Privacy Policy

Lump Financial Services LTD is a corporation federally incorporated in Canada with its head office in Montreal, Quebec. Lump operates as a payment service provider: members fund a Lump once and we schedule and send daily Interac e-Transfer deposits to the recipient they designate.

Person in charge of the protection of personal information

Our President acts as the person in charge of the protection of personal information (Privacy Officer). You may reach the Privacy Officer at the contact details at the end of this Policy for any question, access request, correction, complaint, or withdrawal of consent.

We collect only what we need to run the service safely and to meet our legal obligations. Depending on how you use Lump, this includes:

• Account information: your email address and a password (stored only as a cryptographic hash by our authentication provider), or, if you sign in with Google, the name and email address Google shares with us. We also store your preferred language, your unique member code, and the date your account was created.
• Profile information: your phone number if you choose to provide it, and the names taken from your verified identity document.
• Identity verification information: images of your Canadian government-issued identification, a live facial capture (selfie with liveness detection), the result of the comparison between the two, and the data extracted from your document: first, middle, and last name, date of birth, residential address, document type, and the last four characters of the document number. Verification is performed by our provider Persona, and we archive the approved or declined verification media and result in our own secure storage.
• Lump information: the daily amount, duration, start and end dates, recipient Interac email address, recipient's full legal name, the Lump code used as the Interac security answer, funding method, Lump status, and the history of events on that Lump (creation, funding, deposits, pauses, cancellations, refunds).
• Payment information: when you pay by card, Klarna, or Afterpay, you enter your payment details directly on Stripe's hosted checkout. We never see or store your full card number. We receive and keep the payment method type, the last four digits of the card, the billing name, the amount, timestamps, 3D Secure authentication results, and any dispute or refund records. When you fund by Interac e-Transfer, we receive the sender's name, amount, and message (your member code) from our bank's transfer notifications.
• Deposit delivery information: when a daily Interac e-Transfer is accepted or auto-deposited, we receive and keep the confirmation from Interac and the receiving institution, including the legal name of the account holder who received the funds, the amount, and the time. We use it as proof of delivery.
• Communications: messages you send us through the contact form, by email, or by phone, our replies, and, if you join the investor waitlist, the details you provide there.
• Technical information: IP address, browser and device type, pages visited, timestamps, and error logs generated when you use lump.money. Our identity, payment, and hosting providers also record IP address and device information for fraud prevention and security.
• Risk and compliance records: your trust ladder tier inputs (completed Lumps, account age, dispute count), fraud-screening signals, name-matching results, operator notes, dispute evidence, and refund records.

We use personal information for the following purposes only:

• To provide the service: create and manage your account, schedule and send your daily deposits, process funding, cancellations, and refunds, and show you your Lump history.
• To verify your identity and meet our obligations under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act, the Retail Payment Activities Act, and the Quebec Money-Services Businesses Act, including record keeping and, where required, reporting to FINTRAC.
• To prevent fraud and protect members, recipients, and Lump: matching the name on your payment method and your recipient's bank account to the names we verified, screening card payments, applying the Progressive Trust Ladder, and pausing suspicious activity.
• To document delivery and defend against chargebacks and payment disputes with card networks, banks, Klarna, and Afterpay.
• To send you transactional messages about your account and your Lumps (welcome, funding confirmation, completion, cancellation, refund, identity verification status). These are not marketing messages.
• To answer your questions and resolve problems.
• To comply with the law, respond to lawful requests from regulators, courts, and law enforcement, and enforce our Terms of Service.
• To understand, in aggregate, how the site performs and is used, so we can improve it. We do not sell personal information and we do not use it for third-party advertising or behavioural profiling.

We collect personal information with your consent, which you give when you create an account, start identity verification, create or fund a Lump, or contact us. Where the law allows, we may also use information without consent, for example to detect and prevent fraud, to comply with a legal obligation, or to collect a debt.

Identity document images and facial captures are sensitive information. Before verification begins, we ask for your express consent to collect them and compare them, for the sole purposes of confirming your identity, preventing fraud, and meeting our anti-money-laundering obligations. Without this verification, we cannot allow you to fund a Lump.

You may withdraw your consent at any time by contacting the Privacy Officer, subject to legal and contractual restrictions and reasonable notice. Withdrawing consent may mean we can no longer provide the service to you. We will still keep the records the law requires us to keep.

Two decisions about you are made exclusively by automated processing: the outcome of your identity verification (a comparison of your document and facial capture performed by Persona), and your trust ladder tier, which determines whether card and pay-later funding is available to you and at what caps, based on your number of completed Lumps, your account age, and whether a payment dispute has been recorded on your account.

When a decision is made this way, you have the right to be informed of it, to ask which personal information was used, to know the main factors and parameters that led to it, to have that information corrected, and to submit your observations to a member of our team who can review the decision. Contact the Privacy Officer to exercise these rights.

We share personal information only with the service providers and parties needed to run Lump, under contracts that restrict their use of it to our instructions:

• Supabase: hosts our database, authentication, and secure file storage. Our production database and identity-evidence storage are hosted in Canada (Montreal region).
• Vercel: hosts the lump.money website and application servers and provides aggregate, cookie-free analytics and performance measurement.
• Persona: performs identity document and facial verification, including liveness detection, and returns the verified data to us.
• Stripe: processes card, wallet, Klarna, and Afterpay payments, screens them for fraud, and manages disputes and refunds. We pass Stripe your email address, member code, verified name, and Lump reference for fraud screening.
• Resend: delivers our transactional emails and receives our bank's Interac notification emails so we can match funding and deposits to your Lump.
• Google: only if you choose to sign in with Google, under Google's own privacy policy.
• Interac Corp. and financial institutions: to receive your funding and send your daily deposits. Your recipient sees Lump's name, the deposit amount, and the Lump code security question. Our bank and Interac see the recipient's email address and name.
• Regulators and authorities: FINTRAC, the Bank of Canada, the Autorité des marchés financiers, Revenu Québec, courts, and law enforcement, when the law requires or permits it.
• Card networks, issuing banks, Klarna, and Afterpay: when a payment is disputed, we provide the evidence described in our Terms of Service, including identity verification results, authentication data, initiation timestamps, and deposit confirmations.

We do not sell, rent, or trade personal information, and we do not share it with advertisers. If Lump is involved in a merger, financing, or sale of assets, personal information may be transferred to the successor, who will remain bound by this Policy.

Our primary database and identity-evidence storage are located in Canada. However, several of our providers, including Persona, Stripe, Vercel, Resend, and Google, are headquartered in the United States and store or process personal information there or in other countries where they operate. While your information is outside Quebec or Canada, it is subject to the laws of that jurisdiction and may be accessible to its authorities. Before relying on each provider, we assess the sensitivity of the information, the purposes, the protections in place, and the legal regime of the destination, and we bind the provider by contract to protect your information to a standard equivalent to this Policy.

lump.money uses only strictly necessary cookies: secure session cookies set by our authentication provider to keep you signed in and protect your account. They are not used to track you across other websites and cannot be turned off without losing the ability to sign in. Your language preference is stored in your profile, not in a cookie.

We use Vercel Analytics and Speed Insights to measure page views and site performance. These tools do not set cookies, do not collect personal identifiers, and produce only aggregate statistics. We do not use advertising trackers, social media pixels, or technologies that identify, locate, or profile you.

We keep personal information only as long as needed for the purposes described above and to meet legal requirements, then we securely destroy or anonymize it:

• Identity verification records (document images, facial capture, extracted data, and result): for the duration of your relationship with us and at least five years after it ends, as required by the Proceeds of Crime (Money Laundering) and Terrorist Financing Act, and longer if needed to defend an open dispute or claim.
• Lump, payment, deposit, dispute, and refund records: at least five years after the transaction, and for the full duration of any chargeback or dispute window or legal claim.
• Account and profile information: while your account is open, and then for the retention periods above. You may ask us to close your account at any time.
• Support messages and investor waitlist entries: up to three years after our last exchange, unless needed to resolve a dispute.
• Technical logs: typically 30 to 90 days, unless kept longer as security or fraud evidence.

We protect personal information with safeguards proportionate to its sensitivity: encryption in transit (TLS) and at rest, row-level access controls in our database so members can see only their own data, role-based operator access limited to what each role requires, hashed passwords, signed and verified webhooks from our providers, 3D Secure on card payments, and logging of administrative actions. Identity evidence is stored in a private bucket accessible only to authorized operators.

We maintain a register of confidentiality incidents. If an incident involving your personal information presents a risk of serious injury, we will notify the Commission d'accès à l'information du Québec and notify you as required by law, and we will take reasonable steps to reduce the harm.

Subject to legal exceptions, you have the right to:

• Access: obtain confirmation that we hold personal information about you and receive a copy of it.
• Rectification: have inaccurate, incomplete, or ambiguous information corrected. Names taken from your verified identity document can be corrected only by completing a new verification.
• Withdraw consent: ask us to stop using or sharing your information, subject to the legal retention obligations described above.
• Deletion: ask us to delete information that is no longer necessary for the purposes it was collected for, or to close your account.
• Portability: receive the computerized personal information you provided to us in a structured, commonly used technological format, or have it sent to another organization where technically feasible.
• De-indexing: ask us to stop disseminating information about you, or to de-index a hyperlink attached to your name, where dissemination contravenes the law or a court order or causes you serious injury.
• Automated decisions: be informed of, ask questions about, and have a person review any decision made exclusively by automated processing, as described in section 5.
• Complain: file a complaint with us, with the Commission d'accès à l'information du Québec, or with the Office of the Privacy Commissioner of Canada.

To exercise a right, write to the Privacy Officer at the address below. We may need to verify your identity before acting. We respond within 30 days of receiving a request. There is no fee for access requests, except for reasonable costs of transcription, reproduction, or transmission, of which we would inform you in advance.

Lump is intended for adults. You must be at least 18 years old, and the age of majority in your province or territory, to open an account. We do not knowingly collect personal information from minors. If you believe a minor has provided us with personal information, contact the Privacy Officer and we will delete it.

We may update this Policy to reflect changes in our practices or in the law. We will post the updated version on lump.money with a new effective date and, for material changes, notify you by email or in the application before they take effect.

Person in charge of the protection of personal information (Privacy Officer), attention of the President

Lump Financial Services LTD

Headquarters: 658 - 2000 McGill College Ave, H3A 3H3, Montreal, Quebec, Canada

Email: support@lump.money

Phone: 1-855-221-2212

Supervisory authorities

Commission d'accès à l'information du Québec: cai.gouv.qc.ca

Office of the Privacy Commissioner of Canada: priv.gc.ca