Privacy Policy
Last updated: April 26, 2026
1. Introduction
Cana ("we," "our," or "us") is an income routing platform operated by The Boricua Group LLC. We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our services at usecana.com and our mobile application.
2. Information we collect
Information you provide
Name, email address, phone number, date of birth, and financial account information you provide during account creation and onboarding. For business accounts, we also collect business name and entity type.
Financial information
Bank account numbers, routing numbers, account balances, and transaction history collected through our banking partner Unit and account linking partner Plaid. We use this information solely to provide our income routing services.
Usage information
Information about how you use our platform, including routing rules you create, goals you set, and transactions processed through our system.
3. How we use your information
To provide, operate, and maintain our income routing services
To process transactions and execute your routing rules
To verify your identity in compliance with Know Your Customer (KYC) regulations
To communicate with you about your account and transactions
To detect, prevent, and investigate fraud and security incidents
To comply with legal obligations including anti-money laundering (AML) requirements
To improve and personalize your experience with Cana
4. How we share your information
We do not sell your personal information to third parties. We share your information only in the following circumstances:
Unit (banking partner)
To create and manage your deposit accounts, process ACH transfers, and issue debit cards. Unit is FDIC-insured and subject to federal banking regulations.
Plaid (account linking)
To link and verify your external bank accounts. Plaid is subject to its own privacy policy and security standards.
Legal authorities
When required by law, court order, or government regulation, including for anti-money laundering compliance.
Service providers
Trusted third-party vendors who assist in operating our platform, bound by confidentiality agreements.
5. Data security
We implement industry-standard security measures to protect your information. All data transmitted between your device and our servers is encrypted using TLS 1.2 or higher. All data stored in our systems is encrypted at rest. Access to production systems is controlled through role-based access control (RBAC) and API token authentication. Financial data is processed through our banking partner Unit, which maintains its own comprehensive security program.
6. Data retention
While your account is active, we keep the personal and financial information needed to operate Cana. When you close your account in Settings (or request closure at privacy@usecana.com), we:
- Immediately revoke bank connections (including Plaid access tokens)
- Delete or anonymize personal information (name, email, avatar, preferences)
- Retain financial transaction and routing records for seven years to meet banking and recordkeeping requirements, then permanently delete them on a scheduled basis
Some information (such as security audit logs) may be retained longer where required by law or to prevent fraud. Our banking partner Unit and account-linking partner Plaid maintain their own retention practices under their policies.
7. Your rights
Access the personal information we hold about you
Request correction of inaccurate information
Request closure of your account and erasure of personal information (financial records may be retained for the period described in Data retention)
Opt out of marketing communications at any time
Request a copy of your data in a portable format
To exercise any of these rights, contact us at privacy@usecana.com.
8. Cookies and tracking
We use essential cookies to maintain your session and authentication state. We do not use advertising cookies or sell your data to advertisers. You may disable cookies in your browser settings, but this may affect functionality.
9. Children's privacy
Cana is not intended for users under the age of 18. We do not knowingly collect personal information from minors. If you believe we have collected information from a minor, please contact us immediately at privacy@usecana.com.
10. Changes to this policy
We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a notice on our platform. Your continued use of Cana after changes become effective constitutes acceptance of the updated policy.
11. Contact us
The Boricua Group LLC (operating as Cana)
Email: privacy@usecana.com
Website: usecana.com