Privacy Policy
This policy explains what personal information O'Shares Invest collects, why we collect it, on what basis we keep it, who can see it and what rights you hold over it. It is organized as a numbered list of commitments so you can check any specific question without reading the whole document.
1. Who is responsible
The controller of your personal information is O’Shares Invest Digital Services — demo entity, operating as O'Shares Invest, with its office at 120 Example Avenue, Suite 4, Toronto — fictional demo address, Toronto. Questions, access requests and complaints about data handling go to [email protected], which is monitored by the same compliance team that answers regulatory queries.
2. What we collect
Account data: your name, email address, phone number, country and province of residence, and your password stored as a one-way hash. Verification data: the identity documents and banking confirmations required under our AML / KYC policy. Transaction data: deposits, withdrawals and their statuses. Usage data: pages visited within the platform, watchlists, alert settings, and technical logs including device and browser information.
We do not collect special-category information beyond what identity verification legally requires, and we never ask for the password of your bank or exchange accounts.
3. Why we collect it
Each category has a named purpose. Account data exists to operate your account and communicate with you. Verification data exists to satisfy Canadian anti-money-laundering and identity-verification requirements. Transaction data exists to execute, record and audit movements. Usage data exists to run the service, secure it and improve it. No category is collected for a purpose we cannot state.
4. Legal bases for processing
We process your data under a combination of bases: performance of the contract you entered by registering; compliance with legal obligations, principally the AML and KYC framework described on the AML page; legitimate interests in securing and improving the platform; and consent, where required, for optional communications you can withdraw at any time.
5. Marketing communications
Operational messages, verification, security, withdrawal status, complaints, are not marketing and cannot be switched off while your account is open. Marketing messages, the monthly market digest and product updates, are opt-in and every one carries a working unsubscribe link honored within three business days.
6. Who can see your data
Access is role-based and logged. Account managers see what they need to support you; compliance staff see verification files; engineers see production data only through audited tooling with personal fields masked. Third-party processors, payment handlers, identity-verification providers, cloud hosting, receive only the minimum data for their function under written agreements that bind them to our standards.
7. We do not sell your data
Your personal information is not sold, rented or traded. It is shared with third parties only as processors under contract, or where the law compels disclosure, for example reporting obligations to FINTRAC, or where you explicitly direct us, for example sending your complaint file to OBSI on your behalf.
8. Where your data lives
Primary storage is in Canada, with encrypted backups in facilities we audit. Some processors operate elsewhere; where that happens, data remains protected by contractual safeguards at least equivalent to Canadian requirements, and transfer needs are documented in our records.
9. How long we keep it
Account data persists while your account is open and for a reasonable period after closure for dispute and audit purposes. Verification and transaction records are retained for the periods Canadian AML rules prescribe, which outlive account closure. Marketing preferences are kept until you withdraw consent. When retention ends, data is deleted or irreversibly anonymized.
10. Your access rights
You may request a copy of the personal information we hold about you. We deliver it in a readable format within thirty days, free of charge, and we correct errors you identify within the same timeline. Requests go to the support email with ACCESS REQUEST in the subject line.
11. Correction and erasure
You can correct your contact details directly in your profile. Corrections to identity records require re-verification. Erasure requests are honoured except where the law requires retention, AML records being the main case, and we explain any limit on deletion rather than quietly refusing.
12. Objection and restriction
You may object to processing based on legitimate interests, and we restrict processing of disputed data while a complaint about it is investigated. Objection never affects your ability to withdraw funds or close your account.
13. Automated decisions
The platform does not make automated decisions with legal or significant effect on you. Monitoring flags are reviewed by a person before any account action, and every such action can be explained and challenged through support and the complaints process.
14. Cookies and analytics
We use a minimal set of cookies: session cookies for sign-in, and analytics only through the slot described in our technical documentation, which remains inactive until the site's own analytics identifier is configured. No advertising trackers run on this site. You can block cookies in your browser; the site degrades gracefully except for sign-in persistence.
15. Security and breaches
Protection measures are described on the Security page: encryption in transit and at rest, hashed credentials, 2FA, scoped exchange connections and append-only audit logs. If a breach affects your personal information, affected users are notified directly with plain-language facts and concrete next steps, alongside any notifications the law requires.