At a glance
Reviewed
Where your data lives
Reviewed
The database, file storage and application servers are in Canada, in Montréal. Requests reach them through our hosting provider’s global network. Email delivery and billing are handled by providers in the United States.
Service providers that receive personal information
As of
| Provider | What it does | Personal information it receives | Where |
|---|---|---|---|
| Supabase | Database and file storage for the whole platform | Firm, advisor and client records, uploaded files, signed consents and the audit log | Canada (Montréal) |
| Vercel | Hosts the app and this website, and runs every server function and scheduled job | All request data in transit, including client pages | Canada (Montréal) Requests enter through Vercel’s global network |
| Resend | Email delivery | Recipient names and email addresses, sign-in and recovery links, client reminder text, task digests and shared resources | United States |
| Stripe | Subscription billing and tax | The firm’s billing contact, address and tax number. No client information | United States |
When we add or replace a provider on this list, we post the change in the change log at least 30 days before it takes effect.
Other services, and what they receive
- Video and audio on client pages. When an advisor adds a video or audio clip, it loads in the client’s browser straight from YouTube (its privacy-enhanced youtube-nocookie domain), Vimeo or SoundCloud. That provider sees the client’s IP address and browser details.
- Carrier links. To find a carrier’s website, we send the carrier’s name to a search provider (Google Custom Search, Brave or DuckDuckGo). No personal information goes with it.
- Partner tools. These are links only. We send them no data.
- This website. livingmyplan.com loads fonts from Google Fonts and books demos through Calendly. The app bundles its own fonts, so client pages make no requests to Google.
We use no third-party analytics, error-monitoring service, advertising tracker or AI provider.
Security
Reviewed
Advisors, clients and Living My Plan staff each sign in differently, and each sees only what their role allows.
Signing in
- There are no passwords. Advisors sign in with their email and a 6-digit code from an authenticator app.
- Links we email for signing in or joining a firm work once, are stored only as a hash, and expire. A sign-in link you request lasts 15 minutes, and no link lasts longer than 7 days.
- Sessions time out. Advisors are signed out after 12 hours idle (30 days at most), and Living My Plan staff after 4 hours (7 days at most).
Access by role
Firm admins control access. An advisor who is not an admin sees only the service plans assigned to them.
Firm separation
Every request is scoped to one firm, and the database cannot be reached from a browser. Only our servers talk to it.
Client pages
- Each service plan link is 14 random characters. An advisor can replace it at any time, which signs out everyone using the old link.
- A client’s service plan is protected by a PIN they choose. Five wrong tries lock it for 15 minutes, and ten lock it for an hour.
- Files a client uploads are stored privately and opened only through short-lived links.
- The installable client page caches no personal information for offline use. Only a static offline screen is stored.
Encryption
Authenticator secrets and PINs get an extra layer of AES-256 encryption inside the database.
Content safety
Content cannot carry hidden code. Raw HTML is rejected on save, and pages render text safely.
Staff and support access
- Living My Plan staff sign in with a staff key, an approved email address and an authenticator code.
- When our support team opens a firm’s account, the start and end of that visit are written to an audit log that cannot be edited.
- Every action our staff take on the platform, support visits included, goes into an audit log that cannot be edited or deleted. It records who, what, when, IP address and browser.
Privacy
Reviewed
Whose information it is
Living My Plan holds information about two groups of people, and each has its own policies. Firms and their advisors are covered by the Privacy Policy and the Terms and Conditions. The firm’s clients are covered by the Client Privacy Policy and the Client Terms of Use.
Most client information reaches us through the advisor. The firm stays responsible for the advice it gives and for its own records.
What the client page leaves out
- Birthdates are never collected. On the client page, the client’s own name is shortened to first names.
- Living My Plan records what kinds of accounts a client holds and where, never balances or values.
How consent is recorded
A signed consent records the exact version of the document and a fingerprint of its text. It stores no IP address or browser details.
AI tools
Living My Plan sends no firm or client data to any AI provider. Where a feature helps you use your own AI tool, you copy the text across yourself.
Usage measurement
No third-party analytics, ad trackers or session recording. Our own usage measurement honours Global Privacy Control.
For clients
If your advisor gave you a link to your service plan, the Client Privacy Policy explains what reaches us about you and how to ask about it. Questions about the service plan itself go to your advisor.
What never goes into Living My Plan
Reviewed
The platform is built for ordinary service-planning information: names, general life circumstances, and the kinds of accounts a client holds and where. Our Terms and Conditions forbid entering any of the following anywhere in it, free-text notes included:
- Social Insurance Numbers
- Full account or policy numbers
- Banking or payment credentials
- Government-issued identification numbers
- Passwords
It records the kinds of accounts a client holds, never balances or values.
Keep these in your firm’s own secure systems, such as your CRM, not in Living My Plan.
Retention and deletion
Reviewed
- Each service plan keeps a Change history for 7 years.
- Firm and advisor account information is kept while the firm’s subscription is active, and for a reasonable period afterwards to meet legal, accounting and billing needs (Privacy Policy, section 7).
- Client information is kept while the firm has an active relationship with Living My Plan and with the client. Before access ends, the advisor can print or save a record of the service plan’s activity (Client Privacy Policy, section 6).
To ask for information to be deleted, email our Privacy Officer at privacy@livingmyplan.com. Clients can also ask their advisor.
Compliance
Reviewed
Living My Plan is built for Canadian advisory firms and the privacy laws they work under: the Personal Information Protection and Electronic Documents Act (PIPEDA), Alberta’s Personal Information Protection Act (PIPA) and Quebec’s Law 25. Email to clients follows Canada’s Anti-Spam Legislation (CASL).
Our Terms and Conditions are governed by the laws of Alberta and the federal laws of Canada that apply there.
Documents
Reviewed
| Document | For | Version and date | Access |
|---|---|---|---|
| Privacy Impact Assessment | Compliance teams and regulators | In preparation | The summary will be published here, and the full version will be available on request |
| Privacy Policy | Firms and advisors | 1.1Updated September 25, 2026 | Public |
| Terms and Conditions | Firms and advisors | 1.0Updated August 10, 2026 | Public |
| Client Privacy Policy | Clients | 1.1Updated September 25, 2026 | Public |
| Client Terms of Use | Clients | 1.0Updated August 10, 2026 | Public |
| Service providers list | Compliance teams | As of | On this page |
| Data Processing Agreement | Firms | - | On request |
| Security overview | Compliance teams | Same as this page | Print this page, or save it as a PDF from your browser |
All four policies took effect on July 1, 2026. To request the Data Processing Agreement, email privacy@livingmyplan.com.
Incidents
Reviewed
If you suspect an incident involving your firm’s information, email our Privacy Officer at privacy@livingmyplan.com.
Report a security issue
Reviewed
Email our Privacy Officer, Matthew McWhirter, at privacy@livingmyplan.com. Tell us what you found, the steps to reproduce it and the page or address affected. Please don’t access other people’s data or disrupt the service while you test.
Change log
Every change to this page is listed here, newest first. A change to our service providers is posted here at least 30 days before it takes effect.
- Trust Center published.
Questions about this page, or requests for the documents above, go to our Privacy Officer:
Living My Plan is a 49Maple Inc. platform. LIVING MY PLAN™ is a trademark of 49Maple Inc.