Privacy policy

1.1 About Monitiva

Monitiva is a Canadian corporation incorporated in the Province of Ontario (Ontario Corporation Registration Number: 1000801222), registered as a Money Services Business (MSB) with FINTRAC (#C100000118) and as a Payment Service Provider (PSP) with the Bank of Canada under RPAA (REG-3961, registered February 2, 2026).

Monitiva provides cross-border domestic payment infrastructure enabling users to maintain a safeguarded Local Balance — held in trust in Canadian dollars with a prudentially regulated Canadian financial institution or trust company — and to execute domestic payments in Destination countries through a Just-in-Time (JIT) FX mechanism. At the exact instant a User confirms a payment instruction, Paytex simultaneously converts the required CAD amount and executes the domestic payment (SPEI in Mexico; additional Destination rails as they become available) from Paytex's own corporate accounts in the Destination jurisdiction. No foreign client balance is created at any point. Client funds never leave Canada until a User-instructed payment or withdrawal executes.

Data Controller Declaration: Paytex Solutions Ltd. dba Monitiva acts as the data controller for all personal data collected through the Platform, waitlist, and associated services.

1.2 Two Operational Phases Covered by This Policy

CURRENT STATUS — PRE-LAUNCH: Monitiva is currently in a pre-launch phase. The only service available today is waitlist registration. Monitiva does not currently open accounts, accept or hold client funds, or process payments. Accordingly, the Phase 2 processing described below — identity verification, biometric verification, risk assessment, location data, and transaction monitoring — does not occur today. It describes the processing that will apply when payment services launch and you open a Monitiva Account. Only the Phase 1 processing described below applies to you at present.

Phase 1 — Waitlist and Pre-Launch: Collection of interest registration information (name, email, city, user profile, urgency indicator, payment frequency, and monthly spend estimate) through landing pages and waitlist forms, including campaign and marketing analytics.

Phase 2 — Full Platform: Processing of personal and financial information necessary to provide payment services, including identity verification (KYC), risk assessment, transaction processing, regulatory reporting, and AML/CTF compliance.

1.3 Privacy Officer

1.4 Acceptance

By accessing our website, submitting your information for our waitlist, or using our services, you acknowledge that you have read and understood this Privacy Policy and consent to the collection, use, and disclosure of your personal information as described herein, subject to the legal bases set out in Section 4.

2.1 Jurisdictional Scope

3.1 Waitlist and Pre-Launch Registration Data

3.2 Technical and Analytics Data (Automatically Collected)

We automatically collect: IP address (anonymized where feasible); browser type, version, and operating system; device type and screen resolution; referring URL and landing page URL; UTM parameters for campaign attribution; pages visited, time spent, and navigation patterns; cookie identifiers; and A/B test variant exposure.

3.3 Personal Identification Information (Platform Users — KYC)

3.4 Financial and Transactional Information

We collect: details of the Canadian bank account you link to your Monitiva Account in order to fund your Local Balance by pre-authorized debit (account number, institution, and the name of the account holder of record); your pre-authorized debit authorization and the record of it; your Local Balance and transaction history; source of funds documentation; purpose of transactions; and Beneficiary name and domestic payment identifier (CLABE or equivalent).

Account ownership verification. When you link a Canadian bank account, we verify that the account belongs to you by comparing the name of the account holder of record against your verified legal name. We do this to prevent third-party funding, which we do not permit, and to meet our obligations under PCMLTFA and the requirements of our banking partner. If the names do not match, the account cannot be linked and you will not be able to fund your Local Balance from it. You may ask us to review this outcome (see Section 13).

3.5 Risk Assessment and Suitability Information (KYC)

To meet our risk-based obligations under PCMLTFA and to assign appropriate transaction limits, we collect the following at onboarding and, where applicable, at Enhanced Due Diligence (EDD):

How we use employer and business information. Where you provide the name of an employer or business, we use it to assess the risk profile associated with your declared occupation and industry, and it may be screened against adverse media sources as part of our AML/CTF due diligence. This screening is directed at the named organization in the context of your risk assessment.

Data minimization. Consistent with PIPEDA and Quebec Act 25 minimality requirements, Monitiva does not collect your Social Insurance Number (SIN) or your country of birth. These data points are not necessary for our MSB/PSP scope and are excluded by design.

3.6 Biometric Verification Information

We collect biometric information — facial images for liveness verification, and biometric data compared against your identity document — through our identity verification and compliance provider Sumsub. Biometric verification occurs at two points:

• At onboarding, as part of the identity verification process required before we can provide you with any financial service.
• On an ongoing basis, at each Cash Pickup request. Because Cash Pickup releases cash to you in person in a Destination country, we re-verify your identity biometrically each time you request a Cash Pickup, to confirm that the person making the request is you. This is a recurring verification for as long as you use Cash Pickup, not a one-time check.

By initiating identity verification, and by requesting a Cash Pickup, you grant express consent for biometric data collection exclusively for identity verification purposes. Consent is obtained explicitly within the verification flow. We do not use biometric data for any other purpose, and we do not use it to identify you in any context other than verifying your own identity to your own account.

3.7 Location Information

When you use the payment services, we collect information about where you are located. This is distinct from the website analytics described in Section 3.2 and is used for compliance and fraud-prevention purposes.

Cash Pickup location gating. Cash Pickup requires you to be physically present in the Destination country. We verify this using a combination of the signals above; if we cannot confirm your presence, the Cash Pickup request is declined. You may ask us to review this outcome (see Section 13).

What we do not do with location data. We do not use location information for advertising, marketing, or profiling unrelated to compliance and fraud prevention. We do not sell or share it with marketing platforms. We do not use it to determine your tax residency or your immigration status, and we do not report it to tax or immigration authorities except where we are legally compelled to respond to a valid order or regulatory request. Our use of location data is for AML/CTF compliance, fraud prevention, and risk assessment only.

4.1 Overview

4.1.1 Legal Basis by Activity — Waitlist and Pre-Launch Phase

4.2 CASL Compliance

Monitiva fully complies with CASL. We will only send you commercial electronic messages if you have provided express consent through our waitlist form or platform registration. Every commercial message identifies Monitiva as the sender, provides our complete contact information, and includes a clear, functioning unsubscribe mechanism honored within 10 business days. We maintain records of how and when consent was obtained. Withdrawal of consent does not affect transactional or service messages.

4.3 Quebec Act 25 — Specific Requirements

For Quebec residents, we apply: the principle of minimality (we collect only the minimum personal information necessary); clear, specific information about each purpose before collection; express consent before using information for purposes not identified at collection; Privacy Impact Assessments (PIAs) before implementing new technologies; data portability in structured, machine-readable format; and the ability to request de-indexation of information.

5.1 Waitlist and Pre-Launch Activities

• Sending waitlist confirmation, position updates, and launch notifications
• Communicating product developments, beta access invitations, and early adopter offers (with CASL-compliant consent)
• Analyzing demand by geography and user profile
• Running A/B tests on messaging to optimize the product before launch
• Prioritizing beta access based on urgency, profile, and geographic alignment
• Sending newsletter content and marketing communications of potential interest to the User — including cross-border payment tips, product updates, and corridor-specific information — exclusively to Users who have provided separate express opt-in consent in accordance with CASL at the time of waitlist registration. Each communication will identify Monitiva as the sender, include complete contact information, and provide a clear unsubscribe mechanism honored within 10 business days.

5.2 Platform Service Delivery

• Verifying ownership of the Canadian bank account you link, and processing Local Balance funding by pre-authorized debit (PAD) against that account
• Executing JIT FX conversions and domestic payment instructions in the Destination country
• Maintaining RPAA-compliant Trust Account sub-ledgers for each client
• Providing customer support and resolving service issues

5.3 Regulatory Compliance

• Complying with PCMLTFA, including filing Suspicious Transaction Reports (STRs), Electronic Funds Transfer Reports (EFTRs), and Terrorist Property Reports (TPRs) with FINTRAC
• Complying with RPAA operational and incident reporting requirements to the Bank of Canada
• Conducting sanctions screening against applicable Canadian, US, UN, and EU lists
• Implementing and maintaining our AML/CTF program, including transaction monitoring and risk classification

5.4 Travel Rule Compliance

For transfers of CAD $1,000 or more, we are required to share sender and beneficiary information with receiving financial institutions. This is a mandatory legal requirement under PCMLTFA and does not require additional consent.

5.5 Fraud Prevention, Security, and Business Improvement

We use your information to detect and prevent fraudulent activity and account takeover; maintain audit trails for security and compliance; analyze service usage to improve our product; and personalize the user experience based on your profile and preferences.

6.1 Service Providers

We share personal information with service providers strictly as necessary to deliver and safeguard the service. With the exception of Sumsub (named below given its role in identity verification and compliance), providers are described by function rather than by name; where they relate to cookies and analytics, the specific vendors are listed in our Cookie Policy.

6.2 Regulatory Authorities

6.3 What We Do NOT Do

Monitiva does not, and will not: sell, rent, or trade your personal information to third parties for marketing purposes; share your information with advertisers or ad networks for behavioral targeting on other platforms; or use your financial transaction data or Local Balance information for purposes other than providing and improving our services and complying with legal obligations.

9.1 Technical Safeguards

• Encryption in transit: TLS 1.3 for all data transmitted over the internet
• Encryption at rest: AES-256 for all stored data on our cloud infrastructure
• Multi-Factor Authentication (MFA): required for account access and all critical administrative systems
• API gateway with rate limiting, authentication enforcement, and attack protection
• Immutable backup systems with daily verification
• Endpoint Detection and Response (EDR) for continuous threat monitoring
• Regular penetration testing and vulnerability assessments

9.2 Organizational Safeguards

• Role-based access controls limiting data access to employees with business need
• Segregation of duties and four-eyes principle for high-risk operations
• Annual employee training on data protection, privacy, and AML/CTF
• Independent security audits (external review at minimum every two years)

9.3 Fund Segregation Security

Client funds (Local Balances) are held in trust in the Trust Account and are segregated from Paytex's own corporate funds. Client funds are not Paytex's property, are not used to fund Paytex's operations, and are not available to Paytex's creditors. This segregation protects client funds and is a non-negotiable operational requirement under RPAA safeguarding obligations.

11.1 Rights Under PIPEDA (All Canadian Residents)

You have the right to: access the personal information we hold about you; request correction of inaccurate or incomplete information; withdraw consent for processing activities based on consent (subject to mandatory legal retention obligations); and file a complaint with the Office of the Privacy Commissioner of Canada (OPC).

11.2 Additional Rights Under Quebec Act 25

Quebec residents have additional rights including: data portability in structured, machine-readable format; de-indexation requests; information about automated decisions significantly affecting you; and human review of automated decisions.

11.3 Additional Rights Under GDPR (EU/EEA Residents)

EU/EEA residents have additional rights including: data portability; restriction of processing; right to object; erasure ("right to be forgotten", subject to mandatory PCMLTFA retention obligations); and the right not to be subject to solely automated decisions with legal effects.

11.4 CASL Unsubscribe Rights

You may withdraw consent to receive commercial electronic messages at any time by clicking the unsubscribe link in any commercial email, emailing privacy@monitiva.com, or updating your communication preferences in your account settings. We will honor unsubscribe requests within 10 business days.

17.1 Contact Monitiva

17.2 Supervisory Authorities