Legal documentation

Privacy Policy

Version 1.2 — Effective September 2026

Last reviewed: September 2026 · Next review: September 2027

1. About This Policy

This Privacy Policy explains how NINIPAY INC., operating as Nini ("Nini", "we", "us", or "our"), collects, uses, discloses, and protects personal information in connection with our platform and services. It applies to all individuals whose personal information Nini processes, including representatives of organizations participating in Nini's pilot program, users of the Nini platform, and visitors to Nini's public website at nini.io.

Nini is committed to complying with applicable Canadian privacy laws, including the Personal Information Protection and Electronic Documents Act (PIPEDA) and substantially similar provincial privacy laws where they apply, including Alberta's Personal Information Protection Act ("Alberta PIPA"), British Columbia's Personal Information Protection Act ("BC PIPA"), and Quebec's Act respecting the protection of personal information in the private sector ("Quebec Act"), as amended by Law 25. Where the requirements of these laws differ, Nini applies the standard most protective of personal information. In particular, where the Quebec Act imposes a more stringent requirement than PIPEDA or another applicable provincial privacy law, Nini applies the Quebec standard to all personal information it holds about individuals in Canada, regardless of the individual's province of residence, unless doing so would conflict with a mandatory requirement of another applicable law. This policy also reflects obligations affecting personal information under the Retail Payment Activities Act (RPAA) and the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA), where applicable to Nini's operations. This policy is intended to give you meaningful information about how we handle your data and to support informed consent under PIPEDA Principle 3.

By visiting nini.io, using the Nini platform, or entering into a Pilot Agreement with Nini, you acknowledge that your personal information will be handled as described in this policy. If you have questions or concerns, contact us at privacy@nini.io.

2. Definition of Personal Information

"Personal Information" means any information that relates to an individual and directly or indirectly identifies that individual or otherwise relates to an identifiable individual.

This policy does not apply to Personal Information concerning the performance of an individual's duties within a company, such as the individual's name, title, position, business address, business email address, or business telephone number, where that information is used to make or facilitate contact in connection with the individual's employment, business, or occupation.

Information is "anonymized" only where it has been irreversibly modified, using generally accepted best practices and in accordance with the criteria and terms determined by regulation under the Quebec Act, such that it is, at all times, reasonably foreseeable in the circumstances that it no longer allows the individual concerned to be identified, whether directly or indirectly, by any reasonably foreseeable means. Anonymized information is not personal information and is not subject to this policy.

Information is "de-identified" when it has been modified so that it no longer allows the individual to be directly identified, but where re-identification remains reasonably possible, including through combination with other information or by reversing the de-identification process. De-identified information remains personal information and continues to be governed by this policy and applicable privacy laws. Nini uses de-identification as a safeguard in certain processing activities, including analytics and internal research, but does not treat de-identified information as falling outside its privacy obligations.

3. Who We Are

NINIPAY INC. is an Ontario corporation with a registered office at 5-141 Toryork Drive, North York, Ontario, Canada, M9L 1X9. Nini operates a financial technology platform that aggregates, normalizes, and contextualizes financial data to help organizations understand, model, and optimize their financial operations.

Nini provides financial data services to participating organizations under Pilot Agreements and, increasingly, commercial service agreements. The platform is used to develop, deliver, and operate financial data and analytics capabilities.

4. Information We Collect

Nini collects personal information only to the extent necessary to operate the platform and deliver services. The categories of personal information we may collect are set out below.

4.1 Information You Provide Directly

When you or your organization enters into a Pilot Agreement or uses the Nini platform, we may collect:

Contact information — your name, email address, job title, and employer or organization name.
Account credentials — usernames and authentication information used to access the platform.
Communications — correspondence you send to us, including requests, feedback, and support inquiries.

4.2 Financial and Organizational Data

The Nini platform is designed to ingest financial data provided by participating organizations. This data may include transactional records, payment histories, account structures, and related financial information submitted by or on behalf of your organization. Where this data contains personal information — for example, records that identify individual employees, customers, or counterparties — Nini processes it in accordance with this policy and the terms of the applicable Pilot Agreement.

Participants represent and warrant, as a condition of their Pilot Agreement or commercial agreement with Nini, that they have obtained all necessary permissions and consents required under applicable privacy law to provide such data to Nini, including consents that describe the purposes for which Nini may use that data. Nini does not independently collect personal financial information directly from individuals without organizational authorization. Individuals whose personal information appears in data submitted by a participating organization may contact Nini directly at privacy@nini.io to exercise the rights described in Section 9.

Because Nini receives personal information exclusively through participating organizations and has no independent relationship with the individuals whose information is submitted, Nini's process for handling such requests is as follows:

Upon receipt of a request, Nini will acknowledge receipt within 5 business days, inform the individual of the process described below, and, in parallel, search its own systems to the extent possible to locate personal information relating to the individual based on whatever identifying information the individual has provided;
Nini will simultaneously contact the relevant participating organization to request confirmation of whether the individual is one of its employees, contractors, or other counterparties whose information was submitted, and if so, what personal information was submitted — the individual will be informed that this contact is being made;
Nini will respond substantively within 30 days of receipt of the request, as required by applicable privacy law. Where the need to consult with the participating organization makes it impracticable to respond within 30 days, Nini will notify the individual within that 30-day period of the extension, the reason for it, and a revised response deadline, in accordance with PIPEDA s. 8(3) and Article 32 of the Quebec Act. In no case will Nini's response be delayed beyond 60 days from receipt of the request;
If the participating organization confirms the individual's identity and the scope of submitted data within the response period, Nini will process the request in accordance with Section 9 and applicable law; and
If the participating organization does not respond within the response period, or disputes the individual's identity, Nini will nonetheless process the request to the best of its ability using its own records. Nini will notify the individual of any limitation on its ability to fully respond, and inform the individual of their right to escalate to the Office of the Privacy Commissioner of Canada or, for Quebec residents, the Commission d'accès à l'information du Québec.

The individual should be aware that their request will be disclosed to the participating organization for identity verification purposes. If the individual has concerns about that disclosure — for example, because the participating organization is their employer — they should indicate this when submitting their request and Nini will consider whether alternative verification approaches are available in the circumstances.

4.3 Technical and Usage Data

When you access the Nini platform, we automatically collect certain technical information, including:

Log data — IP address, browser type, access times, pages visited, and actions taken on the platform.
Device information — operating system, device identifiers, and browser settings.
Session data — session identifiers and authentication tokens used to maintain your logged-in state.

This data is collected to operate and secure the platform, diagnose technical issues, and improve service quality. It is not used for advertising or sold to third parties.

4.4 Information We Collect From Website Visitors

Sections 4.1 to 4.3 describe information collected through the Nini platform. This section describes information collected through Nini's public website at nini.io, which is separate from the platform and requires no account.

Information you submit through a form. The website offers a Request Access form and a Contact form. Both collect your name, work email address, organization name, and the message or details you choose to provide. Submissions are stored in Nini's systems and are forwarded to Nini personnel by internal message, and by email where that channel is enabled, so that we can respond. Nini uses this information only to respond to your enquiry and to assess and administer platform access requests. Nini does not use it for advertising and does not sell it.

Website analytics, only if you consent. Nini uses Google Analytics 4 and PostHog to understand how the website is used — which pages are viewed, how visitors move between them, and which links are clicked. These tools store a first-party identifier in your browser and record technical information including IP address, approximate location derived from that address, device and browser type, the page that referred you, and the pages and links you interact with.

Neither tool loads, and no information is sent to either provider, unless you have consented to that purpose through the notice presented on your first visit. If you decline, the underlying code is not downloaded at all. Section 10.1 describes how to give, refuse, or withdraw that consent.

Session recordings, only if you consent separately. Where enabled, PostHog reconstructs a visit as a replayable recording of the page — pointer movement, scrolling, clicks, and page changes. This is a distinct purpose and requires its own consent; consenting to analytics does not enable it. Every text input is masked before the recording leaves your browser, so a recording shows that a field was used and never the characters entered into it. No recording is made of the Nini platform or of any authenticated session. Section 10.2 describes this in full.

4.5 Information We Collect From Job Applicants

When you apply for a role or contact careers@nini.io, we collect the information you choose to provide, such as your name, contact details, resume, cover letter, portfolio links, work history, and information you share during interviews. If we make you an offer, we may also collect references and, with your separate express consent, background check results.

Accommodations are available on request at every stage of our recruitment process.

4.6 Information We Do Not Collect

Nini does not collect the following categories of information from participating organizations or from individuals: government-issued identification numbers, Social Insurance Numbers, full payment card numbers, banking authentication credentials, or biometric identifiers.

Nini asks participating organizations to remove or otherwise de-identify these elements before submitting data to the platform.

Where any such element nonetheless appears in data files submitted by a participating organization, Nini treats it as sensitive personal information subject to the heightened protections described in Section 6, and may, at its discretion, mask or delete the element on ingestion.

5. How We Use Your Information

Nini implements privacy by design and by default principles, integrating privacy protections into its practices, systems, and technologies from the outset, and collecting only the personal information necessary for identified purposes. Nini identifies the purposes for which it uses personal information at or before the time of collection and obtains consent prior to or at the time of collection for each identified purpose. Consent must be manifest, free, and enlightened, and is requested for specific purposes in clear and simple terms. For individuals resident in Quebec, Nini does not rely on implied consent for the collection, use, or disclosure of personal information. For sensitive personal information — meaning personal information that, due to its nature (including financial or otherwise intimate information) or the context of its use, entails a high level of reasonable expectation of privacy — and for any purpose beyond what the individual would reasonably expect, Nini obtains express consent.

Nini uses personal information only for the purposes for which it was collected or to which you have consented, as permitted or required by law. The primary purposes for which we use personal information are:

Purpose	Description
Platform operation	To provide access to the Nini platform, authenticate users, and deliver services under the Pilot Agreement.
Product development	To develop, test, and improve the Nini platform, including building models, analytics features, and payment optimization capabilities using participant data as permitted by the Pilot Agreement. Where that use involves personal information, Nini will: (i) use the data only for analytics and product-improvement purposes consistent with the purposes disclosed to the individual at or before the time of collection and to which the individual has consented; (ii) prefer aggregated or de-identified data over identifiable data wherever feasible; and (iii) not use participant data to make decisions about identified individuals outside the participating organization without that individual's consent. The Pilot Agreement reflects, and does not extend beyond, the scope of consent obtained from individuals at or before the time of collection. Within that scope, the Pilot Agreement grants Nini a royalty-free, non-sublicensable licence (except to the extent necessary to engage subprocessors bound by equivalent obligations under Section 7.1) to use participant data for the product development and analytics purposes described in this row. Identifiable personal information is retained only for the period specified in Section 8, after which Nini's continuing use of the information is limited to anonymized information (within the meaning of Section 2). The licence does not authorize Nini to use participant data for any purpose not described in this Section 5 or beyond the scope of the consent obtained from the individual concerned; any such further use requires fresh consent.
Security and fraud prevention	To monitor platform activity, detect anomalies, investigate security incidents, and protect the integrity of the platform and the data it holds.
Legal and regulatory compliance	To meet obligations under PIPEDA, the Quebec Act, and any other applicable law, including responding to lawful requests from regulators or law enforcement.
Communications	To respond to your inquiries, send service-related notices, and communicate material changes to the platform or this policy.
Recruitment	To assess applicants for current or future roles, communicate about applications, and arrange accommodations. Nini does not use automated decision-making to screen applicants.
Anonymized analytics	To generate aggregated and anonymized insights that cannot reasonably identify any individual. Nini may use and publish such insights without restriction.

Nini does not use personal information for targeted advertising, profiling for commercial marketing, or any purpose incompatible with the purposes described above without obtaining fresh consent.

6. How We Protect Your Information

Nini implements technical and organizational security measures designed to protect personal information against unauthorized access, disclosure, alteration, and destruction. Key measures include:

Encryption at rest — all customer and participant data is encrypted using AES-256 encryption.
Encryption in transit — all data transmitted to and from the platform is encrypted using TLS 1.3.
Access controls — role-based access controls ensure that platform users access only the data they are authorized to access. Multi-factor authentication is enforced via Okta single sign-on for all access to Nini systems.
Data residency — regional data residency, with platform data hosted on AWS infrastructure in the region designated in each client's agreement. Canada is the default hosting location (see Section 11).
Audit logging — all system and administrative actions are logged and protected from tampering.
Endpoint security — company devices are centrally managed, encrypted, and protected by endpoint detection and response (EDR) tooling.
Security assessments — Nini engages an independent third-party security firm to conduct external penetration testing on a quarterly cadence, with remediation tracked to closure.
Data minimization — Nini configures its ingestion processes to limit the personal information received to what is necessary for analytics purposes, and outputs delivered to participating organizations are filtered to remove personal information not necessary to the requested analysis (see Section 4.6).
Privacy impact assessments — Nini conducts a documented privacy impact assessment before launching any material new feature, data pipeline, or use of personal information, and updates the assessment when the use changes.
Personnel safeguards — all Nini personnel with access to personal information undergo background checks (where lawful), are bound by confidentiality obligations, and complete privacy and security training on hire and at least annually thereafter.

No security system is impenetrable. In the event of a confidentiality incident (within the meaning of the Quebec Act) or a breach of security safeguards (within the meaning of PIPEDA) involving personal information under Nini's control, Nini will promptly assess the incident to determine whether it presents (i) a real risk of significant harm to any affected individual under PIPEDA, and (ii) a risk of serious injury under Article 3.5 of the Quebec Act. Where Nini determines that either threshold is met, it will, as soon as feasible after that determination: (a) notify each affected individual in a conspicuous and direct manner, with sufficient information to allow the individual to understand the significance of the incident and to take steps, if possible, to reduce or mitigate the risk of harm or serious injury; (b) report the incident in writing to the Office of the Privacy Commissioner of Canada in accordance with PIPEDA Division 1.1 and the Breach of Security Safeguards Regulations, and, where the Quebec threshold is met, to the Commission d'accès à l'information du Québec in accordance with Article 3.5 of the Quebec Act; and (c) notify any organization, government institution, or part of a government institution that may be able to reduce the risk of harm or serious injury. Where the affected personal information was provided to Nini by a participating organization, Nini will also notify that organization without undue delay to enable it to meet its own obligations to downstream data subjects.

Nini maintains a confidentiality incident register recording every incident involving personal information under its control, whether or not the incident triggers notification to individuals, the Office of the Privacy Commissioner of Canada, or the Commission d'accès à l'information du Québec. The register satisfies both PIPEDA's requirement (under Division 1.1) to maintain a record of every breach of security safeguards for at least 24 months after the day on which Nini determines that the breach has occurred, and the Quebec Act's confidentiality incident register requirement under Article 3.8. Records are made available to the Office of the Privacy Commissioner of Canada and to the Commission d'accès à l'information du Québec on request.

In assessing whether an incident creates a real risk of significant harm under PIPEDA, Nini considers the factors required by PIPEDA, including the sensitivity of the personal information and the probability of misuse. "Significant harm" includes bodily harm, humiliation, damage to reputation or relationships, loss of employment or business opportunities, financial loss, identity theft, negative effects on credit record, and damage to or loss of property. In assessing whether an incident presents a risk of serious injury under Article 3.5 of the Quebec Act, Nini considers the factors required by Article 3.7, including the sensitivity of the personal information, the anticipated consequences of its use, and the likelihood that the personal information will be used for injurious purposes. Because the data Nini handles is, as a class, sensitive financial information, Nini approaches both assessments with a presumption in favour of notification where the risk is uncertain. Each assessment is documented in writing and retained as part of the incident record described above.

7. Sharing and Disclosure of Personal Information

Nini does not sell personal information. We share personal information only in the circumstances described below.

7.1 Service Providers

Nini engages a limited number of third-party service providers to operate the platform. These providers process personal information only on Nini's behalf, for the purposes described in this policy, and under contractual obligations requiring them to protect that information to a standard consistent with this policy. Categories of service providers include:

Cloud infrastructure and managed services.
Identity, authentication, and access management.
Bank data connectivity.
Application observability and error monitoring.
Website and product analytics, including session recording where enabled (see Sections 4.4 and 10).
Compliance, security automation, and audit tooling.
Recruitment email and careers site hosting (Google Workspace, Notion).

Nini maintains a current list of subprocessors who process personal information on its behalf. The subprocessor list is available upon request at privacy@nini.io. Nini will provide reasonable advance notice to the privacy contact of each participating organization before adding or replacing a subprocessor that will have access to personal information. Where a subprocessor is the parent entity of, or shares operational control with, an entity headquartered outside Canada, Nini will identify that fact on request and describe the protections in place under Section 11.

Nini conducts vendor risk assessments and imposes confidentiality and security obligations on all third-party processors. Nini remains responsible for personal information disclosed to service providers.

7.2 Legal and Regulatory Disclosure

Nini may disclose personal information without consent where required or permitted by law, including:

In response to a valid court order, subpoena, or other legal process.
To comply with a lawful request from a government authority or regulator, including the Office of the Privacy Commissioner of Canada or a provincial privacy regulator with jurisdiction.
Where Nini reasonably believes disclosure is necessary to prevent fraud, protect the safety of individuals, or enforce its legal rights.

Where permitted by law, Nini will attempt to notify affected individuals before making such disclosures.

7.3 Business Transactions

In the event of a merger, acquisition, financing, or sale of all or part of Nini's assets, personal information held by Nini may be transferred to the acquiring or successor entity. Nini will notify affected individuals of any such transfer and any material change to the use of their personal information that results from it.

7.4 Consent-Based Disclosure

Nini may disclose personal information with your express consent for purposes not described in this policy. You may withdraw consent at any time, subject to legal and contractual restrictions and reasonable notice. Withdrawing consent may affect Nini's ability to continue providing services.

8. Data Retention

Nini retains personal information only for as long as necessary to fulfill the purposes for which it was collected, or as required by law. The following general retention standards apply:

Category	Retention Period	Basis
Pilot participant contact data	Duration of Pilot Agreement + 2 years	Contractual and operational
Participant financial and organizational data	Duration of Pilot Agreement + 2 years. Beyond that, retained only in de-identified or aggregated form	PIPEDA Principle 5 (limited retention); applicable contractual and limitations periods
Security and audit logs	Minimum 24 months; longer where required for an open investigation or audit	PIPEDA Division 1.1 (24-month breach record-keeping); SOC 2 evidence retention
Account and authentication records	Duration of active account + 2 years	Operational; fraud prevention
Website form submissions (Request Access, Contact)	24 months from your last contact with Nini	Operational; to respond to and administer access requests
Job applicant records	24 months from last contact for unsuccessful applicants; incorporated into the employee record for successful applicants	Operational; to consider applicants for current and future roles
Website analytics events	14 months maximum	PIPEDA Principle 5 (limited retention); Quebec Act (retained only for the time necessary)
Website session recordings	30 days	Retained only long enough to diagnose a website problem
Anonymized and aggregated data	Indefinite	No personal information — no restriction

When personal information is no longer required, Nini will securely destroy or anonymize it. Secure destruction means deletion in a manner that renders recovery infeasible.

9. Your Privacy Rights

Subject to applicable law, you have the following rights with respect to personal information Nini holds about you.

9.1 Right of Access

You have the right to request access to the personal information Nini holds about you and to receive information about how that information is used and disclosed. Nini will respond to access requests within 30 days of receipt, or notify you if additional time is required.

9.2 Right to Correction

If personal information Nini holds about you is inaccurate, incomplete, or out of date, you have the right to request that it be corrected. Where Nini cannot make the requested correction, it will note the requested correction in the record.

9.3 Right to Withdraw Consent

Where Nini processes personal information on the basis of consent, you may withdraw that consent at any time. Withdrawal of consent is prospective — it does not affect processing that occurred prior to withdrawal. In some circumstances, withdrawal of consent may affect Nini's ability to continue providing services or fulfilling its obligations.

9.4 Right to Request Destruction

You may request the destruction of personal information Nini holds about you where: (i) the purposes for which it was collected have been achieved and there is no continuing lawful basis for retention; (ii) you have withdrawn your consent and Nini has no other lawful basis to continue processing; or (iii) destruction is otherwise required under applicable privacy laws. Certain personal information is subject to mandatory retention under applicable law; where mandatory retention applies, Nini will retain the information for the required period and destroy or anonymize it at the end of that period.

9.5 Right to Data Portability

In accordance with Article 27 of the Quebec Act, you have the right to obtain the personal information you have provided to Nini (excluding personal information Nini has created or inferred about you) in a structured, commonly used technological format, and to have that personal information communicated to any person or body authorized by law to collect it, to the extent technologically feasible. To exercise this right, submit a written request to privacy@nini.io.

9.6 Right Regarding Automated Decision-Making

Where a decision concerning you is based exclusively on automated processing of your personal information, you have the right, on request, to be informed of: (i) the personal information used to make the decision; (ii) the reasons and the principal factors and parameters that led to the decision; and (iii) your right to have the personal information corrected. You also have the right to submit observations to a member of Nini personnel with authority to review the decision, and to request that the decision be reviewed by that person. Nini does not currently use personal information to make decisions about individuals based exclusively on automated processing.

9.7 Right to De-indexing and Cessation of Dissemination

You have the right to require Nini to cease disseminating your personal information or to de-index any hyperlink attached to your name that provides access to that information by technological means, where: (i) the dissemination of the personal information contravenes the law or a court order; or (ii) certain conditions are met as to the prejudice caused to you by the dissemination, having regard to your right to privacy and right to reputation, weighed against the public interest in the information remaining available. You also have a right to re-indexing of personal information that has been de-indexed where the conditions for de-indexing are no longer met.

9.8 Right to Lodge a Complaint

If you believe that Nini has handled your personal information in a manner inconsistent with applicable privacy law, you have the right to file a complaint with the relevant regulator. Under PIPEDA, complaints may be made to the Office of the Privacy Commissioner of Canada. Under the Quebec Act, complaints may be made to the Commission d'accès à l'information du Québec at www.cai.gouv.qc.ca. Before doing so, we encourage you to contact us directly so that we can attempt to resolve your concern. Our contact details are set out in Section 14.

9.9 Submitting a Privacy Request

To exercise any of the rights described above, submit a written request to privacy@nini.io. Include sufficient information to allow us to verify your identity and locate the personal information in question. Nini will not charge a fee for access requests unless they are excessive or repetitive. Nini will acknowledge receipt within 5 business days and respond substantively within 30 calendar days, or notify you if additional time is required. If Nini denies access to or correction of personal information, it will provide you with written reasons for such denial. Where applicable law permits, Nini may charge a reasonable fee for the transcription, reproduction, or transmission of personal information, in which case Nini will inform you of the fee in advance.

10. Cookies and Similar Technologies

The Nini platform uses cookies and similar session management technologies to operate the platform, maintain authenticated sessions, and support security functions. On the platform, these are the only such technologies Nini uses.

Session cookies are deleted when you close your browser. Persistent cookies used for security and fraud prevention are retained for a limited period as necessary to fulfill their function. You may configure your browser to refuse cookies; however, doing so may affect your ability to access and use the platform.

Nini's public website at nini.io additionally uses analytics technologies. These are not necessary for the website to function, they are used only with your consent, and they are described in Sections 10.1 and 10.2.

Nini does not use advertising cookies, advertising pixels, or cross-site tracking technologies on the platform or on the website, and has not enabled advertising, cross-device, or audience-sharing features in its analytics tools. Nini does not sell personal information, and does not disclose website analytics information to any third party for that party's own purposes.

10.1 Website Analytics and Your Consent

On your first visit to nini.io you are shown a consent notice. It presents the option to refuse and the option to accept together, on the same screen and with equal prominence. Refusing is not made harder than accepting, and continuing to browse is not treated as consent. Until you choose, no analytics technology is loaded.

Consent is requested separately for each purpose. Accepting analytics does not enable session recording, and each may be refused independently. Nini records the date of your choice and the purposes you allowed, so that it can demonstrate the consent it relies on. A choice older than 180 days is treated as expired and you are asked again.

You may change or withdraw your consent at any time using the Cookie choices link in the website footer, which re-presents the notice. Withdrawal takes effect immediately. Refusing or withdrawing consent does not affect your ability to use the website, submit a form, or request access to the platform.

Website analytics is not used on the authenticated Nini platform.

10.2 Session Recordings

A session recording reconstructs a visit to the website as something Nini can replay. Nini uses recordings for one purpose: to find where the website itself is confusing or broken, particularly on the Request Access form. The following limits apply whenever recording is enabled:

Separate consent. Recording requires consent given for that specific purpose, and is off unless you have granted it.
Every text input masked. Characters you type are replaced before the recording leaves your browser. Nini cannot recover them from a recording.
Public website only. No recording is made of the Nini platform or of any authenticated session.
No payment data. The website does not collect payment card numbers or banking credentials, so none can appear in a recording.
Retention. Recordings are deleted after 30 days.
Access. Recordings are available only to Nini personnel who need them to diagnose a website problem.

You may withdraw consent to recording at any time through the Cookie choices link in the footer. To request deletion of recordings relating to you, contact privacy@nini.io as described in Section 9.

10.3 Technologies that Identify, Locate, or Profile You

In accordance with the Quebec Act, Nini discloses below each technology it uses that identifies, locates, or profiles users, and the means available to you to deactivate it.

Identification — platform. Authentication cookies and account-linked session identifiers. Deactivate by signing out of your account and clearing first-party cookies through your browser settings.
Identification — website. Google Analytics 4 and PostHog store a randomly generated first-party identifier in your browser in order to recognise a returning visit. It is not linked to your name and is not used to identify you personally. It is not set at all unless you consent; deactivate by refusing or withdrawing analytics consent through the Cookie choices link in the footer.
Location. IP-based general geolocation. On the platform it is used for security and fraud prevention and cannot be fully deactivated where required for those purposes. On the website the analytics tools use it to report visitor country and region; deactivate by refusing or withdrawing analytics consent.
Profiling. Session recording on the public website, described in Section 10.2, and only where you have consented to that purpose. Deactivate by refusing or withdrawing that consent through the Cookie choices link in the footer.

Nini does not use these technologies to build commercial or advertising profiles, does not combine website analytics information with platform data or participant financial data, and does not use them to make decisions about identified individuals.

10.4 Default Privacy Settings

Where Nini offers a technological product or service to the public that includes privacy settings, those settings are configured by default to provide the highest level of confidentiality, without any action required on your part. Non-essential identification and location functions are off by default and are activated only if and to the extent you affirmatively consent. On the public website this means that analytics and session recording are off until you consent to them. This default does not apply to cookies and similar technologies that are strictly necessary for the platform or the website to function, for security, or for authentication.

11. Cross-Border Data Transfers

Platform and Participant Data. Nini is a Canadian company, and platform instances are hosted in Canada by default. Where a client requires data residency in another jurisdiction, we host that client's instance in the region designated in its agreement, which may be in the United States. Personal information processed for a client is stored and processed in that client's designated region and is not moved to another region without the client's agreement. Personal information stored outside Canada is subject to the laws of that jurisdiction and may be accessible to its courts, law enforcement, and national security authorities. Nini remains accountable for that information under PIPEDA and applies the same security controls in every region. To learn where your information is hosted, contact the organization that provided you with access to Nini, or privacy@nini.io.

Website analytics information is processed outside Canada, and Nini discloses that here. Where you consent to analytics under Section 10.1, information about your visit to nini.io is transmitted to and processed in the United States by Google LLC (Google Analytics 4) and by PostHog, Inc. (product analytics and, where enabled, session recording). This transfer occurs only with your consent, and covers only information about your use of the public website. It does not include platform data or participant financial data.

Form submissions are stored in Canada and notified outside it. A submission you make through the Request Access or Contact form is stored in a database hosted in Canada, and is processed by Nini's hosting provider in Canada. So that the Nini team knows it has arrived, a notification containing the content of your submission is also sent to Slack, a workplace messaging service operated by Slack Technologies, LLC. Nini's Slack workspace stores this notification in the United States. The record of your submission stays in Canada; the notification of it does not. Nini uses this notification only to respond to you.

Job Applications. Applications and inquiries sent to careers@nini.io or through our careers site are processed by Google and Notion and may be stored in the United States.

United States law may permit government authorities to obtain access to information held there under conditions that differ from Canadian law. If you would prefer that no information about your visit leave Canada, refuse analytics consent, or withdraw it later through the Cookie choices link in the website footer; the website functions normally either way. If you would prefer not to send a form submission outside Canada, write to privacy@nini.io instead of using the forms.

Where Nini engages service providers that may have parent entities or operations outside Canada, Nini ensures by contract that those providers process personal information only within Canada or under protections equivalent to those required by PIPEDA. Nini remains accountable for personal information transferred to such providers.

Several of the subprocessors on Nini's subprocessor list are headquartered in the United States or are subsidiaries of United States parent entities, even though the personal information they process for Nini is stored and processed in Canada or in the client's designated region. Where this is the case, personal information may, in limited circumstances, become subject to access requests by foreign governments or law enforcement authorities asserting jurisdiction over the parent entity. Nini addresses this risk by: (i) selecting subprocessors that contractually commit to processing Nini's data within Canada or the client's designated region and to challenging unlawful access requests; (ii) imposing PIPEDA-equivalent protections by contract; (iii) encrypting personal information in transit and at rest, so that in many cases the subprocessor does not hold the keys necessary to read it; and (iv) identifying on the published subprocessor list which subprocessors have a non-Canadian parent or non-Canadian control plane. Nini remains accountable under PIPEDA for personal information transferred to its subprocessors, whether or not those subprocessors are located in Canada.

In accordance with Article 17 of the Quebec Act, before any communication outside Quebec of personal information that is subject to the Quebec Act (including to other Canadian provinces where the Quebec Act's protections would not otherwise apply), Nini conducts a privacy impact assessment that takes into account: (i) the sensitivity of the personal information; (ii) the purposes for which it will be used; (iii) the protection measures, including contractual measures, that will apply; and (iv) the legal framework applicable in the destination jurisdiction, including the degree of equivalence of that jurisdiction's personal information protection regime with the regime applicable in Quebec. The communication proceeds only where the assessment establishes that the personal information will receive adequate protection. The protection measures Nini relies on include written data processing agreements incorporating substantive privacy and security obligations; encryption in transit and at rest; access controls on a need-to-know basis; breach notification obligations; and audit rights.

12. Changes to This Policy

Nini may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or platform capabilities. Material changes will be communicated by posting a notice on the Nini website or by direct communication to individuals whose personal information is affected, at least 30 days before the changes take effect.

The effective date at the top of this policy indicates when it was last revised. Except for individuals resident in Quebec, continued use of the Nini platform following notice of changes constitutes acceptance of the updated policy. For individuals resident in Quebec, Nini does not treat continued use as consent: where a change introduces a new purpose or otherwise requires consent under the Quebec Act, Nini will obtain the individual's express consent before applying the change to their personal information.

Previous versions of this policy are available upon request by contacting privacy@nini.io.

v1.2 (September 2026): Added Section 4.5 on job applicant information, with related updates to Sections 5, 7.1, 8, and 11. Updated Sections 6 and 11 to reflect client-designated data residency, with Canada as the default hosting location. Renumbered former Section 4.5 as 4.6. Clarified the scope of Quebec Act obligations in Sections 1 and 11, and the treatment of Quebec residents in Section 12.

13. Accountability and Person Responsible for the Protection of Personal Information

Nini is accountable for the personal information under its control, including personal information transferred to third parties for processing, in accordance with PIPEDA Principle 1.

Nini's Chief Operating Officer is the individual designated as responsible for Nini's compliance with PIPEDA and, for the purposes of Quebec Law 25, as the person in charge of the protection of personal information. The designated individual's responsibilities include overseeing Nini's privacy program, approving privacy impact assessments, responding to privacy requests and complaints, coordinating breach assessment and notification, and ensuring that personal-information-handling practices remain aligned with this policy and applicable law. Contact details are set out in Section 14.

Nini publishes this Privacy Policy in clear and accessible language on its website. The policy describes, for each category of personal information collected, the purposes for collection and the categories of third parties to whom the information may be communicated.

All privacy requests, complaints, and inquiries may be addressed to that individual at privacy@nini.io.

Nini maintains internal policies and procedures that give effect to this policy, including policies governing access controls, security incident response, vendor management, retention and destruction, and the handling of privacy requests. Nini reviews this Privacy Policy at least annually and updates it as required to reflect changes in Nini's practices or in applicable law.

14. Contact Us

Questions, concerns, access requests, or complaints regarding this policy or Nini's handling of personal information should be directed to:

Field	Value
Privacy Contact	James Kang, Chief Operating Officer
Email	privacy@nini.io
Mailing Address	NINIPAY INC., 5-141 Toryork Drive, North York, Ontario, Canada, M9L 1X9
Response Time	Nini will acknowledge receipt within 5 business days and respond substantively within 30 calendar days.

If you are not satisfied with Nini's response, you may contact the Office of the Privacy Commissioner of Canada at www.priv.gc.ca or by calling 1-800-282-1376.