EnoughLine is a personal-finance service operated by Tekinno Software LTD ("we", "us"). It lets you and the household members you invite see your accounts, balances, transactions, and financial plans in one place. This policy explains what personal information we handle, why, who processes it on our behalf, and the choices you have — including exporting everything and deleting your account entirely.

What data we collect

• Account data — your email address, a hashed password, and your multi-factor authentication enrolment, managed by our authentication provider.
• Financial data you connect — account names, types, currencies, balances, transactions, and investment holdings retrieved from institutions you link through our connectivity providers, plus a daily history of balances so you can see change over time.
• Data you add yourself — manual accounts and entries, budgets, goals, and notes.
• Workspace data — who you have invited to your household workspace and the plan your workspace subscribes to.

We do not collect your bank or brokerage login credentials. Those are entered directly into the secure widgets of our connectivity providers and are never seen or stored by us. We do not run any advertising trackers. We do use a first-party product-analytics provider (see below) that measures product usage in aggregate — never your financial numbers, entered content, or names — so we can see which features are used and where new sign-ups get stuck.

How we use your data

• To provide the service: showing your finances back to you.
• To power the AI features you invoke — categorization, questions, and insights.
• To bill your subscription and provide support.

We do not sell your data, share it for advertising, or use it for any purpose other than operating the service for you.

Service providers we rely on

The following providers process data on our behalf. Each is bound by its own terms and receives only what its role requires:

• Plaid Inc. — bank connectivity. Retrieves balances and transactions from banks you link. By connecting an account you also agree to Plaid's End User Privacy Policy. We use read-only products and never initiate payments or transfers.
• SnapTrade — brokerage connectivity. Retrieves holdings, activity, and balances from investment accounts you link, read-only, under SnapTrade's privacy policy.
• DeepSeek — AI processing, in the People’s Republic of China. When you use an AI feature, the relevant slice of your financial data — the merchant names and amounts of transactions being categorized, along with account names and balances for the assistant — is sent to DeepSeek's API to produce the result, and is processed on servers in China under Chinese law. We no longer upload documents of any kind: statement import was removed, so no PDF, no statement text, and no name or address from a statement header is sent anywhere. If you would rather no financial data leave Canada, don’t use the AI features — every other part of the service works without them.
• Alpha Vantage — market data. Receives only public ticker symbols to fetch prices and benchmarks; none of your personal or account data is sent.
• Supabase — database and authentication hosting, where your data is stored encrypted at rest.
• Vercel — application hosting.
• Sentry — error monitoring. Receives crash reports and the page a crash happened on, so we can fix it. Configured not to send personal information; it never receives balances, transactions or anything you have typed.
• Resend — email delivery. Receives your email address and the contents of the messages we send you (confirmations, invites, billing notices).
• Stripe — subscription payments. Card details are entered on Stripe-hosted pages and never touch our servers.
• Mixpanel Inc. — product analytics. Receives event names (for example, connect_bank_completed or dashboard_viewed), a hashed workspace identifier, and your plan tier. Account balances, transaction descriptions, merchant names, entered content, and your email address are stripped before any event leaves our servers.

We also fetch public reference data — market prices, exchange rates and Bank of Canada rates — from Alpha Vantage, Yahoo Finance, Frankfurter, open.er-api.com and the Bank of Canada. Those receive ticker symbols and currency codes only. Nothing about you or your accounts is sent to them.

Where your data is processed

Your data is stored with Supabase and served through Vercel. Several of the providers above operate outside Canada: DeepSeek in the People’s Republic of China, and Stripe, Mixpanel, Resend and Sentry principally in the United States.

While your information is in another country it is subject to that country’s laws, and may be accessible to its courts, law enforcement and national-security authorities under lawful process there. Canadian privacy law does not follow it across the border. We say this plainly because you cannot meaningfully agree to something you haven’t been told.

Household sharing

If you invite someone to your workspace, they can see the workspace's financial data — that is the point of inviting them. Only the workspace owner can invite or remove members, manage the subscription, or delete the workspace. Invite people you trust with this information.

How your data is protected

• Access tokens for your financial institutions are encrypted with AES-256-GCM before they are stored, using a key held only in the server environment.
• All data is transmitted over TLS and encrypted at rest.
• Database access is enforced at the row level, so data is only ever readable by the members of the workspace it belongs to.
• Signing in requires two-factor authentication.
• The application is read-only by construction: no code path exists that can move your money or place trades.

Full detail is on our Security page.

Data retention, export, and deletion

Your data is retained while your account exists, so your history is there when you come back. You are in control of it at all times:

• Disconnect an institution at any time from Settings; doing so revokes our access with the connectivity provider and permanently deletes that connection's stored access token, accounts, balances, and synced transactions.
• Export your data from Settings at any time — a machine-readable copy of your accounts, balances, transactions, history, and settings.
• Delete your account from Settings. This revokes institution access upstream, permanently deletes your workspace's financial data and your sign-in account, and is not reversible. If your payment provider or our legal obligations require us to retain billing records, those are kept only as long as the law requires.

Cancelling a paid subscription never deletes anything — paid features pause and your data remains intact.

Your rights

Subject to the laws that apply to you (including PIPEDA in Canada), you may request access to, correction of, a copy of, or deletion of your personal information. The export and deletion tools in Settings satisfy most requests instantly; for anything else, contact us and we will respond within a reasonable time.

Children

The service is not directed to children and requires you to be the age of majority in your province or territory to open an account.

Changes to this policy

If we make material changes, we will update this page and its date, and notify account holders by email or in the app before the changes take effect.

Contact

Tekinno Software LTD — support@enoughline.com