‍

‍

‍

Privacy Policy

‍

Rypl Financial Solutions Inc.

Version 1.1  |  Adopted April 1, 2026

Rypl Financial Solutions Inc. and its affiliates (collectively, “Rypl”, “us” and “we”) respect your privacy and are committed to protecting your personal information. This Privacy Policy describes our practices and procedures relating to the collection, use, retention, and disclosure of your personal information.

This Privacy Policy applies to Rypl’s privacy practices in connection with our website and any related subdomains (the “Website”), our web and mobile applications (the “App”, and together with the Website, the “Platform”), the products and services we make available through the Platform (the “Services”), and our other interactions with you.

Rypl is responsible for the personal information it collects, uses, and discloses.

Our Privacy Officer oversees the protection of your personal information and our compliance with this Privacy Policy and applicable privacy laws. Please see the contact information for our Privacy Officer at the end of this Privacy Policy in Section 8.

‍

1. Personal Information We Collect

We may collect personal information in order to provide you with the Services you request. We do this by collecting information: (i) directly from you; (ii) automatically when you use the Platform; and (iii) from third parties where you authorize us to do so or where otherwise permitted by applicable law.

‍

1.1 Information We Collect Automatically: When you create a Rypl profile, apply for Services, or use the Rypl Platform, we may automatically collect certain information about you, including:

• App and device data: device type, hardware model, operating system, language preferences, the date and time the App connects to our servers, browser type, time zone, IP address, unique device identifiers, and in some cases your device’s GPS coordinates.
• Usage data: search activity and Website history, including cookie data, information about your use of the Platform, including transactions, card and account activity, payment history, parties to transactions, and the Services you use or may qualify for.
• Analytics: we use analytics tools such as Google Analytics to help us collect and evaluate information about how our Website is used, including pages visited, time spent, search terms, and other engagement information.
• Additional Information: we will make commercially reasonable efforts, subject to the limitations of third-party providers such as Apple and Google, to clearly explain what information the App collects, how it is used, and with whom it may be shared. Please note that some practices are outside our control, including tracking carried out by Apple, Google, your telecommunications provider, or other third parties. We are not responsible for the actions of those third parties. You should review and understand the policies of any third-party provider, including Google for Android apps, Apple for iOS apps, and your telecommunications provider, before purchasing or downloading any application.

‍

1.2 Information We Collect from Third Parties: When you create a Rypl profile, apply for Services, or use the Rypl Platform, we may collect information about you from third parties, including:

• Identity information: name, address, date of birth, phone number, and device-related information from telecommunications providers.
• Biometric information: identity verification service providers may collect biometric information, such as an image of your government-issued identification together with a real-time image or video, to verify your identity; we may collect information from your identification, such as an ID number, along with the outcome of the identity verification process, for example whether verification was successful.
• Screening information: the results of anti-money laundering, sanctions, fraud, or similar screening checks from third-party screening providers.
• Third-party account information: financial institution details, account numbers, and balance information.

‍

1.3 Information You Provide to Us: When you create a Rypl profile or apply for Services, you may be asked to provide information such as the following:

• Identity information: your full name, email address, phone number, password, date of birth, mailing address, residential address and address history, employment and educational information, social insurance number (where requested, providing your SIN for identity verification may be optional), tax information, and identification documents.
• Financial information: information about your income, living arrangements, sources of income, credit information including assets, liabilities, and payment information, account objectives, risk tolerance or capacity, and investment timelines.
• Biometric information: images of yourself and images of your government-issued photo identification.
• Information about others: such as the full name, email address, and phone number of your spouse, family or household members, authorized users, or counterparties.
• Survey information: responses and information collected through surveys, user feedback initiatives, and client research.

‍

2. How We Use Your Information

In addition to purposes identified to you before or at the time of collection, the personal information we collect may be used for the following purposes:

‍

2.1 Identity Verification:

• To verify your identity and other information you provide to us.
• To complete identity verification through credit file or similar verification methods.
• To detect, prevent, and investigate fraud.

‍

2.2 Account and Product Servicing

• To contact you by mail, email, SMS message (message and data rates may apply), in-app messaging, and telephone to respond to your questions or comments.
• To deliver, administer, and improve the financial products and services you have with us, and to provide you with relevant information concerning your application and/or account.
• To manage and authenticate access to your Rypl profile, enable your use of products and services, notify you of changes to the Platform, and market products and services to you in accordance with this Privacy Policy.
• To facilitate transactions involving linked bank accounts.
• To help determine which products and services may be appropriate for you.
• To train our personnel and support quality assurance activities.
• To open, maintain, service, process, analyze, market, audit, collect on, or fulfill products, services, and packages related to rewards programs, premium offerings, marketplaces, or similar Rypl offerings.

‍

2.3 Legal and Regulatory: To comply with applicable legal and regulatory requirements, including requirements relating to anti-money laundering, sanctions compliance, tax reporting, mortgage activities, suitability assessments, and investment suitability where applicable.

‍

2.4 Offers, marketing and advertising: To contact you by mail, email, SMS message (message and data rates may apply), push notification, and telephone to notify you of changes to the Services, provide important updates regarding account opening disclosures, and send important or useful messages relating to your financial accounts.

• To provide you with personalized marketing communications. You may request that we no longer contact you for advertising, marketing, promotions, rewards programs, or research by updating your privacy preferences within the Platform.
• For more information, please see section 4 – Your Choices.

‍

2.5 Analytics: To generate insights that support business decision-making, including introducing new features or products, modifying or removing existing features or products, improving adjudication and internal risk models, optimizing resources, and managing our business.

• To better understand our clients and improve our product and service offerings.
• To assess existing products and services, develop new products and services, optimize our Website, perform analytics, and enhance the client experience we provide.
• To evaluate and improve user experience on the Website.
• To better understand activity within the App, monitor and improve the App, and tailor your in-app experience. We may also use third-party service providers to collect analytical information concerning your use of the App, such as features used and time spent in the App, to help personalize your in-app experience, improve our products and app quality, and manage and analyze information to better understand our users.
• For more information, please see Section 4 – Your Choices.

‍

2.6 Automated decision making: When processing your personal information, we may use automated decision-making systems to help deliver products and services to you, including for identity verification, analytics, security, anti-money laundering, and fraud detection and prevention purposes. You may contact us for further information regarding our use of these systems, including how to challenge a decision, as described in section 8.

‍

2.7 Personal Information We Process on Behalf of Third-Party Organizations: In addition to personal information that we collect and use for our own purposes, we may from time to time act as a service provider to third-party partners and assist them in processing certain personal information on their behalf. For example, we may act as a service provider to organizations connected with financial products or services made available to you through our platform.

Where we process personal information on behalf of partners, we rely on those third-party organizations to comply with applicable privacy laws in collecting, using, and disclosing personal information, including obtaining any necessary consent. We require third parties to ensure they have the authority to provide personal information to us in accordance with applicable privacy laws. If you have questions about personal information we process on behalf of one of our partners, we encourage you to contact that partner directly and/or review its applicable privacy policy first.

‍

3. Sharing of Personal Information

We do not sell, rent, or disclose your personal information to third parties without your consent, except as described below or as otherwise permitted by applicable law.

‍

3.1 Service Providers; Your personal information may be transferred to, collected by, or otherwise made available to third parties in connection with the Services. These may include:

• Client support: to provide support services to clients who contact us with questions about Rypl or our products and services, including support involving our financial, co-brand, or third-party partners, we may share identity, financial, and credit information.
• Lenders: where applicable, to administer a mortgage product, including processing or servicing mortgages, dealing with mortgage insurers, consumer reporting agencies, title custodians, and title insurance providers, we may share identity, financial, credit, and biometric information.
• Payment processing businesses: to process payments and transactions, we may share identity and financial information, and information about others where required.
• Sanctions screening providers: to confirm that you are not subject to sanctions or other restrictions under anti-money laundering, anti-terrorist financing, or related legal requirements, we may share identity information.
• Marketing and research companies: to help us understand and deliver products, services, and offers that may be relevant to you and others like you, or to avoid sending offers that are unlikely to be relevant, we may share app and device data, usage data, analytics, or anonymized and aggregated information with digital affiliates and companies such as Google or Meta.
• Print and card suppliers: to issue and service card products, we may share identity and financial information with suppliers that print and send cards, statements, and related materials.
• Cloud service providers: to store your information and help operate the Platform and Services.
• Our service providers are provided only with the information they require to perform their designated functions. Service providers may be located in Canada or in other jurisdictions. Your personal information may be stored and processed by us, our affiliates, and third-party service providers in Canada or in other jurisdictions. Those jurisdictions may not have the same privacy laws as the jurisdiction in which you provided the information. When we transfer your information to another jurisdiction, including outside the province in which you reside and outside Canada, it will be subject to the laws of that jurisdiction and may be disclosed to or accessed by courts, law enforcement, and government authorities in accordance with those laws. By submitting your information to us, you agree to that transfer, storage, and processing.

‍

3.2 Legal and Compliance: In response to a search warrant or other legally valid inquiry or order, or to another organization for the purpose of investigating a breach of an agreement or a contravention of law, or for detecting, suppressing, or preventing fraud, or as otherwise required or permitted by applicable law or legal process, we and our service providers may share your information with regulatory bodies, courts, law enforcement agencies, payment networks, or other government institutions. Your personal information may also be disclosed where necessary for the establishment, exercise, or defence of legal claims and to investigate or prevent actual or suspected loss or harm to persons or property.

‍

4. Your Choices

‍

4.1 Access and Accuracy: Subject to limited exceptions under applicable law, you may have the right to access, update, correct inaccuracies in, or request portability of personal information in our custody or control, to withdraw consent to our collection, use, and disclosure of your personal information, and to request deletion of your personal information. You may do so by contacting our Privacy Officer using the contact details set out below in section 8. We may request certain personal information to verify the identity of the person seeking access to personal information records.

Rypl seeks to keep your personal information as accurate and complete as reasonably possible based on the most current information available to us. We make reasonable efforts to reduce the use of inaccurate, incomplete, or outdated personal information when making decisions about you. To help maintain accuracy, we may periodically review or update your information and keep records of when your personal information was changed or updated. We may also verify the accuracy of your information when you contact us about your accounts.

If your personal information changes or if it is inaccurate or incomplete, you may request correction or amendment of the personal information we hold about you, subject to any exceptions required by law. You may be able to view and update certain personal information through our Platform, or you may contact Rypl’s client support team through the contact information made available on our Website or by writing to our Privacy Officer using the details at the end of this Privacy Policy in section 8. Where appropriate, we will communicate corrected personal information to third parties to whom inaccurate information was previously disclosed.

Where required by and subject to applicable law, on request Rypl will inform you of the personal information in our possession, how it is being used, and to whom it has been disclosed. To request this information, please contact our Privacy Officer using the contact information in section 8.

‍

4.2 Analytics and Advertising: Google Analytics: for more information about Google Analytics, or to opt out using the Google Analytics opt-out browser add-on, please review information made available by Google concerning how Google uses data when you use partner sites or apps and Google Analytics and Privacy.

‍

Personalized Marketing: personalized marketing is optional and you can manage your privacy preferences within the Platform. If required by applicable law in your jurisdiction, you may be opted out of certain personalized marketing by default.

‍

Location Tracking: you may opt out of location tracking at any time by turning off location services for the App in your mobile device settings.

‍

Cookies: we use cookies, which are small files placed by a website’s server on your computer or device so that we can recognize your device when you return. You may set your browser to notify you when you receive a cookie or to reject cookies, although doing so may limit our ability to customize and test your experience, including remembering your preferred language or presenting location-specific information.

‍

Marketing: we may use third parties such as ad exchanges and data companies to display our advertisements on our Platform or on other websites.

‍

These companies may use cookies, tracking tags, or web beacons to collect information about visits to our Website and other websites, such as the pages you visit and your response to advertisements, in order to measure the effectiveness of our marketing campaigns and deliver advertisements that are more relevant to you both on and off our Platform. To learn more about this type of behavioural advertising or to opt out, you can visit the Digital Advertising Alliance website or the Digital Advertising Alliance of Canada website.

‍

5. Safeguarding and Retention of Personal Information

We use industry-standard security practices and procedures to protect your personal information.

We use procedures, practices, and reasonable administrative, technical, and physical safeguards appropriate to the sensitivity of the personal information in order to protect against loss, theft, unauthorized access, disclosure, copying, use, or modification. We restrict access to personal information to those individuals and parties who need to know it and we regularly train our personnel on information security and privacy best practices. We use security measures such as passwords, encryption, multi-factor authentication, security monitoring software, secure cloud storage, and restricted access to our offices. Where we transfer personal information to third parties for processing, we require those third parties by contract to protect personal information in a manner consistent with our privacy principles, procedures, and practices. Third parties receive only the information necessary to perform the services described in their contracts.

‍

We limit retention of your personal information.

‍

Except where otherwise permitted or required by law, your personal information will be retained only for as long as reasonably necessary to fulfill the purposes for which it was collected. We may retain your personal information, together with other information about you in our records, even after your account has been closed, in order to comply with legal and regulatory obligations.

‍

6. Information About Our Privacy Governance Policies and Practices

We are committed to protecting personal information and have implemented a comprehensive set of policies and practices governing how we treat personal information. These policies and procedures include, among other things, the following:

• We have implemented policies and procedures designed to protect personal information in our custody and control from unauthorized access, use, or disclosure.
• We follow a security compliance program, to help ensure that our systems and infrastructure are securely controlled and effectively operated. Our controls are reviewed regularly for operating effectiveness and security.
• We regularly redact data when transmitting it outside secure segments or applications within our private network. We use encryption where appropriate to further protect data both at rest and in transit. In the event of a data breach, encrypted data cannot be viewed or otherwise used without the necessary keys, and our key management processes are designed to prevent key export.
• We have implemented processes to respond to data subject requests and complaints in a timely and effective way.
• We have established a framework for the retention and secure destruction of personal information so as to comply with legal obligations and securely destroy personal information once it is no longer required.
• We have implemented a privacy framework that defines the roles and responsibilities of our employees with respect to the handling of personal information. Although all Rypl personnel share responsibility for safeguarding your personal information, we have designated key internal leaders with responsibility for data within the business.
• We have appointed a Privacy Officer who oversees Rypl’s compliance with privacy legislation, advises Rypl on its personal information and data protection obligations, and monitors compliance. Our technical teams are responsible for the technical controls used to manage and safeguard your data, including information security systems and secure data storage.
• We provide regular privacy training and awareness programs to our employees.

‍

7. Updates to our Privacy Policy

This Privacy Policy describes our current privacy procedures and practices. We may revise this Privacy Policy from time to time. Any changes will become effective when the updated version is posted on our Website. Individuals who have a relationship with Rypl will be notified of material changes that may affect them. Your use of our Services after any changes to the Privacy Policy indicates your acceptance of the updated Privacy Policy.

‍

8. Contact Us

Our Privacy Officer is responsible for advising Rypl regarding our obligations relating to personal information and data protection and for monitoring compliance. Please contact our Privacy Officer if you have any questions, concerns, or complaints about how we handle your personal information or about this Privacy Policy, or if you wish to submit an access, correction, or deletion request. Our Privacy Officer may be contacted at the following address:

‍

Rypl Financial Solutions Inc.

Attn: Compliance & Privacy

530 8 Ave SW, Suite 1110

Calgary, AB T2P 3S8

compliance@ryplworks.com