Privacy policy

1 Who we are and what this covers

Fortress Algo Incorporated, operating under the trade name Wiremi, is the organisation responsible for the personal information described in this policy. We are a corporation registered in Canada under Registry ID 4363756, with our head office at 5800 Ambler Dr, Suite 210, Mississauga, Ontario L4W 4J4, and we are registered with the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) as a money services business under registration number M23401666.

In data protection language we are the controller of your personal information. Where this policy says “we”, “us” or “Wiremi”, it means Fortress Algo Incorporated.

This policy covers every way you deal with us: the Wiremi mobile application, the website at wiremi.ca, the Wiremi Verify console used by lenders and landlords, our business accounts, our developer interfaces, and the email, telephone and messaging channels through which we answer you. It applies to visitors, to account holders, to the people who become part of your account because you send them money or share a savings circle with them, and to businesses that hold a Wiremi Business profile.

2 The principles we hold ourselves to

The ten principles in Schedule 1 to PIPEDA are the structure of this policy, and we read them as obligations rather than aspirations.

• Accountability. A named Privacy Officer is answerable for this policy and for every processor acting on our behalf.
• Identifying purposes. We tell you why we are collecting something at or before the moment we collect it.
• Consent. We ask, in language you can read, and we tell you what happens if you say no.
• Limiting collection. We collect what the purpose requires and refuse what it does not, even where more would be convenient.
• Limiting use, disclosure and retention. Information collected to verify your identity is not repurposed for marketing, and it is destroyed when its retention period ends.
• Accuracy. A score built on a wrong entry is a wrong score, so correction is a product feature and not a favour.
• Safeguards. Encryption in transit and at rest, access on a documented need, and a log of who looked.
• Openness. This document, kept current, with every prior version available on request.
• Individual access. You can ask what we hold about you and receive it in a form you can read.
• Challenging compliance. You can complain to us, and then over our heads to a regulator, and we tell you how.

3 The information we collect

The table below is the complete inventory of the categories we hold, where each comes from, and why. Individual fields change as the product changes; the categories and purposes do not change without a new version of this policy.

3.1 Information about other people that you give us

When you send money you give us information about the person receiving it. When you start or join a savings circle you give us information about the other members. When you ask a landlord or a lender to read your file you identify them to us. You are responsible for having the authority to give us that information, and we ask you to tell the person concerned that you have. We use it only to carry out what you asked for, to screen it as the law requires, and to keep the record we are obliged to keep.

3.2 Sensitive information, and what we do not collect

Biometric information is sensitive, and section 7 sets out the separate consent and the shorter retention that applies to it. Beyond that, we do not ask for information about your health, your racial or ethnic origin, your religion, your political opinions, your trade union membership, your sex life or your sexual orientation, and we ask you not to send it to us. Where you volunteer such information in a message to support, we remove it from the record unless it is material to a complaint you have asked us to investigate.

4 Why we use it, and on what legal footing

Every use of personal information at Wiremi serves one of the purposes below. Where you are in Canada, the right-hand column states the basis on which we rely under PIPEDA; where the GDPR applies to you, it states the Article 6 basis as well.

5 Consent: how we ask, and how you take it back

We ask for consent in a form proportionate to the sensitivity of what we are asking for. Opening an account is express consent to this policy, given by an action you take rather than by a pre-ticked box. Biometric processing, the release of a Community Credit file through Wiremi Verify, and marketing each require their own separate, express consent, recorded with a version and a timestamp, and each can be refused without losing the rest of the service.

We rely on implied consent only where the purpose is obvious from the circumstances and a reasonable person would expect it, such as using your address to deliver a card you asked us to send. We never rely on implied consent for sensitive information.

You may withdraw a consent at any time, in the app or by writing to privacy@wiremi.ca. Withdrawal takes effect as soon as we can give it effect, is not retroactive, and does not reach the information we are required by law to keep. We will tell you plainly what a particular withdrawal will cost you in service before you confirm it.

6 Automated decisions and Community Credit

Community Credit is a score we generate about you, and we use it to decide what we will lend you and at what price. That is an automated decision about a person, and it carries obligations we take seriously, so this section states exactly how it works.

6.1 What the score is, and what it is not

Community Credit runs from 300 to 900. It is proprietary to Wiremi and is not a credit bureau score. We are not a consumer reporting agency, we do not file your Wiremi conduct with Equifax, TransUnion or Experian, and nothing in your Wiremi record appears on a conventional credit report because of us. A score we give you does not raise or lower any bureau score you hold.

6.2 The inputs, and their weights

6.3 What the decision affects

6.4 Your rights over an automated decision

Where a decision about credit is made by automated means, you have the following rights, which you may exercise by writing to privacy@wiremi.ca or through the app. We answer within thirty days.

1. To be told. We tell you, at the time, that the decision was made by automated processing. The app shows your score, your tier and every entry that moved the number.
2. To an explanation. You may ask for the personal information used, the principal factors that led to the decision, and what would have to change for the outcome to change. We answer in plain language, not in model output.
3. To correct the inputs. Any entry on your file can be disputed under section 14. A corrected entry triggers a recomputation of the score.
4. To a human review. You may ask for the decision to be reviewed by a person with the authority to change it. That person is not the model and is not bound by it.

7 Biometric information

To confirm that the person opening an account is the person whose document has been presented, we ask you to take a selfie in the app. A liveness check confirms that we are looking at a living person rather than a photograph or a screen, and a template derived from the image is compared with the photograph on your document.

8 Who we share it with

We disclose personal information in five situations and no others: to the processors who help us run the service, to the partners who actually deliver your money, on your instruction through Wiremi Verify, to regulators and law enforcement where the law compels us, and to a buyer if the business changes hands.

8.1 Processors and partners

Each of the following acts for us under a written agreement that limits them to our instructions, requires security at least equal to our own, forbids them from using your information for their own purposes, and requires them to return or destroy it when the engagement ends.

8.2 On your instruction: Wiremi Verify

A lender, landlord or property manager cannot read your Community Credit file by asking us. They ask you. A request reaches you in the app showing who is asking, where they are, the purpose they gave and the depth they want, and it expires on its own after fifteen minutes if you do nothing. Nothing is released without your approval. What you approve is scoped to the depth you agreed and closes by itself after thirty days. Every request, including the ones you decline and the ones that expire, is written into an enquiry history that only you and we can see. A declined request is not an adverse event, costs you nothing and does not touch your score. Full details, including what a soft check and a full check each disclose, are in the Wiremi Verify terms.

8.3 Regulators, law enforcement and the courts

We disclose personal information to FINTRAC when we file a report the PCMLTFA requires, and to the Bank of Canada in the exercise of its supervision under the Retail Payment Activities Act. We disclose to police, to a securities or financial regulator, or to a court where we are compelled by a subpoena, production order, warrant or equivalent lawful demand, and to the extent that demand actually reaches.

We check the authority of every requester and the scope of every demand, we refuse what exceeds it, and we record what we gave and to whom. Where the law permits us to tell you about a demand, we do. Where the law forbids it, including the tipping-off prohibition that attaches to a suspicious transaction report, we cannot and do not.

8.4 If the business changes hands

If Wiremi is sold, merged, reorganised or financed, personal information may be disclosed to the other party, in each case under a confidentiality agreement and limited to what the transaction requires. If a transaction completes, the acquirer is bound by this policy in respect of information collected before the change until it gives you notice of a new one. We will tell you before your information becomes subject to a materially different policy.

9 Where your information goes

Wiremi is a Canadian company and your information is held primarily in Canada. Delivering a cross-border payment, by its nature, moves information across a border: to send money to Lagos we must give the delivering partner there the name and account of the person receiving it.

10 How long we keep it

We keep personal information only as long as the purpose requires or the law compels, and then we destroy it. Five years is the floor the PCMLTFA sets for most of what a money services business holds, and it runs from the end of the relationship rather than from the day the record was made.

When a retention period ends, records are destroyed, erased or de-identified so that they can no longer be associated with you. Information held in encrypted backups is destroyed on the backup cycle rather than individually, and remains protected and out of production use until it is.

11 How we protect it

• Information is encrypted in transit using current transport security, and at rest in our databases and backups.
• Access is granted on a documented need, is reviewed, is removed when a role changes, and is logged. Access to identity, biometric and compliance records is restricted to the compliance function, trained support reviewers and engineers who need it.
• Every employee and contractor signs a confidentiality undertaking and is trained on this policy before they touch client data, and at least annually after that.
• Multi-factor authentication protects administrative systems, and your account is bound to the devices you use, with step-up authentication on a new device or an unusual request.
• We test the platform, review our dependencies, and run a formal change process over anything that touches money, identity or records.
• Processors are assessed before engagement and reassessed at least every two years, and our agreements with them carry security, breach notification and audit terms.

No system is perfectly secure, and anyone who tells you otherwise is selling something. What we can promise is that we design for failure, that we look, and that we tell you when something goes wrong.

12 If something goes wrong

We maintain an incident response procedure covering detection, containment, assessment, notification and remediation. Where a breach of security safeguards creates a real risk of significant harm to you, we will report it to the Office of the Privacy Commissioner of Canada and notify you as soon as feasible, and we will keep a record of every breach whether or not it reaches that threshold, as PIPEDA requires.

A notification to you will describe what happened, what information was involved, what we have done about it, what you can do to protect yourself, and how to reach a person at Wiremi about it. Where the GDPR applies we notify the relevant supervisory authority within 72 hours of becoming aware of a qualifying breach. Where Quebec law applies we notify the Commission d’accès à l’information and keep the register of incidents it requires.

13 Your rights

The rights below belong to you wherever you are. Some of them come from PIPEDA, some from Quebec’s Law 25 and some from the GDPR; rather than make you work out which regime you fall under, we extend all of them to everyone, except where a right is genuinely specific to one law.

13.1 How we answer

We acknowledge a request promptly and answer within 30 days. Where a request is complex we may extend that once, by up to a further 30 days, and we will tell you why before the first period expires. We verify who you are before we act, because handing your file to someone impersonating you would be the worst failure of all. There is no charge. If we refuse a request in whole or in part we will tell you why, which provision we rely on, and how to challenge the refusal.

We may refuse or limit access where it would reveal personal information about another person that cannot be severed, where it would reveal confidential commercial information, where it is protected by solicitor-client privilege, or where it would reveal that we have filed or considered filing a suspicious transaction report. The last of those is not discretion on our part: the law forbids us to tell you.

14 Accuracy, and disputing an entry

Your Community Credit score is built from entries, and a wrong entry produces a wrong score. You may dispute any entry on your file, in the app, on the entry itself. The dispute runs as a case with four stages you can watch: we investigate against the source of the entry; we correct or remove it if it does not hold up, or explain why it does; we recompute the file with the corrected entry and show you what moved; and we tell you the outcome in writing. The entry is marked as disputed for the whole time the case is open, and anyone who reads the file while it is open sees that mark.

15 Saying no, and closing your account

You can decline anything. What differs is the consequence, and we would rather you knew it in advance than discovered it afterwards.

You can close your account at any time in the app or by writing to support@wiremi.ca. We will return your available balance, subject to any lock you chose and any amount you owe us. Closing the account ends the relationship but does not erase the records the PCMLTFA requires us to keep, which continue for five years as set out in section 10. After that period they are destroyed.

16 Messages, cookies and tracking

16.1 The messages we send

Service messages tell you about your own money: a transfer arrived, a contribution is due, a login happened on a new device, a document is expiring. They are part of the service and you cannot turn them off while the account is open. Marketing messages are everything else, and you consent to them separately, can withdraw that consent in one action in the app or by the unsubscribe link in any message, and we act on a withdrawal promptly. We comply with Canada’s anti-spam legislation.

16.2 Cookies and similar technologies

You can refuse non-essential cookies when you first arrive and change your mind at any time from the footer of the site. Your browser can also block or delete cookies, though blocking the strictly necessary ones will stop you signing in. We honour a Global Privacy Control signal where your browser sends one, and we do not track you across other companies’ websites.

17 Children

Wiremi is for adults. You must be at least 18 to open an account, we do not knowingly collect personal information from anyone under 18, and the platform refuses an application where the date of birth on the document shows the applicant is under age. If you believe a child has given us information, write to privacy@wiremi.ca and we will delete it and close any account. Where Quebec law applies, we do not use the personal information of a minor under 14 for any purpose other than one that is clearly for their benefit.

18 Our Privacy Officer, and how to complain

A named Privacy Officer is accountable for this policy and answers every access request, correction, objection and complaint. Write to privacy@wiremi.ca, or by post to the Privacy Officer, Fortress Algo Incorporated, 5800 Ambler Dr, Suite 210, Mississauga, Ontario L4W 4J4, Canada.

If you are unhappy with our answer, say so and your complaint is escalated inside Wiremi to someone who was not part of the first decision. We acknowledge a complaint within two business days and aim to resolve it within thirty days. If we cannot, we will tell you why and when we expect to.

You do not have to come to us first, and nothing in this policy limits your right to go straight to a regulator or to a court.

19 Changes to this policy

We review this policy at least annually and whenever we add a product, a partner, a corridor or a purpose. If we change it in a way that materially affects you, we will tell you at least 30 days before the change takes effect, by email and in the app, and we will say plainly what changed. Where a change requires your consent, we will ask for it rather than assume it from your silence. Minor corrections take effect when published. Every prior version is kept and is available on request.

20 The documents this one sits beside

This policy explains what we do with personal information. The terms of service are the agreement that governs your account and every product on it. The compliance and AML policy explains the obligations that force some of the collection described here, including identity verification, screening, monitoring and reporting. The Wiremi Verify rights page explains, from your side, what happens when someone asks to read your file. Where this policy and another document disagree about personal information, this policy governs.