How we govern personal information

The person in charge of the protection of personal information is the President of Maliko Labs Inc. They approve these practices, are consulted on every privacy impact assessment, assess every confidentiality incident, and sign off every notice. Write to them at support@maliko.ca.

Nobody at EvenHearth reads a household's entries, receipts, shops, comments or settlements as part of normal work, and our support tools cannot show them.

Our staff can look up an account to help its owner: how it is set up, its sessions, its plan and its problem reports. Each person can do only what their role needs. Opening or searching an account, and every change our staff make, is recorded in an audit log that staff cannot alter, kept 24 months. The few people who review receipts that someone chose to share see only that copy.

Outside providers receive only what each one needs for its job, and are listed on Subprocessors before they receive anything. The most personal parts of your records, such as names, notes, comments, and receipt images and their text, are also encrypted with a key for one account or one household alone.

Each kind of information has a period, and the periods are on Data retention. When the purpose has been met, the information is destroyed. When you delete your account, it is erased 30 days later unless you recover it first. Copies in our backups are deleted within 100 days, and the parts encrypted for your account or household become unreadable within 14 days of the erasure. Some records are kept longer for a stated reason, such as billing records for six years, as tax law requires; Data retention lists them.

We assess the privacy of the system as a whole, and again before a change that adds a provider, a country, a kind of information or a purpose. The assessment weighs how sensitive the information is, why it is needed, how much of it there is, who receives it, where it goes and how it is protected. For any information that leaves Quebec it also weighs the law of the place it goes to. The assessments are reviewed every year.

Any access to, use of, disclosure of or loss of personal information that should not have happened is recorded as an incident, however small, and contained first. We assess whether anyone risks serious harm. If so, we notify the Commission d'accès à l'information and the Office of the Privacy Commissioner of Canada as the law requires, and tell the people affected without delay.

Every incident is kept in a register for five years, whether or not anyone had to be told.

You can ask to see what we hold about you, to correct it, to have a copy in a usable format (Settings can export every household you are in), to withdraw a consent, or to have it deleted. Send a request or a complaint in writing to support@maliko.ca. We help you put it in writing if you need that, and we answer in writing within 30 days.

If you are not satisfied, you can complain to the Office of the Privacy Commissioner of Canada, the Information and Privacy Commissioner of British Columbia or of Alberta, or the Commission d'accès à l'information du Québec. You can do so without writing to us first.

The date at the top is the date of the last change. A material change is also announced in the app, as a change to the Privacy Policy is.