Privacy policy

1. Accountability and contact details

The person accountable for personal information at Nova Cash Inc. is the Privacy Officer. For questions, access or correction requests, or privacy complaints:

• Nova Cash Inc.
• Privacy Officer
• Email: info@novacash.ca
• Toll-free phone: (877) 431-4134
• Fax: (877) 267-2773
• Mailing address: CP 51012 Lévis, Québec, G6C 1R8, Canada

2. Collection and processing: what we collect

Depending on how you interact with us, we may collect and process the following categories of information:

• Loan application: identity and contact details (name, email, phone, gender, date of birth), address, employment and income information, requested amount and terms, a reference contact, consents, and the technical parameters needed to transmit the application securely.
• Campaign parameters: if you arrive through a promotional link, UTM parameters present in the URL may be associated with the application session to measure traffic source.
• Essential security: Cloudflare Turnstile processes security signals (IP address, TLS fingerprint, user-agent, sitekey and origin) to limit abusive automated submissions. This processing is necessary for the secure operation of the form.
• Technical signature sent to FinX: the client IP observed by our infrastructure (platform headers) is included in the application signature transmitted to FinX.
• Optional analytics: only if you accept analytics cookies, Google Analytics 4 (GA4) may process online identifiers, device and browser data, page interactions, and approximate location. GA4 is not loaded and does not send data until that consent is given.
• Marketing communications: only if you separately opt in on the form; that choice is distinct from analytics consent and from processing the loan application.
• Google Search Console: we review aggregated search-performance data in the console. GSC does not add a browser cookie or runtime tag for visitors on this site.

3. Purposes of processing

We process this information to:

• receive, validate, and transmit your loan application to the FinX application system;
• protect the form against abuse and spam (Turnstile and server-side controls);
• communicate with you about your application or file;
• meet legal, regulatory, and contractual obligations;
• measure audience and improve the site only when you have consented to analytics;
• send marketing communications only when you have chosen them separately.

4. Application transmission: NovaCash relay and FinX system of record

The NovaCash Next.js site acts as an application relay. When you submit an application through /en/apply (or /demande), the server receives the form, runs validation and security checks, then transmits the payload to FinX (instance clients.novacash.finexpert.io) through the lead-creation interface.

This Next.js relay does not write application payloads to its own database or files for the purpose of retaining the application record. Transmission is designed to be transient: application content is processed for as long as needed to validate and securely forward it.

FinX receives and retains the application as the loan-application system of record under applicable service and legal requirements. After acceptance, you may be redirected into the FinX environment for the next steps (including instant bank verification / IBV).

Collection/processing versus storage: the fact that the web relay does not durably store the payload does not mean there is no processing. Processing still occurs (receipt, validation, security, transmission, limited infrastructure technical logging). The application file is retained by FinX and may be retained by Nova Cash as needed for the service and legal obligations.

5. Hosting, providers, and processing outside Quebec

The site is hosted on Vercel. Function execution is configured in the Montréal region (yul1). Even so, Vercel technical or service data, and data handled by its subprocessors, may involve processing outside Quebec.

Cloudflare acts as a security provider for Turnstile (essential signals described above). Google acts as an analytics provider only after analytics consent. FinX acts as the application and file-continuation system for the loan.

We may also disclose certain information to professional advisors (legal, financial, accounting) or to authorities when required by law. Nova Cash does not sell your personal information.

When personal information may be processed outside Quebec, Nova Cash assesses the applicable privacy factors and governs the disclosure through written agreements and safeguards proportionate to the sensitivity of the information. Nova Cash remains accountable for its privacy obligations.

6. Cookies and similar technologies

Details on cookies, local storage, retention periods, purposes, and consent management are in our Cookie policy (/en/cookie-policy). In summary: consent preferences (cc_consent) are stored locally; Turnstile is essential security; GA4 (_ga, _ga_*) loads only after analytics opt-in, capped at 395 days; GSC adds no browser tag.

7. Retention

Information related to an application is retained by FinX and, where applicable, by Nova Cash for as long as needed for the purposes described, credit administration, and applicable legal requirements. Infrastructure and security technical logs may be kept for shorter operational and security periods. Analytics consent preferences are retained for the period stated in the Cookie policy. For details on a specific retention period, contact the Privacy Officer.

8. Security measures

We implement reasonable technical and organizational measures: encrypted transmission (HTTPS), server-side validation, anti-abuse protection (Turnstile), access controls, and least-exposure design on the web relay. No method is infallible; if an incident occurs, we will take appropriate steps based on the circumstances and applicable obligations.

9. Your rights

Subject to conditions under applicable Quebec law, you may request access to personal information we hold about you, request correction, and exercise other recognized rights where applicable. Send your request using the contact details in section 1. We may verify your identity before responding. Some data held only by a provider (notably FinX) may require coordination with that provider.

10. Marketing communications

Marketing communications are sent only if you chose them separately. You may withdraw that consent by writing to info@novacash.ca or through any mechanism indicated in the messages, where available. Withdrawal does not affect processing needed for a loan application already in progress.

11. Accuracy and loan-related risks

You are responsible for the accuracy of information provided in an application. A loan involves financial risks, including non-payment and possible additional fees. Site information aims to be clear but does not replace the terms confirmed before acceptance.

12. Updates

We may update this policy to reflect changes in practices, providers, or obligations. The version published on this page prevails. If a new non-essential purpose or cookie provider is added, an updated notice and consent will be required where applicable.