What we collect, and what we do not have.
A privacy policy is judged on what it refuses. Yoseri never sees your banking credentials, sells nothing on, and trains no model on your data.
What is collected, and why.
Every line has a reason to exist. Nothing is collected “just in case”.
| Data | Why | How long |
|---|---|---|
| First name and email address | Identify you, write to you when your access arrives | Until you ask for deletion |
| Country and region | Choose the institutions connected and the tax rules applied | Until you ask for deletion |
| Balances and transactions | Produce your statement, your budget and your findings | Erased within 30 days of revocation |
| Banking access token | Refresh your accounts read-only | Destroyed on revocation, immediately |
| Technical logs | Diagnose an outage, detect abuse | 90 days, then deletion |
The waiting list collects only the first four lines of the first block: first name, email, country, region. No banking credential is asked for there, and none can be.
What Yoseri does not have, and cannot have.
- Encrypt at rest and in transitAES-256 at rest, TLS 1.3 in transit.
- Host in CanadaYour data stays on servers located in Canada.
- Go through an approved aggregatorIt holds the banking connection, not Yoseri.
- Erase on requestSame day for the waiting list, within 30 days for an account.
- See or store your banking credentialsYou authenticate at your bank. Yoseri receives only a read token.
- Sell or rent your dataNot to an advertiser, not to a broker, not to a financial institution.
- Train a model on your financesYour transactions serve only to produce your own findings.
- Track your browsing elsewhereNo advertising pixel, no cross-site tracker.
Your rights, and how to exercise them.
In Quebec, Law 25 gives you these rights. Elsewhere in Canada, PIPEDA; in France, the GDPR; in the United Kingdom, the UK GDPR. Yoseri applies them to everyone, without looking at where you write from.
Access
Know what is heldYou can ask for the list of what concerns you, and get a readable copy of it.
Correct
Have an error put rightInaccurate or out-of-date data is corrected, and the correction is carried through to the calculations that depend on it.
Delete
Have everything erasedSame day for a waiting-list sign-up. Within 30 days for an account, after immediate revocation of access.
Take away
Get your data backA complete export in an open format, reusable elsewhere.
Withdraw
Take back your consentRevoking a banking connection is immediate and requires no justification.
Complain
Lodge a complaintIf an answer does not satisfy you, you can bring the matter to the competent authority — in Quebec, the Commission d’accès à l’information.
A request is sent to support@yoseri.com. Answer within 30 days, and free of charge.
Who holds your data, and who answers for it.
The enterprise responsible for the personal information described on this page is 9565-3283 Québec inc., incorporated in Quebec on 15 April 2026, Quebec enterprise number (NEQ) 1182042425, which operates Yoseri. Its head office is at 6930 Wiseman Avenue, Apt. 2, Montréal, Quebec H3N 2N2, Canada.
Writing to support@yoseri.com reaches the person in charge of protecting personal information. A request is not filtered by anyone else before reaching them.
Cookies and audience measurement.
This site uses no advertising cookie and no cross-site tracker. It therefore shows no consent banner: there is nothing to consent to.
Local storage
A single key, on your deviceThe country you pick at the top of the page is kept in your browser’s local storage so you are not asked again. It does not leave your device and is sent nowhere.
Audience measurement
No cookie, no identifierAudience measurement is on. It counts page views with no cookie, no persistent identifier and no IP address kept. No individual profile is built.
If something happens.
A privacy incident that presents a risk of serious harm is reported to the competent authority and to the people concerned, with what we know, when we know it.
We say what leaked, from when, what was done, and what you can do. We do not play it down and we do not wait until we have a nice turn of phrase. A register of incidents is kept, as the law requires.