Privacy Policy

1. Who we are

Yield Scanner (“we”, “us”) is an online research and portfolio-tracking service operated from Ontario, Canada. This policy explains what personal information we collect, why, who handles it, and the choices you have.

Privacy contact (person in charge of the protection of personal information): [Name and title to be confirmed], privacy@<our-domain>.

We follow Canada’s federal privacy law (PIPEDA) and, for people in Québec, Québec’s Law 25.

2. What we collect

• Account details: your email address, an optional display name, and sign-in method (email code or Google).
• Preferences: settings such as currency, hidden columns, and whether numbers are hidden.
• Portfolio information you enter: portfolios, account types, holdings, quantities and costs. You type them in, import a CSV, or confirm what we extracted from a screenshot. Holdings are financial information, which we treat as sensitive.
• Screenshots you upload: processed in memory to read the holdings, then discarded. We never store them. See “AI screenshot import” below.
• Signup code: a referral or coupon code, if you enter one.
• Terms acceptance: the time you accepted and the version you accepted.
• Technical logs: IP address, browser type, pages and errors, kept for security and troubleshooting.
• Cookies: a strictly necessary session cookie that keeps you signed in (see “Cookies and analytics”).
• Billing information (when billing starts): handled by Stripe. We keep only a customer ID, plan and the last 4 digits of a card.

3. Why we use it

We use personal information only for these purposes:

• To provide the service: sign you in, show your portfolios, value them at current market prices, and send the codes and notices you request.
• Security and fraud prevention: rate-limit sign-ins, run the human check, detect abuse, and investigate incidents.
• Support: answer your questions and fix problems you report.
• Billing: start, renew and cancel paid plans, send receipts and renewal notices, and meet tax and accounting rules.
• Product improvement and internal experiments: we use de-identified or aggregated versions of information (for example, how many people use a feature, or which tickers are held most across all users) to run statistics and test improvements. Published insights, if any, are aggregated over large groups so no individual can be identified. You can opt out in Settings or by emailing us, where this applies.
• Legal compliance: respond to lawful requests and keep records we are required to keep.

We will ask for your consent again before using your information for a new purpose that is not covered here.

4. What we never do

We never sell or rent your personal information, and we don’t share your name, email, phone, address or holdings with anyone for their own marketing.

We do not show you ads, and we do not give your portfolio to advertisers or data brokers. Our research tiles and rankings are the same for every user and are never personalised from your holdings.

5. Service providers and where data goes

We use the following providers to run the service. They may only use your information to perform services for us.

Cross-border transfers

Several providers are located in or process data in the United States. Your information may therefore be stored or processed outside your province or Canada, and may be accessible to courts, law-enforcement and national-security authorities in those countries under their laws. For people in Québec, we carry out a privacy impact assessment before communicating personal information outside Québec and rely on contracts that require protection comparable to Québec law.

6. AI screenshot import

• If you upload a screenshot, we send it to a named AI provider (OpenAI, Google Gemini or Anthropic, whichever is in use) so it can extract the holdings.
• The image is processed in memory and never stored by us.
• We use commercial or paid API terms. Under those terms the provider may keep inputs briefly for abuse monitoring and is not permitted to use them to train its models. Check the provider’s current terms for details.
• Processing takes place in the United States.
• You review and confirm the extracted holdings before anything is saved. The AI can be wrong.
• Please crop out account numbers, names and other personal details before uploading.
• You can always add holdings manually or by CSV instead, with no AI involved.

7. How long we keep it

• Account and portfolio data: while your account is active, then deleted within 30 days of account deletion.
• Backups: removed on a rolling schedule, within [N] days of deletion.
• Sign-in code hashes: 10 minutes.
• Technical logs: about 90 days.
• Screenshots: never stored.
• Billing and tax records: about 6 to 7 years, as required by Canadian tax rules.
• Security incident records: at least 24 months.

8. Your rights

• Access the personal information we hold about you.
• Correct anything that is wrong. Most details can be edited in the app.
• Delete your account and data yourself in Settings → Delete account.
• Export your data in a structured, commonly used format (portability).
• Withdraw consent to uses that rely on it, such as optional emails, at any time.
• In Québec, ask us to stop disseminating or de-index personal information where the law allows, and to be told of any decision made exclusively by automated processing. We do not make such decisions about you.

Email privacy@<our-domain> and we will respond within 30 days.

If you are not satisfied, you may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, if you live in Québec, the Commission d’accès à l’information du Québec (cai.gouv.qc.ca).

9. Québec (Law 25)

• Our person in charge of the protection of personal information is named in “Who we are”.
• We perform a privacy impact assessment before sending personal information outside Québec, including to the providers listed above.
• We notify the Commission d’accès à l’information and affected people of confidentiality incidents that present a risk of serious injury, and keep an incident register.
• Technology that can identify, locate or profile you is off by default.
• A French version of this policy and our Terms is planned and available on request.

10. Security

We use encryption in transit, hashed one-time codes, rate limiting, access controls and a human check on sign-in. No system is perfectly secure. If a breach creates a real risk of significant harm, we will notify you and the regulator as the law requires.

11. Children

Yield Scanner is for adults aged 18 and over. It is not directed at children, and we do not knowingly collect their information. If you believe a child has signed up, contact us and we will delete the account.

12. Email and CASL

Sign-in codes, receipts and renewal or trial notices are transactional and sent as needed. We send marketing or newsletter email only if you have given express consent (an unticked box you chose to tick). Every marketing email has an unsubscribe link that we honour within 10 business days.

13. Cookies and analytics

We use only strictly necessary cookies: a session cookie that keeps you signed in and, if enabled, a short-lived cookie during Google sign-in. We use no advertising cookies or pixels.

Analytics are off by default. If we add analytics later, we will prefer cookieless, first-party tools, and ask for your opt-in before using anything that could profile you.

14. Changes to this policy

We may update this policy. We will post the new version here with a new date and, for material changes, email you or show a notice in the app before they take effect. Continued use after the effective date means the updated policy applies.

15. Contact

Questions or requests: privacy@<our-domain>. Postal address: [Ontario, Canada. To be completed].