Privacy Policy

Last updated: May 17, 2026

Umbra Pay ("Umbra Pay," "we," "us," or "our") respects your privacy. This Privacy Policy explains what information we collect when you use our service, how we use it, who we share it with, and the rights you have over it. Umbra Pay is operated from Canada and is governed by Canadian privacy law (PIPEDA), with additional protections extended to users in the European Economic Area (GDPR) and California (CCPA).

1. What we collect

Account information

• Email address — used to authenticate your account, send password resets, and contact you about service-critical matters.
• Password — stored as a salted, one-way hash by our authentication provider. We cannot see your password.

Planning data you enter

• Paycheck amounts, pay frequency, and the date of your next paycheck
• Vault names, allocation percentages, locked monthly targets, and accumulated balances
• The history of paychecks you have "routed" within the app

Technical data

• IP address (used for rate-limiting and fraud prevention)
• Browser type, operating system, and approximate region
• Anonymous usage data (which features you use, error reports)

What we do not collect: Umbra Pay does not connect to your bank accounts and does not process payments. We do not collect real account numbers, transaction data, government IDs, or social insurance / social security numbers.

2. How we use it

• To provide the service — store your plan so it persists across devices and sessions.
• To generate AI insights — when you click "Get AI insight," your current plan context (paycheck, vaults, recent routing history) is sent to our AI provider (Anthropic). No insight call is made without your explicit click.
• To send you transactional email — password resets, magic links, account confirmations.
• To protect the service — detect abuse, enforce rate limits, prevent fraud.
• To improve the product — aggregate, anonymized analytics about which features are used.

We do not sell your data. We do not use your data to train AI models. We do not show you third-party advertising.

3. Who we share it with (data processors)

To run Umbra Pay we use a small set of trusted third-party services that process data on our behalf. Each is bound by their own privacy policy and security commitments.

• Supabase — database hosting and authentication. Stores your account credentials and planning data. Supabase Privacy Policy
• Vercel — application hosting and serverless function execution. Vercel Privacy Policy
• Anthropic — AI provider for the "Get AI insight" feature. Receives your plan context only when you click the button. Anthropic Privacy Policy
• Resend — transactional email delivery (password resets, magic links). Resend Privacy Policy
• Upstash (via Vercel Marketplace) — rate-limit counters. Stores only a hashed identifier and a numeric count; never your email or planning data.

We do not share your personal information with any party outside this list. We will never sell, rent, or trade your information.

4. How long we keep it

• Account and planning data — for as long as your account is active. If you delete your account, we delete this data within 30 days.
• Email logs — Resend retains delivery metadata for 30 days for compliance and debugging.
• AI insight requests — Anthropic may retain request and response data per their policy; we do not retain copies on our end.
• Rate-limit counters — auto-expire within 24 hours.
• Backups — Supabase keeps automated backups; deleted data is purged from backups within 30 days.

5. Your rights

Regardless of where you live, you have the right to:

• Access — request a copy of the personal data we hold about you
• Correct — fix anything that's wrong
• Delete — close your account and have your data removed
• Export — receive your data in a portable format (JSON)
• Object — opt out of specific uses of your data

To exercise any of these rights, email support@umbrapay.ca from the address associated with your account. We will respond within 30 days.

Users in the European Economic Area have additional rights under the GDPR, including the right to lodge a complaint with your local data protection authority. Users in California have additional rights under the CCPA. We honor both regimes for all users globally.

6. Security

We take security seriously. Specific measures we implement:

• All connections use HTTPS (TLS 1.2 or higher). HTTP Strict Transport Security is enforced.
• Passwords are stored as salted hashes; we cannot retrieve your password.
• Database row-level security ensures each user can only access their own data.
• API endpoints are rate-limited to prevent abuse.
• Our AI provider's API key is stored server-side and never exposed to the browser.

For a plain-language walkthrough of how we protect your data, see our Trust & Security page.

No security measure is perfect. If you suspect your account has been compromised, contact us immediately at support@umbrapay.ca.

7. Cookies and local storage

Umbra Pay uses browser local storage to keep you signed in, remember your preferences (pay frequency, anchor date), and reduce server load. We do not set tracking cookies. We do not use third-party advertising trackers.

8. Children's privacy

Umbra Pay is not intended for users under 18. We do not knowingly collect personal information from minors. If you believe a child has provided us with information, contact support@umbrapay.ca and we will delete it.

9. International transfers

Umbra Pay is operated from Canada. Some of our third-party processors store data in the United States. When you use the service, your data may be transferred to and processed in countries other than your own. We rely on standard contractual clauses and equivalent safeguards where required.

10. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be announced via email and within the app. The "Last updated" date at the top of this page reflects the most recent revision. Continued use of Umbra Pay after a change constitutes acceptance.

11. Contact

Questions, requests, or concerns about this Privacy Policy:
Umbra Pay
Email: support@umbrapay.ca

This Privacy Policy is provided for informational purposes and does not constitute legal advice. For specific legal questions, consult a qualified attorney.