Privacy Policy

Definitions

In this policy: personal information means information about an identifiable individual; personal data is used in the same sense where the context refers to data protection concepts; we, us means VestAccrue, operating the website vestaccrue-ai.com; you means a visitor, registrant or client; service provider means a third party processing information on our behalf under contract.

Personal information we collect

Account and contact data: first and last name, email address, telephone number, country and province of residence, and, when you become a client, date of birth and residential address. Verification data required by our KYC/AML program: identity documents, address documents and, where applicable, liveness captures. Transaction data: deposits, withdrawals, strategy activity and statements. Content data: the messages you send us and records of calls with your account manager. The minimum we collect at registration is name, phone and email; everything else follows from features you actually use.

Usage data

When you visit the site we receive technical data generated by your browser: IP address, approximate location derived from it, browser type and version, device type, referring pages, and pages visited with timestamps. This data powers security monitoring, abuse prevention and aggregate analytics, and is the basis for the geo features of the site such as showing prices in your currency.

Cookies and similar technologies

We use strictly necessary cookies to keep you signed in and maintain security tokens, and preference storage to remember settings like your dashboard preferences. Analytics cookies, if enabled, help us understand which pages help users and which confuse them. Marketing and retargeting cookies are used only with your consent where consent is required, and you can change your choices at any time in your browser or through our cookie notice. Blocking strictly necessary cookies will break sign-in.

Controller and processors

VestAccrue is the controller of the personal information described in this policy. Service providers (KYC verification providers, hosting and IT providers, email delivery, payment processors, analytics) act as processors: they handle information only on our documented instructions, under contracts that restrict use, require confidentiality and set security standards. We do not transfer control of your information to them; we remain responsible for it.

How we use information

We use personal information to: create and administer your account; verify identity as required by law; provide, operate and improve the platform and its features; process deposits and withdrawals; communicate with you about your account, security and, with your consent, products; answer questions and handle complaints; comply with legal obligations including record keeping and reporting; protect the platform and users against fraud, abuse and unauthorized access; and maintain and improve security. Where features require additional data, we ask at the point the feature is used.

Legal bases for processing

We process personal information on the following bases: contract, for everything needed to open and run your account and execute your instructions; legal obligation and legitimate compliance purposes, for KYC/AML checks, record keeping, reporting and responses to lawful authority requests; legitimate interests, for security monitoring, fraud prevention, service improvement and aggregate analytics, balanced against your expectations and rights; and consent, for marketing communications and non-essential cookies, where consent is required. Where we rely on legitimate interests, you can object as described below.

Data retention

Account and contact data are kept while your account is open and for a reasonable period after closure for dispute handling. KYC/AML records are retained for five years after the end of the business relationship, as Canadian requirements provide. Transaction records follow the same five-year standard. Support communications are kept for up to three years. Usage and analytics data is kept in identifiable form for up to 24 months, then aggregated or deleted. When retention periods expire, data is deleted or anonymized so it no longer identifies you, subject to legal holds.

Transfers of data

Your information is primarily hosted in Canada, with some service providers operating in other countries. Where information is transferred outside Canada, we use contracts with protections comparable to Canadian privacy law, and we remain accountable for it. The categories of recipients are described under "Disclosure of information" below, and the current list of processing locations is available on request.

Disclosure of information

We disclose personal information to: the licensed entity executing trades, where trading services are provided in partnership; affiliated companies within our group involved in providing the service; service providers under the protections described above; payment providers as needed to route deposits and withdrawals; and regulators, courts and public authorities, where a lawful request or reporting obligation requires it. In an emergency involving danger to life or security, limited information may be disclosed where lawful. We never sell personal information.

Security

Technical measures include encryption in transit and at rest, access control on a need-to-know basis, logged access to sensitive records, and segregation of verification data. Organizational measures include staff confidentiality obligations, security training, and an incident response process. No system is perfectly secure; if a breach affecting your personal information occurs, we will notify you and the relevant authorities as required by Canadian law, with what happened and what we did.

Your rights

You have the right to: access the personal information we hold about you; correct information that is inaccurate or incomplete; delete information where no legal obligation requires retention (verification records cannot be deleted within their retention period); restrict or object to processing based on legitimate interests, including profiling for analytics; withdraw consent for marketing or optional cookies at any time; and know what disclosures have been made. Requests go to [email protected]; we answer within 30 days and may ask for information to confirm your identity before acting. These rights complement, and do not replace, rights you have under Canadian and provincial law.

Service providers

Categories of providers processing personal information for us: identity verification and screening providers; cloud hosting and IT operations; email and communications delivery; payment processors; analytics (under consent where required); and professional advisers such as auditors and legal counsel under confidentiality. Each is bound by contract to process only for our purposes with appropriate safeguards.

Analytics

We use privacy-respecting analytics to count visits, understand navigation and detect errors. Aggregated statistics guide product decisions. Where analytics tools set identifiers, they are treated under the cookie rules above. Google Analytics may be enabled by our team; when it is, its data processing is covered by this policy and you can object through cookie choices.

Advertising and retargeting

We do not run advertising trackers by default. If we run campaigns that use retargeting, those identifiers are set only with your consent where consent is required, are limited to our own campaigns, and can be withdrawn at any time. We do not share your personal information with advertising networks for their independent purposes.

Third-party links

Our site links to third parties such as exchanges and payment providers. Once you follow a link, their privacy rules apply, not ours. We encourage you to read their policies; we are not responsible for their practices.

Children's privacy

The services are not directed to minors, and you must be at least the age of majority in your province to register. We do not knowingly collect personal information from children. If you believe a minor has provided us information, contact us and we will delete it promptly.

Changes to this policy and contact

We may update this policy to reflect changes in our practices or the law. The current version is always published on this page with its effective date, and material changes are announced in the dashboard. Questions, requests or complaints about privacy: [email protected], or by post to 181 Bay Street, Suite 2100, Toronto, ON M5J 2T3, attention "Privacy, Client Support & Compliance". If we cannot resolve a privacy concern to your satisfaction, you may raise it with your provincial privacy authority, and unresolved complaints generally follow our Complaints procedure.