Privacy Policy

Effective Date: April 30, 2026
Last Updated: April 30, 2026

Lodavo Inc. ("Lodavo," "we," "us," or "our") is committed to protecting the privacy and personal information of individuals who use our services. This Privacy Policy explains how we collect, use, disclose, and protect your personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and Quebec's Act respecting the protection of personal information in the private sector (Law 25).

This Privacy Policy applies to the website located at www.lodavo.ca (the "Site"), the Lodavo mobile application (the "App"), and any related services (collectively, the "Services").

By accessing or using our Services, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy.

1. Purpose and Scope

We collect and use personal information solely for the purposes identified in this Privacy Policy. We limit our collection to what is necessary to operate the Services — a prize-linked savings platform that allows users to link bank accounts, earn contest tickets based on savings balances, and participate in weekly draws for cash prizes.

2. Consent

We obtain your consent before or at the time of collecting personal information, except where permitted or required by law. By using our Services, you consent to the collection, use, and disclosure of your personal information as described herein.

How we obtain consent:

Account registration: By creating a Lodavo account, you consent to the collection and use of your account information.
Financial data: Consent for the collection of financial data is obtained when you initiate the bank account linking process through Plaid. You may revoke this consent at any time by unlinking your bank account.
Marketing communications: Express consent for marketing emails is obtained separately, in compliance with Canada's Anti-Spam Legislation (CASL). You may withdraw this consent at any time.
Winner publicity: Consent for the public display of winner information (first name, last initial, and province) is obtained during the prize claim process through the declaration and release (waiver).

Withdrawal of consent: You may withdraw your consent at any time by contacting us at contact@lodavo.ca. Withdrawal of consent may limit our ability to provide certain Services to you.

3. Language Policy

This Privacy Policy is available in both English and French. In the event of a discrepancy between the two versions, the version in the language you selected at registration shall prevail.

English: www.lodavo.ca/privacy-policy
French: www.lodavo.ca/fr/politique-de-confidentialite

4. Personal Information We Collect

A. Information You Provide

Account information: Full name, email address, date of birth, country of residence, province of residence (for Canadian residents), and language preference.

Financial information (via Plaid): When you link a bank account, Plaid collects and transmits to us: bank account identifiers, financial institution name, account type, account name, account mask (last four digits), and account balances. Lodavo never receives or stores your bank login credentials — these are handled exclusively by Plaid.

Contest participation data: Number selections for weekly draws, ticket allocations, and draw participation history.

Prize claim data: Banking information for electronic funds transfer (EFT) or Interac e-Transfer, signed declaration and release (waiver), and skill-testing question responses.

Referral data: Referral codes you share and redemption information.

Communications: Messages you send to us via email or in-app support.

B. Information Collected Automatically — Site

When you visit the Site, we may automatically collect: IP address, approximate geographic location, browser type and version, operating system, device type, pages visited, links clicked, referring URL, and time spent on pages.

C. Information Collected Automatically — App

When you use the App, we may automatically collect: device model, operating system version, app version, unique installation identifiers (such as iOS vendor ID or Android device ID), push notification tokens, app usage events (anonymized), crash and error data, and performance metrics.

Fraud prevention signals. At the time of account creation, we collect and store a device identifier and a cryptographic hash (non-reversible) of your IP address. We also perform device integrity attestation using platform-provided services (Apple App Attest on iOS and Google Play Integrity on Android) to verify that the App is running on a genuine device. These signals constitute the use of technology capable of identifying individuals, as contemplated by section 8.1 of Quebec Law 25. They are collected only to detect and investigate potential multi-account abuse, as described in section 5, and are reviewed manually by authorized personnel; no automated decisions are made based on these signals. This functionality is activated when you create an account, is necessary for fraud prevention, and cannot be deactivated independently of the Services.

5. How We Use Your Personal Information

We use the personal information we collect for the following purposes:

Account management: Create and maintain your account, verify your identity, and authenticate your sessions.
Savings verification: Verify savings account balances to determine ticket eligibility ($25 in savings = 1 ticket, up to 1,000 tickets per week).
Contest operations: Allocate contest tickets, process number selections, conduct weekly draws, determine winners, and administer prize claims.
Winner announcements: Display winner information (first name, last initial, and province) to other users, with consent obtained through the prize claim waiver.
Transactional communications: Send account alerts, draw results, prize claim notifications, and other service-related messages.
Marketing communications: With your express consent under CASL, send promotional messages about our Services.
App performance: Monitor application performance and diagnose technical errors.
Product improvement: Analyze anonymized usage patterns to improve the Services.
Fraud prevention: Detect and prevent fraudulent activity, enforce rate limits, and maintain platform integrity. This includes using device identifiers and hashed IP addresses to identify patterns consistent with multi-account abuse. These signals are reviewed manually by authorized personnel; they are never used to automatically block accounts or deny service.
Legal compliance: Comply with applicable laws and regulations, including tax reporting obligations (CRA), CASL, PIPEDA, and Quebec Law 25.

6. Who We Share Your Personal Information With

We do not sell your personal information. We share personal information only as described below.

A. Data Processors (Service Providers)

We engage the following third-party service providers who process personal information on our behalf, under written agreements that require them to protect your information:

Plaid Inc. (United States) — Bank account verification and balance retrieval. Data shared: bank credentials (handled by Plaid only), account identifiers, balances, transactions.
Supabase Inc. (Canada) — Database hosting, authentication, and backend infrastructure. Data shared: all account data.
Mailgun (Sinch Email) (United States) — Transactional and marketing email delivery. Data shared: email address, name.
Render Services, Inc. (United States) — Backend API hosting. Data shared: API request data (in transit only; no at-rest storage).
Expo (650 Industries, Inc.) (United States) — Mobile app delivery, over-the-air updates, push notifications, and app delivery analytics. Data shared: device information, push notification tokens.
Functional Software, Inc. (Sentry) (United States) — Application error monitoring and diagnostics. Data shared: error and crash data, device information (personally identifiable information is scrubbed before transmission).
New Relic, Inc. (United States) — Application performance monitoring and log aggregation. Data shared: application performance metrics, request traces, and application logs (request paths, error messages, internal user IDs).
PostHog, Inc. (United States) — Product analytics (personally identifiable information is filtered before transmission). Data shared: anonymized usage events, device properties.

B. Other Users (With Your Consent)

If you win a prize and complete the prize claim process (including signing the declaration and release), your first name, last initial, and province of residence will be displayed to other users in draw results and winner announcements. This display is made with your express consent, obtained through the prize claim waiver, in accordance with Section 9(b) of the Contest Rules.

C. Website Analytics and Advertising (Site Only)

The following services are used on the Site only and are not used in the App:

Google Analytics (website traffic analysis)
Meta Pixels (advertising measurement)
Hotjar (website heatmaps and session recordings)
LinkedIn Ads, Reddit Ads, Snap Ads, TikTok Ads (advertising measurement)

These services may use cookies and similar technologies. See Section 13 (Cookie Policy) for details.

D. Legal and Regulatory Disclosures

We may disclose personal information without consent where required or permitted by law, including to:

Tax authorities (Canada Revenue Agency) for prize reporting
Law enforcement agencies pursuant to valid legal process
Courts or tribunals in connection with legal proceedings
Regulatory bodies (including the Office of the Privacy Commissioner of Canada and the Commission d'acces a l'information du Quebec)

E. Aggregated and De-Identified Data

We may share aggregated or de-identified data that cannot reasonably be used to identify any individual. Such data is not considered personal information under PIPEDA or Law 25.

7. Technologies

A. Site Technologies

The Site uses cookies and similar tracking technologies. Non-essential cookies (analytics and advertising) are disabled by default for users located in Quebec, in compliance with Law 25, and require your affirmative consent before activation.

Essential cookies: Required for the Site to function (session management, security). These do not require consent.

Analytics cookies: Google Analytics — used to understand how visitors interact with the Site. You may opt out at any time.

Advertising cookies: Meta Pixels, LinkedIn, Reddit, Snap, and TikTok tracking pixels — used to measure advertising effectiveness. Disabled by default in Quebec; opt-in required.

B. App Technologies

The App uses the following technologies for performance monitoring and analytics. The App does not use advertising identifiers, cookies, or advertising tracking pixels.

PostHog: Product analytics with personally identifiable information (PII) filtering enabled. Session replay uses text masking to prevent capture of sensitive information.
Sentry: Crash and error reporting to help us diagnose and fix technical issues. PII scrubbing is enabled.
New Relic: Application performance monitoring to ensure the App runs smoothly.
Expo: Over-the-air JavaScript updates and push notification delivery.

8. Other Disclosures

In the event of a merger, acquisition, reorganization, bankruptcy, or other similar event, your personal information may be transferred to the successor entity, provided that the successor agrees to be bound by this Privacy Policy or provides equivalent protection.

9. Data Retention and Destruction

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, or as required by law. The following retention periods apply:

Account information: Retained for the duration of your account plus one (1) year, to accommodate post-closure access requests.
Financial data (Plaid): Retained for the duration of your account and deleted within 30 days of account closure. Only weekly balance snapshots are stored, in keeping with data minimization principles.
Contest and draw data: Retained for seven (7) years after the relevant draw, to satisfy tax and regulatory requirements and the Contest Rules.
Prize claim records: Retained for seven (7) years after prize payment, in accordance with Canada Revenue Agency requirements.
Email engagement data: Retained for three (3) years, for CASL compliance record-keeping.
Analytics data (PostHog): Retained for two (2) years, for product improvement.
Error and crash logs (Sentry): Retained for 90 days, for debugging and diagnostics.
Performance data (New Relic): Retained for 90 days, for performance monitoring.
Fraud prevention signals (device identifier, hashed IP address): Retained for the duration of your account and deleted upon account deletion, for multi-account abuse detection.
Deleted account data: Destroyed within 30 days of deletion, except where legal retention obligations apply.
Account deletion feedback: When you delete your account you may optionally share a reason and a short comment. Comments are screened by an automated redaction layer that removes common identifiers (email addresses, phone numbers, long digit sequences, Canadian postal codes) before storage, are not linked to your deleted account, and are automatically deleted from our systems within fourteen (14) days. Aggregate non-identifying context (the selected reason, your language preference, a broad tenure category, and whether you had a linked bank account) is retained with the comment and purged on the same 14-day schedule.

When personal information is no longer required, it is securely destroyed or anonymized in accordance with our internal governance policies and procedures.

Governance: Lodavo's Privacy Officer is responsible for overseeing compliance with this Privacy Policy, internal governance policies, and applicable privacy legislation. All personnel with access to personal information receive privacy training.

10. International Data Transfers

Your personal information may be transferred to and processed in countries outside of Canada, specifically the United States, by the following service providers: Plaid, Mailgun, Sentry, PostHog, New Relic, Render, and Expo.

When your personal information is transferred outside of Canada, it may be subject to the laws of the receiving country, including the USA PATRIOT Act, the CLOUD Act, and the Foreign Intelligence Surveillance Act (FISA). While these laws may permit access to your information by government authorities under certain circumstances, we take steps to ensure that our service providers maintain comparable levels of protection.

Safeguards:

Written data processing agreements are in place with all service providers requiring them to protect your information in accordance with PIPEDA and Law 25.
Privacy Impact Assessments (PIAs) have been conducted for each cross-border transfer in accordance with section 17 of Quebec Law 25. A register of these assessments is maintained by our Privacy Officer and is available to regulators upon request.
Our primary database (Supabase) is hosted in Canada.

11. Minors

Our Services are intended for individuals who are at least 18 years of age (or the age of majority in their province of residence, whichever is greater). We do not knowingly collect personal information from individuals under 18. If we become aware that we have collected personal information from a minor, we will take steps to delete it promptly.

12. Your Rights

Under PIPEDA and Quebec Law 25, you have the following rights:

Access: You may request access to the personal information we hold about you.
Correction: You may request correction of inaccurate or incomplete personal information.
Deletion: You may request the deletion of some or all of your personal information, subject to legal retention requirements, without necessarily deleting your account. You may also delete your account entirely through the App under Settings, or by contacting us.
Data portability: You may request a copy of your personal information in a structured, commonly used format (JSON or CSV), in accordance with Section 27 of Quebec Law 25.
De-indexing: You may request that we cease disseminating your personal information, or that any hyperlink to it be de-indexed, where the dissemination contravenes the law or a court order, in accordance with Section 28.1 of Quebec Law 25.
Withdrawal of consent: You may withdraw your consent to the collection, use, or disclosure of your personal information at any time. Note that withdrawal may affect our ability to provide certain Services.

To exercise your rights: Contact us at contact@lodavo.ca or at the mailing address listed in Section 15. We will respond to your request within 30 days.

Complaints: If you are not satisfied with our response, you may file a complaint with:

Office of the Privacy Commissioner of Canada (OPC): www.priv.gc.ca
Commission d'acces a l'information du Quebec (CAI): www.cai.gouv.qc.ca

13. Automated Decision-Making

Lodavo uses automated decision-making in the limited circumstances described below. These decisions are made based exclusively on the automated processing of your personal information, without human intervention, as contemplated by section 12.1 of Quebec Law 25.

A. Entry allocation

The total number of contest entries credited to your account for each Weekly Period is calculated automatically by our systems.

Personal information used: entries earned through any of the methods described in sections 4.1 and 4.2 of the Contest Rules, including (i) your weekly balance snapshot of linked Canadian chequing and savings accounts; (ii) promotional code redemptions; (iii) verified referrals; (iv) verified social-media follows; (v) completion of in-app bonus activities; (vi) verified partner offer completions; (vii) discretionary bonus entries awarded by Lodavo; and (viii) qualifying no-purchase postal entries received under section 4.2 of the Contest Rules.

Principal factors and parameters: the entry count associated with each eligible method at the applicable conversion rate set out in the Contest Rules (for example, $25 CAD in total linked balances = 1 entry, rounded down; 10 entries per qualifying postal submission); the weekly entry cap of 1,000 per person per Weekly Period; and the timing of each entry event relative to the Weekly Period. All entry methods — including the no-purchase postal method — confer the same odds per entry in the applicable draw.

B. Auto-pick of numbers

If you do not manually select seven numbers for a given entry before the Monday 8:00 p.m. ET deadline, our systems automatically generate a unique seven-number combination (integers from 0 to 99, with no duplicates within a single entry) for that entry.

Personal information used: the presence or absence of a manual number selection for each of your entries before the deadline.

Principal factors and parameters: the output of a cryptographically secure random number generator, constrained to produce a unique combination per entry per Weekly Period for each entrant.

C. Winner determination

After all seven winning numbers for a Weekly Period have been drawn, our systems automatically identify the selected entrant(s) in accordance with section 6 of the Contest Rules.

Personal information used: the seven numbers associated with each of your entries in the applicable Weekly Period.

Principal factors and parameters: the count of matches between your selected numbers and the seven drawn winning numbers, without regard to order; in the event of a tie at the highest match count, a random selection from among all tied entries (each tied entry held by the same person is included separately in the random selection).

D. Your rights under section 12.1 of Quebec Law 25

With respect to any decision listed above, you have the right to:

Be informed of the personal information used to reach the decision;
Be informed of the principal factors and parameters that led to the decision;
Have the personal information used to reach the decision corrected; and
Submit observations to a member of Lodavo's personnel who is authorized to review the decision.

To exercise any of these rights, contact us at contact@lodavo.ca or at the address listed in section 17. We will respond within 30 days.

14. Breach Notification

In the event of a breach of security safeguards involving your personal information that creates a real risk of significant harm, we will:

Notify the affected individuals as soon as feasible, in accordance with Sections 10.1 to 10.3 of PIPEDA.
Report the breach to the Office of the Privacy Commissioner of Canada (OPC).
For Quebec residents: notify the Commission d'acces a l'information du Quebec (CAI).

We maintain an internal breach incident register for a minimum of 24 months following each incident.

15. Cookie Policy

Site Cookies

The Site uses cookies and similar technologies as described in Section 7(A). You can manage your cookie preferences through the cookie consent banner displayed when you first visit the Site, or at any time through your browser settings.

For Quebec residents: Non-essential cookies (analytics and advertising) are disabled by default and require your affirmative opt-in consent before activation, in compliance with Law 25.

App Technologies

The App does not use cookies. The technologies used in the App are described in Section 7(B).

16. Modifications to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through an in-app notification at least 30 days before the changes take effect. The "Last Updated" date at the top of this page will be revised accordingly.

Your continued use of the Services after any modifications constitutes your acceptance of the updated Privacy Policy.

17. Contact Us

If you have questions or concerns about this Privacy Policy, your personal information, or our privacy practices, please contact:

Lodavo Inc.
Attention: Privacy Officer
Email: contact@lodavo.ca
Mailing Address: 4 Place Ville Marie, Suite 300, Montreal, QC H3B 2E7, Canada