your personal information with anyone else, except: if you ask us to; to a successor if Tanto or Wharfside Digital Inc. is sold, who must honour this policy; or where the law requires it — for example a valid court order or a lawful request from a Canadian authority. We will tell you about such a request unless the law prevents us.
For residents of Alberta: this section is the notice, required by Alberta's Personal Information Protection Act, of our use of service providers outside Canada, the countries involved, and the purposes. Our Privacy Officer can answer questions about it.
6. Cookies and browser storage
Tanto uses only what is strictly necessary to run:
- Session cookie (
better-auth.session_token) — keeps you signed in for up to 30 days; HttpOnly, Secure, SameSite=Lax. A companion cookie caches session data for 5 minutes. - Local storage — your theme (light/dark/system), your language choice before sign-in, and the list of subscription-tracker items you dismissed. This stays in your browser and is not sent to us.
There are no advertising, third-party analytics, cross-site tracking or "fingerprinting" technologies in Tanto, and no optional tracking to turn on or off. Because there is nothing to opt out of, Tanto shows no cookie banner.
This website. tantobudget.ca sets no cookies of its own and uses no analytics, and its fonts are served from our own site. The waitlist form loads Cloudflare Turnstile only once you start typing your email address; Turnstile checks that a person, not a bot, is signing up.
7. How we protect it
- All traffic is encrypted in transit (HTTPS/TLS). Data is encrypted at rest by our hosting providers, and staged import data is additionally encrypted at the application level (AES-256-GCM) until you confirm the import, then destroyed.
- Passwords are hashed with scrypt; a minimum of 12 characters is enforced; email verification is required; sessions are HttpOnly cookies; sign-in and password-reset endpoints are rate-limited.
- Every database query is scoped to the signed-in user. Uploaded files are processed in memory only.
- Access to production systems is limited to the Director, protected by multi-factor authentication, and secrets are held in a managed secret store.
- Search terms and financial values are stripped from server logs; passwords, cookies and tokens are redacted.
- Daily encrypted backups, tested by restoring them, with a 7-day retention.
No system is perfectly secure. If you find a vulnerability, please email privacy@tantobudget.ca; we will respond promptly and will not take action against good-faith research.
8. How long we keep it
| Information | Kept for |
|---|---|
| Account and budget data | As long as your account exists. When you delete your account, everything is deleted immediately from the live database; encrypted backups containing it expire within 30 days. |
| Staged import data (parsed statement rows) | Until you confirm the import, then destroyed. Abandoned imports are destroyed automatically after 24 hours. |
| Uploaded files (CSV, OFX, PDF, receipt photos) | Not stored — processed in memory during the request only. |
| Sessions and security tokens | Sessions expire after 30 days of inactivity; verification and reset tokens expire within 1 hour; rate-limiting counters within 10 minutes. |
| Server logs | 30 days. |
| AI usage counts (no content) | While your account exists. |
| Billing records (invoices, receipts, tax records held by Stripe and in our books) | 7 years after the end of the tax year, as Canadian tax law requires — even after account deletion. They do not include budget data. |
| Consent records (Terms accepted, AI consent) and account-deletion log (email hash and date) | 2 years after account deletion, to evidence compliance. |
| Support correspondence | 2 years after the matter is closed. |
| Launch waitlist | Nothing is stored until you click the confirmation link, which expires after 7 days. Then until you unsubscribe, or until 12 months after Tanto launches if you have not created an account. When you unsubscribe, Resend keeps your address marked as unsubscribed so you are not emailed again; ask us and we will delete it entirely. |
| Privacy-incident records | 5 years from discovery (24 months minimum under federal law; 5 years under Quebec law). |
When information is no longer needed, we delete it or irreversibly anonymize it.
9. Your rights
Wherever you live in Canada, you can:
- Access the personal information we hold about you and learn how it is used and who it has been disclosed to. Most of it is visible in the app; for everything else, email us.
- Correct it. Name, preferences and all budget data are editable in the app; for your email address, email us and we will change it after verifying you.
- Export it. Settings → Privacy & data gives you your transactions as CSV and everything as JSON, instantly. This is the structured, commonly used format required by Quebec's data-portability right, and we will also provide it on request within 30 days.
- Delete your account and all data, yourself, from Settings — immediately and permanently (subject to the retention table above).
- Withdraw consent to AI features in Settings at any time; and withdraw consent to everything else by deleting your account.
- Ask questions or complain to our Privacy Officer, and escalate to a regulator (section 14).
We respond to requests within 30 days, free of charge. We may ask you to verify your identity first. If we refuse a request in whole or part (for example, because the law requires us to keep a record), we will tell you why and how to challenge the decision.
10. If something goes wrong
If a privacy incident occurs — for example unauthorized access to, loss of, or disclosure of your personal information — we will contain it, assess the risk, and, where there is a real risk of significant harm (or, in Quebec's terms, a risk of serious injury) to you, notify you and the appropriate privacy authorities as soon as feasible, in plain language, with what happened, what information was involved, what we have done and what you can do. We keep a register of every incident, whether or not it required notification.
11. Children
Tanto is for adults. You must have reached the age of majority in your province (at least 18) to have an account, and we do not knowingly collect information from anyone younger. In Quebec, we never collect information from a person under 14 without the consent of the person having parental authority. If you believe a minor has created an account, email us and we will delete it.
12. Automated decisions
Tanto does not make decisions about you based solely on automated processing. AI features produce suggestions that you review; budgets, allocations and goals are entirely your choices. If that ever changes, we will tell you before it does, explain how the decision is made, and give you a way to have a person review it.
13. Changes to this policy
Each version carries its version number and effective date at the top. For material changes, we will email you at least 30 days before they take effect, with a plain-language explanation. Previous versions are available on request. This policy is published in English and French; both have the same meaning.
14. Contact and complaints
Privacy Officer (Director)
Wharfside Digital Inc. (doing business as Tanto Budget)
PO Box 462, Salmon Arm Stn Main, Salmon Arm, British Columbia V1E 4N6, Canada
privacy@tantobudget.ca
If you are not satisfied with our response, you have the right to complain to the privacy authority for your jurisdiction:
- Office of the Privacy Commissioner of Canada (all provinces and territories; interprovincial and international matters)
- Office of the Information and Privacy Commissioner for British Columbia
- Office of the Information and Privacy Commissioner of Alberta
- Commission d'accès à l'information du Québec