Privacy Policy

Last updated: August 2026

Your privacy matters to us. This policy explains how PXO App collects, uses, and protects information when you use our secure digital wallet.

1. PIPEDA Compliance

We are committed to protecting your personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) of Canada. We ensure that your data is collected, used, and disclosed only for purposes that a reasonable person would consider appropriate in the circumstances.

2. Information Collection

We collect the following information when you use PXO App:

Identity information: Name, email address, phone number, date of birth, and government-issued identification (for identity verification purposes)

Payment credentials: Card network tokens only (we do not store your full card number — see Section 7)

Biometric indicators: Device-level fingerprint or facial recognition used for app lock authentication. This data is processed locally on your device and is never transmitted to or stored on our servers.

Transaction data: QR code payment history and associated metadata

Device and usage data: Device type, operating system, and app usage statistics

3. How We Use Your Information

We use your information to:

Verify your identity and prevent fraud

Provision and manage tokenized payment credentials in your wallet

Generate secure QR codes for payment transactions

Send verification codes and account notifications

Improve our services and user experience

4. Third-Party Services

We use trusted third-party services to operate PXO App:

Plaid Inc. — Identity verification. Subject to Plaid's Privacy Policy at https://plaid.com/legal. Plaid receives your identity information solely to verify your identity on our behalf.

Visa, Mastercard, American Express — Payment card tokenization. These networks receive your card details to generate secure tokens and do not share your information with us beyond what is necessary for tokenization.

Twilio — SMS and email verification. Twilio receives your phone number or email address solely to deliver verification codes.

SendGrid — Email notifications. SendGrid receives your email address solely to deliver account-related communications.

These providers receive only the minimum data necessary to perform their services.

5. Data Retention

We retain your personal information for as long as your account is active. Identity verification records are retained for 5 years as required by applicable regulations. Transaction records are retained for 7 years for audit purposes. You may request deletion of your account and associated data at any time through the app.

6. User Rights

Under Canadian law, you have the right to:

Access the personal information we hold about you

Challenge its accuracy and completeness

Withdraw your consent for certain data uses at any time, subject to legal or contractual restrictions

Request deletion of your account and all associated personal data

Receive a copy of your data in a portable format

To exercise any of these rights, contact us using the information in Section 9.

7. What We Do Not Store

PXO App operates as a pass-through digital wallet, similar to Apple Wallet and Google Wallet. We do not store:

Full credit or debit card numbers (PANs)

CVV or CID security codes

Card PINs

Biometric data (processed on-device only)

Payment credentials are tokenized by the card networks (Visa, Mastercard, American Express) and only the resulting token (DPAN) is retained in your wallet.

8. Data Protection

We implement industry-standard security measures to protect your data, including:

Bank-level encryption for all data in transit and at rest

Strict access controls and authentication

Single-device login restriction to prevent unauthorized access

Regular security reviews of our systems and integrations

9. Contact Us

For any privacy-related inquiries or to exercise your rights, please contact our Privacy Officer at privacy@pxoapp.ca.