BankReady Privacy Policy
Effective Date: July 23, 2026 · Last Updated: July 23, 2026
1. Who We Are
This Privacy Policy explains how BankReady Inc. (“BankReady,” “we,” “us,” or “our”), operating under the brand names BankReady and Rafi Credit, collects, uses, discloses, and protects personal information when you visit our website, join our waitlist, or use the BankReady application (collectively, the “Service”).
BankReady Inc. is incorporated federally under the Canada Business Corporations Act, with its head office located in Mississauga, Ontario, Canada. This policy is designed to comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable to residents of Quebec, An Act respecting the protection of personal information in the private sector (commonly known as “Law 25”).
If you do not agree with this Privacy Policy, please do not use the Service.
Privacy Officer / Contact: Mo Rafi, Founder, reachable at info@bankready.ca or Unit 200, 4230 Sherwoodtowne Blvd, Mississauga, ON L4Z 2G6. Under Quebec’s Law 25, every organization must designate a specific person responsible for privacy compliance — this is that person.
2. Personal Information We Collect
We collect the following categories of personal information:
2.1 Information you give us directly
- Contact information: name, email address, and (if provided) phone number.
- Account credentials: username/email and password (stored in hashed/encrypted form — we do not store plain-text passwords).
- Onboarding and quiz data: self-reported income, pay frequency, rent/housing costs, other monthly expenses, self-reported credit score range, number and type of credit cards, and financial goals you share with us (e.g., property ownership goals).
- Uploaded financial documents: credit card and/or bank statements you choose to upload, from which we extract data such as balance, interest rate (APR), minimum payment, and transaction categories, in order to build your personalized payoff plan.
- Payment information: if you subscribe to a paid plan, your payment card details are collected and processed directly by our third-party payment processor, Stripe. BankReady does not receive or store your full card number.
- Communications: anything you send us via support requests, surveys, or feedback forms.
2.2 Information we collect automatically
- Usage data: pages viewed, features used, session duration, and interactions within the app.
- Device and technical data: IP address, browser type, operating system, device identifiers, and approximate location derived from IP address.
- Cookies and similar technologies: see our separate Cookie Policy for full detail.
2.3 What we do not collect
- We do not ask for or store your online banking username or password. Statement data is provided by you uploading a document (e.g., a PDF or CSV statement) — we do not connect directly to your bank account, and we do not use screen-scraping or credential-based bank-login integrations.
- We do not knowingly collect information from anyone under the age of 18. If we learn we have collected personal information from a minor, we will delete it.
3. How and Why We Use Your Information
We use personal information for the following purposes, and only to the extent reasonably necessary for each:
| Purpose | Information Used |
|---|---|
| Generate your personalized debt payoff estimate, projected timelines, and educational strategy suggestions (e.g., general information about rate-conversion or consolidation options) | Onboarding data, uploaded statement data |
| Create and maintain your account | Contact info, credentials |
| Process subscription payments | Payment info (via processor) |
| Operate, maintain, and improve the Service (including bug fixes and new features) | Usage data, technical data |
| Communicate with you about your account, service changes, or (with consent) marketing/educational content | Contact info |
| Detect, investigate, and prevent fraud, abuse, or security incidents | Technical data, usage data |
| Comply with legal, tax, or regulatory obligations | As required by law |
We do not use your uploaded financial data to make decisions on your behalf, submit any application on your behalf, or share your financial data with any bank or lender without your explicit, separate action and consent at the time. BankReady provides general, educational output based on the numbers you provide — it does not access, negotiate, or transact with any financial institution directly.
Legal basis for processing (PIPEDA / Law 25)
We collect and use your personal information based on your meaningful consent — either express (e.g., when you upload a statement or check a box) or implied by the nature of the interaction (e.g., using your email to respond to a support request you sent us). Where we intend to use information for a materially different purpose than originally collected, we will seek fresh consent first.
4. How We Protect Your Information
- Encryption: Uploaded statements and account data are encrypted both in transit (TLS) and at rest.
- Access controls: Only authorized personnel with a legitimate operational need can access identifiable financial data, and access is logged.
- No banking credential storage: As noted above, we never collect or store your online banking login details.
- Data minimization: We extract only the fields needed to generate your payoff analysis (balance, rate, minimum payment, relevant transaction categories) rather than retaining full, unredacted statement images longer than necessary.
- Retention: We retain your account and financial data for as long as your account is active, so that features like your progress dashboard continue to work. If you close your account, we will delete or anonymize your personal information within 90 days, except where we are required to retain certain records longer for legal, tax, or accounting purposes (typically up to 7 years for financial/payment records under Canadian tax law).
No system is 100% secure, and we cannot guarantee absolute security of information transmitted to us.
5. How We Share Your Information
We do not sell your personal information. We may share information with:
- Service providers (“subprocessors”) who help us operate the Service under contract and only for that purpose, currently: website hosting (GitHub Pages, operated by GitHub, Inc.), waitlist form submissions and email delivery (Kajabi), and payment processing for paid subscriptions (Stripe). We are not currently using any analytics or advertising/tracking service; if that changes, this policy and our Cookie Policy will be updated first.
- Professional advisors (lawyers, accountants, auditors) as needed.
- Legal or regulatory authorities, if required by law, court order, or to protect the rights, property, or safety of BankReady, our users, or the public.
- A successor entity, if BankReady is involved in a merger, acquisition, or sale of assets — you will be notified of any such change in control over your personal information.
Cross-border data transfers
Some of our service providers (including GitHub, Kajabi, and Stripe) may store or process data outside Canada, including in the United States. Where this occurs, your information may become subject to the laws of that jurisdiction, including potential access by foreign government authorities. We select service providers that maintain appropriate contractual and security safeguards, and under Law 25, we conduct a privacy impact assessment before transferring personal information outside Quebec where required.
6. Your Rights
Depending on your province of residence, you have the right to:
- Access the personal information we hold about you.
- Correct inaccurate or incomplete information.
- Withdraw consent for a given use, at any time, subject to legal or contractual restrictions (withdrawing consent may limit our ability to provide certain features).
- Request deletion of your personal information, subject to our legal retention obligations.
- Request portability of certain information you’ve provided, in a structured, commonly used format (a right specifically available to Quebec residents under Law 25).
- File a complaint with the Office of the Privacy Commissioner of Canada or, for Quebec residents, the Commission d’accès à l’information (CAI), if you believe we have not handled your information appropriately.
To exercise any of these rights, contact us at info@bankready.ca. We will respond within the time period required by applicable law (generally 30 days).
7. Marketing Communications
If you sign up for our waitlist or provide your email, we may send you educational content and updates about BankReady. This is governed by Canada’s Anti-Spam Legislation (CASL):
- We will only send commercial electronic messages where we have your express or implied consent.
- Every marketing email will clearly identify BankReady as the sender and include a working unsubscribe mechanism. You can withdraw consent at any time by clicking “unsubscribe” or contacting info@bankready.ca.
8. Cookies
We use cookies and similar tracking technologies as described in our separate Cookie Policy, which forms part of this Privacy Policy by reference.
9. Children’s Privacy
The Service is intended for adults aged 18 and older who are capable of entering into a binding contract in their province of residence. We do not knowingly collect personal information from anyone under 18.
10. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through a notice on the Service prior to the change taking effect. The “Last Updated” date at the top reflects the most recent revision.
11. Contact Us
Questions, concerns, or requests regarding this Privacy Policy or your personal information can be directed to:
BankReady Inc. — Unit 200, 4230 Sherwoodtowne Blvd, Mississauga, ON L4Z 2G6 — info@bankready.ca
← Back to home