LEGAL
EFFECTIVE: 15 OCTOBER 2026
BLIA ("BLIA," "we," "us") is an independent project. BLIA builds three things as one product. First, a source-quoted catalogue of Canadian financial-institution product terms. Second, a household app that checks statements against that catalogue. Third, a free tool, the MCP server, so AI assistants can answer banking questions correctly.
BLIA is not a bank. BLIA is not affiliated with or endorsed by any financial institution named in our catalogue.
Questions about this policy: office@bliahub.com.
This covers bliahub.com, BLIA's MCP server, and the BLIA consumer app (including our invite-only founding cohort). It does not cover any bank's or credit union's own website or app. Those have their own privacy notices.
BLIA's catalogue covers BMO, Scotiabank, CIBC, RBC and TD, chequing accounts — the full Big Five. Coverage is intended to grow next to credit unions and digital-first banks, then to other account types, then beyond Canada, starting with the EU. This policy applies no matter how far coverage grows by the time you read it.
We collect two very different kinds of information, described separately because they carry very different sensitivity.
BLIA collects this to keep the service reliable, prevent abuse, and understand which products people ask about most. BLIA does not collect this to build a profile of any individual caller.
If you use the consumer app, you choose to upload statement documents (usually PDFs) from your own bank or credit union. We extract the transactions and balances from those documents to check them against our catalogue and show you the result.
BLIA uses secure statement uploads instead of your banking password, on purpose. This removes password-sharing risk entirely. It also matches the direction of Canadian banking regulation. The Consumer-Driven Banking Act (s.76(1)) moves institutions toward secure, tokenized data-sharing that never requires a password. BLIA's upload flow gives you the same benefit today, before that infrastructure is ready everywhere.
BLIA's role is always advisory. BLIA tells you what it found. Only you decide what to do about it.
BLIA does not collect your name, beyond what a founding-cohort agreement can separately require. BLIA does not collect government ID numbers, payment card details, banking credentials, or conversation content from the AI assistant you use. BLIA does not store your IP address in its usage logs. BLIA does not use advertising trackers. BLIA's pages set no cookies as of this policy.
BLIA processes this data to run the service, stop abuse, fix problems, and understand usage in aggregate. For the consumer app, BLIA processes data solely to check your statements against its catalogue and show you what it found. BLIA never sells your data. BLIA never earns referral revenue from any bank or credit union. See section 15.
For API and MCP usage data, BLIA relies on its legitimate interest in running a free, anonymous public service responsibly. For anything you submit to the consumer app, BLIA relies on your clear, informed consent at the moment you choose to upload a document. Financial data is sensitive. BLIA never collects it passively.
API usage log lines contain no personal information: a random session identifier, the name and version of the AI client, the parameters of the call, and timings. They are kept in our hosting provider's (Railway, Pro plan) log store for 30 days, then deleted there. Each night BLIA copies them into its own analytics database, with any IP address removed before it is stored, and keeps that copy to measure how the service is used. The hosting provider's own request logs record the connecting IP address for the same 30 days. BLIA's rate limiter holds connecting IP addresses in memory for at most 24 hours to enforce per-address limits, and writes them nowhere. Statement PDFs and the transactions BLIA extracts from them are kept only as long as your consumer-app account is active, or until you ask BLIA to delete them, whichever comes first. Aggregated, de-identified statistics, like overall call volume, can be kept indefinitely, since they no longer describe you.
Our API runs on Railway, a managed cloud platform, in a US region; statement extraction for the consumer app runs on hardware we control directly. We choose infrastructure providers that meet applicable Canadian privacy standards, wherever their servers are physically located.
The fees, rates, and rules BLIA publishes describe financial products, not people. They come from documents that institutions publish themselves. This policy covers only the data described in section 4, not the catalogue content.
When an AI assistant calls BLIA for you, BLIA receives only the parameters for that one call. BLIA never receives your conversation history or account identity from the assistant you use.
The consumer app starts with a small, invite-only founding cohort of households, targeted for October 2026, ahead of general availability. If BLIA invites you to join, BLIA will ask you to agree to a short, specific consent step before you upload any statement. You keep the same access and deletion rights described below.
BLIA applies safeguards appropriate to each kind of data it holds. This means rate limiting and minimal collection for API metadata, and no credential storage plus hardware-scoped processing for statement data. No online service can guarantee absolute security.
For API and MCP metadata, BLIA does not build an identifiable profile of any caller. Most "access my data" requests cannot be matched to a specific person, because the usage logs hold no identifier that points to one. This is by design. For the consumer app, BLIA has an identifiable relationship with you. You can ask to access, correct, or delete your data at any time by writing to office@bliahub.com. BLIA will act on your request within its stated retention window.
BLIA does not accept payment, commission, or any other consideration from a bank or credit union in exchange for a recommendation or placement. BLIA does not sell your data to any institution for that purpose. This is a permanent commitment, not a launch promotion.
BLIA's services are not directed at children. BLIA does not attempt to identify or verify anyone's age.
BLIA's pages can link to a bank's or credit union's own website. BLIA is not responsible for their privacy practices. This policy does not cover their privacy practices.
BLIA will update the date at the top whenever this policy changes. BLIA will flag anything material clearly on this page.
This policy is governed by the laws of British Columbia, Canada, and the federal laws of Canada that apply.
Questions or requests about this policy, including access and deletion requests: office@bliahub.com.