Privacy Policy

The organization responsible for your personal information is Liam Agent, based in Montréal, Québec, Canada. Our person in charge of the protection of personal information (Privacy Officer) can be reached at contact@liamagent.com. You can ask us for their title and contact details at any time.

Account information. Name, email address and a hashed password. If you sign in with Google or Apple, we receive your name and email (or Apple's private relay address) from them — never your password.

Financial information you give us. Accounts, balances, budgets, goals and the documents you upload (bank statements, pay stubs, credit reports) in PDF, CSV or image format.

Bank connection data (optional). If you connect a bank through Plaid, we receive read-only balances, transactions and the institution's name. Access tokens stay on our servers. LIAM cannot initiate payments or transfers.

Conversations. Your messages to the assistant and its answers, kept so it can follow up and so you can find them again.

Advisor and expert requests. When you book a meeting or write to an advisor or expert, your message, your availability and the summary of your situation prepared for them (Section 6).

Payments. On the web, Stripe processes your card; we receive your subscription status and billing email, never your card number. In the iPhone app, Apple processes the purchase and we receive the receipt that proves it.

Identity verification outcome (optional). Verified, pending or rejected, and a reason code if rejected — never the documents themselves (Section 8).

Usage and device data. IP address, browser and device type, pages and features used, timestamps, error reports and, in the app, a push-notification token.

Consent records. Which policy versions you accepted and which optional permissions you granted or withdrew, with the date, time, IP address and the screen you used — and the date we emailed you notice of a change to these texts.

Voice. Voice input and read-aloud run on your own device. No audio is sent to us or recorded.

We collect this information from you, from your device, and — only at your request — from Plaid, Google, Apple and Stripe.

• To provide the assistant: measure the cash you can use, simulate decisions, find money you are losing, and answer your questions
• To run your account, subscription and free trial, including the reminder we send the day before your first charge
• To prepare an advisor or expert for a meeting you asked for
• To send service messages: confirmations, billing notices, security alerts and notices of changes to these texts
• To send news and offers — only if you opted in, as Canada’s anti-spam law (CASL) requires; every message has an unsubscribe link
• To keep the service secure: prevent fraud, abuse and unauthorized access
• To understand which features help and fix what breaks, using analytics and error reports
• To meet our legal obligations and keep proof of your consents

LIAM does not make decisions about you that produce legal or similarly significant effects based solely on automated processing. The assistant's suggestions are information for you to weigh; you decide.

• We do not sell your personal information, and we do not “share” it for cross-context behavioural advertising
• We do not use your information for advertising, and we do not show ads
• We do not let our AI provider train its models on your data
• We do not use your financial information for anything other than providing and securing the service you asked for

The assistant is powered by Claude, a model operated by Anthropic PBC (United States). When you use an AI feature, we send Anthropic, over encrypted connections: your messages and conversation history; your financial context (accounts, balances, transactions, budgets, goals and the preferences you set) so answers reflect your real numbers; and the PDF or image documents you upload, so their transactions can be read. We never send your password, identity documents or card details.

Nothing is sent without your explicit permission. The app asks for AI data sharing before any AI feature runs, and our servers refuse to send anything for an account that has not granted it. Withdraw it at any time in Settings → Privacy & Consent (web) or Settings → Privacy (app); the AI features stop and the rest of LIAM keeps working.

Anthropic acts as our service provider: it may use the data only to provide the service to us, does not train its models on data sent through its API, and does not sell it.

When a decision involves choosing investment products, or goes further, you can ask for a video meeting with an advisor or expert, or write to one. Only then, and only for that request, the professional assigned to it can see your name, your message and a summary of your financial situation prepared from your LIAM data, so the meeting starts from your real numbers. They are bound by confidentiality and may use it only to answer your request.

These providers process personal information on our behalf, under contracts that limit its use to the service they provide us and require them to protect it.

We may also disclose information when the law requires it (for example, a valid court order), to protect the rights and safety of our users or of LIAM, or to a successor in a merger or acquisition — in which case this policy continues to apply to your information and you will be told.

If you choose to verify your identity, Stripe Identity collects your government ID and a selfie and checks them, under Stripe's Privacy Policy. We receive only the outcome and, if rejected, a reason code. We never receive, store or see your documents or selfie. Verification is optional unless a feature you choose requires it.

• Encryption in transit (TLS 1.2+) and at rest (AES-256)
• Row-level security: each account can reach only its own data
• Every API request is authenticated on the server; keys and bank tokens never reach your browser
• Signature checks on every incoming webhook, and rate limits against abuse
• Two-factor authentication available on every account

No system is risk-free. If a privacy incident creates a risk of serious injury or a real risk of significant harm to you, we will notify you and the authorities as the law requires — in Canada, the Office of the Privacy Commissioner and, depending on where you live, the Commission d'accès à l'information du Québec or the Information and Privacy Commissioner of Alberta; in the United States, the regulators and residents your state's breach-notification law requires. We keep a register of incidents. Report a suspected security issue to contact@liamagent.com.

Deleting your account (Settings → Data & Account, web or app) is immediate: we revoke bank connections, we cancel your web subscription and permanently delete your account and its data. Copies in our providers' encrypted backups are overwritten on their rotation schedule. A subscription bought in the iPhone app is managed by Apple: cancel it in your App Store account so you are not billed again.

Wherever you live in Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) protects you. If you live in Québec, Alberta or British Columbia, your province's private-sector privacy law also applies: Québec's Act respecting the protection of personal information in the private sector (as amended by Law 25), and the Personal Information Protection Act of Alberta or of British Columbia. Under these laws you can:

• Access the personal information we hold about you and learn how it is used and to whom it was disclosed
• Correct information that is inaccurate or incomplete
• Withdraw consent to optional uses (AI data sharing, marketing) at any time in Settings
• Obtain your data in a structured, commonly used technological format — Settings → Export gives you a JSON file
• Have it deleted — Settings → Data & Account, or by writing to us
• Ask us to stop disseminating your information or to de-index a link to it where the law allows (Québec)

We answer within 30 days. If you are not satisfied, you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, depending on where you live, to the Commission d'accès à l'information du Québec (cai.gouv.qc.ca), the Office of the Information and Privacy Commissioner of Alberta (oipc.ab.ca) or the Office of the Information and Privacy Commissioner for British Columbia (oipc.bc.ca).

Depending on the state you live in — including California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon and the other states with a consumer privacy law — you can:

• Know and access the personal information we collected about you, its sources, purposes and recipients
• Correct inaccurate information
• Delete your personal information
• Obtain a portable copy (Settings → Export)
• Opt out of the sale of personal information, targeted advertising and profiling with significant effects — we do none of these, so there is nothing to opt out of, but you may still ask
• Limit the use of sensitive information — we use your financial account information only to provide the service you requested, which the law permits
• Appeal a decision we make on your request, by replying to our answer with “Appeal”; if we deny the appeal, you may contact your state attorney general
• Not be discriminated against for exercising any of these rights

Send requests to contact@liamagent.com from the email on your account, or through an authorized agent with your signed permission. We verify requests by confirming control of that email, and we answer within 45 days (extendable once by 45 days where the law allows, with notice).

In the past 12 months we collected the categories below, for the purposes in Section 3, from the sources in Section 2. We disclosed them only to the service providers in Section 7, for business purposes. We did not sell or share (for cross-context behavioural advertising) any of them, and we have no actual knowledge of selling or sharing the information of anyone under 16.

We use sensitive personal information only for purposes permitted by Cal. Code Regs. tit. 11, § 7027(m) — providing the service you asked for, security and integrity.

Necessary cookies keep you signed in and remember your language and theme. The service cannot work without them.

Analytics. We use PostHog to understand how LIAM is used. It sets a cookie and local storage on our own domain and, once you sign in, links activity to your account so we can see where people get stuck. We use it for product improvement only — never for advertising. To opt out, write to contact@liamagent.com and we will exclude your account.

We use no advertising cookies, no cross-site trackers and no advertising networks. Because we do not sell or share personal information, we treat a Global Privacy Control signal as a confirmed opt-out and there is nothing further to change; browsers' "Do Not Track" setting has no effect on a site that does not track across sites.

Our providers store and process information mainly in the United States; Section 7 lists each of them and where it is located. As Canadian law requires, we tell you this before collecting your information, and our Privacy Officer (Section 19) will answer your questions about how these providers collect, use, disclose and store it. Before communicating personal information outside Québec, we also assess, as Québec law requires, whether it will receive adequate protection, and we bind the recipient by contract. Information held in another country may be accessible to its courts and authorities under its laws.

LIAM is for adults 18 and over. We do not knowingly collect information from anyone under 18, and never from a child under 13. If you believe a minor has an account, write to contact@liamagent.com and we will delete it.

LIAM is offered in Canada and the United States. If you use it from the European Economic Area or the United Kingdom, we process your information to perform our contract with you, on your consent (AI data sharing, marketing) and for our legitimate interest in keeping the service secure; you have the rights of access, rectification, erasure, restriction, portability and objection, and may complain to your data protection authority.

When we change this policy we update the date and version above. For a material change, we email you at least 30 days before it takes effect for your account, with the date it takes effect, and ask for your consent again before you continue; if you do not accept, you can close your account at no cost. Until then, the version you accepted continues to apply. New accounts accept the current version when they sign up. Earlier versions: previous versions.

Canada: Office of the Privacy Commissioner of Canada (priv.gc.ca). Québec: Commission d'accès à l'information (cai.gouv.qc.ca). Alberta: Office of the Information and Privacy Commissioner (oipc.ab.ca). British Columbia: Office of the Information and Privacy Commissioner (oipc.bc.ca). California: California Privacy Protection Agency (cppa.ca.gov) or the Attorney General. Other U.S. states: your state attorney general.