Privacy Policy

1. Introduction

New To Canada (“we,” “us,” “our,” or the “Company”) operates the New To Canada platform (the “Service”), a web-based settlement guide application designed to assist newcomers in navigating their transition to life in Canada. We are committed to protecting your privacy and safeguarding the personal information you entrust to us.

This Privacy Policy describes how we collect, use, disclose, retain, and protect your personal information when you access or use our Service. This Policy applies to all users of the Service, including visitors who do not create an account.

We are subject to the Personal Information Protection and Electronic Documents Act (PIPEDA), S.C. 2000, c. 5, and any substantially similar provincial privacy legislation, including but not limited to the Personal Information Protection Act (PIPA) of British Columbia and Alberta, and Quebec’s Act Respecting the Protection of Personal Information in the Private Sector (Law 25). Where users access our Service from jurisdictions subject to the European Union’s General Data Protection Regulation (GDPR), Regulation (EU) 2016/679, or the United Kingdom General Data Protection Regulation (UK GDPR), the applicable provisions of those regulations shall also apply.

By accessing or using the Service, you acknowledge that you have read, understood, and agree to the collection, use, and disclosure of your personal information as described in this Privacy Policy. If you do not agree with this Policy, you must discontinue use of the Service immediately.

2. Definitions

For the purposes of this Privacy Policy:

• “Personal Information” means any information about an identifiable individual, as defined under PIPEDA, including but not limited to name, email address, date of birth, immigration status, and location data.
• “Service” means the New To Canada web application, including all features, tools, content, and functionality provided therein.
• “User,” “you,” or “your” means any individual who accesses, browses, or uses the Service, whether or not they have created an account.
• “Account” means a registered user account created through the Service’s registration process.
• “Processing” means any operation or set of operations performed on personal information, whether or not by automated means, including collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure, dissemination, alignment, combination, restriction, erasure, or destruction.
• “Third-Party Service Provider” means any entity that processes personal information on our behalf in connection with the provision of the Service.

3. Information We Collect

We collect the following categories of personal information in connection with the operation of the Service:

3.1 Account Registration Information

When you create an Account, we collect:

• Email address
• Password (stored in hashed form by our authentication service provider; we do not have access to your plaintext password)
• Display name

3.2 Profile Information

During the onboarding process and through subsequent profile updates, we collect:

• Full legal name
• Gender identity (male, female, other, or prefer not to say)
• Date of birth
• Immigration status (landed immigrant or arriving)
• Immigration program or pathway (Express Entry, Provincial Nominee Program, Family Sponsorship, Student Visa, Work Permit, Refugee, Startup Visa, or Other)
• Date of arrival in Canada (actual or planned)
• Postal code
• Current province or territory of residence
• Planned province or territory of residence
• Languages spoken

3.3 Community Content

When you participate in our community forum, we collect the content of your posts, replies, and any related interactions, including timestamps and engagement data.

3.4 Uploaded Documents

The Service provides a document storage feature. When you upload files, we store those documents in our cloud infrastructure. We do not access, review, or analyze the contents of your uploaded documents except as required to provide the Service or as required by law.

3.5 Settlement Journey and Usage Data

We collect data related to your use of the Service, including:

• Settlement journey progress (completed tasks, phases, and milestones)
• Badge and achievement progress
• Reminder and notification preferences
• Recommendation interactions (viewed, started, completed, or dismissed recommendations)

3.6 AI Interaction Data

When you use our AI-powered features, including the settlement chat assistant and personalized recommendation engine, we collect:

• Messages and queries you submit to the AI assistant
• Conversation history within a session
• AI-generated responses and recommendations associated with your Account

3.7 Location Data

We collect location-related information that you provide voluntarily, including your postal code and province. When you use the nearby services feature, we transmit location-based queries to the Google Places API. We do not collect precise GPS or geolocation data from your device without your explicit consent.

3.8 Technical and Device Information

We automatically collect certain technical information when you access the Service, including:

• Internet Protocol (IP) address
• Browser type and version
• Operating system
• Device type and screen resolution
• Referring URL and pages visited
• Date and time of access
• Cookies and similar technologies (see our Cookie Policy)

3.9 Subscription Information

If you subscribe to a paid plan, we collect subscription tier, status, start and end dates, and payment-related identifiers as processed by our third-party payment processor. We do not directly store credit card numbers or complete payment instrument details on our servers.

4. How We Use Your Information

We use the personal information we collect for the following purposes:

• Service Provision and Maintenance: To create and manage your Account, provide access to Service features, and maintain the technical infrastructure of the Service.
• Personalization: To generate personalized settlement recommendations, task lists, and journey milestones based on your immigration program, province, arrival date, and other profile information.
• AI-Powered Features: To process your profile data and queries through our artificial intelligence systems (powered by OpenAI) to deliver tailored recommendations, chat responses, and settlement guidance.
• Community Facilitation: To enable you to create, publish, and interact with community forum content.
• Document Storage: To securely store and organize documents you upload to the Service.
• Local Services Discovery: To process location-based queries through the Google Places API to identify nearby settlement services, government offices, and community organizations.
• Reminders and Notifications: To send you task reminders, progress notifications, and Service-related communications.
• Subscription Management: To process subscriptions, manage account access levels, and facilitate billing.
• Service Improvement: To analyze usage patterns, identify trends, diagnose technical issues, and improve the overall quality and functionality of the Service.
• Communications: To send you transactional communications (account verification, password resets, security alerts) and, with your consent, promotional or informational communications about the Service.
• Legal Compliance: To comply with applicable laws, regulations, legal processes, or enforceable governmental requests.
• Security and Fraud Prevention: To detect, prevent, and respond to fraud, abuse, security incidents, and other harmful activities.

5. Artificial Intelligence and Automated Decision-Making

The Service utilizes artificial intelligence technologies provided by OpenAI, Inc. (“OpenAI”) to deliver personalized settlement recommendations and an AI-powered chat assistant. We believe it is important that you understand how these technologies interact with your personal information.

5.1 Data Transmitted to OpenAI

To generate personalized recommendations and chat responses, we transmit certain profile information to OpenAI’s API, including your immigration program, province of residence, languages spoken, arrival date, and immigration status. When you use the chat assistant, your messages are transmitted to OpenAI for processing.

5.2 OpenAI’s Data Handling

Data transmitted to OpenAI through our API integration is subject to OpenAI’s data usage policies. Under our API agreement with OpenAI, data submitted through the API is not used to train OpenAI’s models. For more information, please refer to OpenAI’s privacy policy and API data usage policies.

5.3 Nature of AI Outputs

AI-generated recommendations and chat responses are provided for informational and educational purposes only. They do not constitute immigration advice, legal advice, financial advice, or any other form of professional advice. AI outputs may contain inaccuracies, errors, or outdated information. You should not rely on AI-generated content as the sole basis for any decision. Please refer to our Disclaimer for additional information.

5.4 Right to Human Review

You have the right to request human review of any automated recommendation or decision generated by the Service. To request a manual review, please contact us at privacy@newtocanada.com.

5.5 Opting Out of Automated Profiling

Where applicable under the GDPR or other legislation, you have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. Our AI features are advisory in nature and do not produce legally binding outcomes. However, if you wish to opt out of AI-powered personalization, you may contact us and we will provide alternative, non-personalized access to the Service to the extent feasible.

6. Legal Basis for Processing

For users subject to the GDPR or UK GDPR, we process personal information on the following legal bases:

• Consent (Article 6(1)(a) GDPR): Where you have given clear, affirmative consent to the processing of your personal information for specific purposes, such as creating an Account and providing profile data for personalization.
• Performance of a Contract (Article 6(1)(b) GDPR): Where processing is necessary for the performance of a contract to which you are party, namely the provision of the Service in accordance with our Terms of Service.
• Legitimate Interests (Article 6(1)(f) GDPR): Where processing is necessary for the purposes of our legitimate interests, including improving the Service, ensuring security, and preventing fraud, provided such interests are not overridden by your fundamental rights and freedoms.
• Legal Obligation (Article 6(1)(c) GDPR): Where processing is necessary for compliance with a legal obligation to which we are subject.

Under PIPEDA, we collect and use your personal information with your knowledge and consent, except where permitted or required by law. You may withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice.

7. Disclosure and Sharing of Information

We may disclose your personal information to the following categories of recipients:

7.1 Third-Party Service Providers

We engage the following third-party service providers who process personal information on our behalf:

• Google LLC (Firebase): Authentication services, cloud database (Firestore), and cloud storage for document hosting. Data is processed and stored in Google Cloud infrastructure.
• OpenAI, Inc.: Artificial intelligence API for generating personalized recommendations and powering the chat assistant.
• Google LLC (Google Places API): Location-based service discovery for identifying nearby settlement services and organizations.

7.2 Community Content

Posts, replies, and other content you publish in the community forum are visible to other users of the Service. Your display name is associated with your community contributions. Exercise caution when sharing personal information in community posts.

7.3 Legal Requirements

We may disclose your personal information if required to do so by law, regulation, legal process, or governmental request, including but not limited to compliance with a subpoena, court order, or order of a tribunal or regulatory body having jurisdiction.

7.4 Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, receivership, or sale of all or a portion of our assets, your personal information may be transferred to the acquiring entity. We will notify you of any such change in ownership or control of your personal information.

7.5 With Your Consent

We may disclose your personal information to third parties where you have provided your explicit consent to such disclosure.

7.6 No Sale of Personal Information

We do not sell, rent, trade, or otherwise commercially transfer your personal information to third parties for their marketing purposes.

8. Data Storage and Security

We implement reasonable technical and organizational safeguards designed to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include, but are not limited to:

• Encryption in Transit: All data transmitted between your browser and our servers is encrypted using Transport Layer Security (TLS/HTTPS).
• Cloud Infrastructure Security: Personal information is stored in Google Cloud (Firebase) infrastructure, which maintains industry-standard security certifications including SOC 1, SOC 2, SOC 3, and ISO 27001.
• Access Controls: Firestore security rules restrict data access to authorized users. Profile data, uploaded documents, and journey data are accessible only to the account owner and authorized administrators.
• Authentication Security: User authentication is managed by Firebase Authentication, which implements secure password hashing, session management, and optional multi-factor authentication.
• Offline Data Persistence: The Service may use IndexedDB on your local device for offline data persistence. This data remains on your device and is subject to your device’s security settings.

Notwithstanding the foregoing, no method of electronic transmission or storage is completely secure. We cannot guarantee the absolute security of your personal information. You are responsible for maintaining the confidentiality of your Account credentials and for any activities that occur under your Account.

9. Data Retention

We retain your personal information for as long as is reasonably necessary to fulfill the purposes for which it was collected, as described in this Policy, unless a longer retention period is required or permitted by law. Specifically:

• Account Data: Retained for the duration of your Account’s existence. Upon account deletion, we will delete or anonymize your personal information within thirty (30) days, except where retention is required for legal compliance.
• Community Content: Posts and replies may be retained in anonymized or pseudonymized form after account deletion to preserve the integrity of community discussions.
• Uploaded Documents: Deleted upon your request or upon account deletion.
• AI Interaction Data: Chat conversation histories are maintained for the duration of your session and may be cached temporarily to improve recommendation quality. We do not permanently retain individual chat transcripts beyond what is necessary for Service operation.
• Technical Logs: Server logs containing IP addresses and access information are retained for a period not exceeding ninety (90) days.

10. Your Privacy Rights

10.1 Rights Under PIPEDA

Under PIPEDA, you have the following rights with respect to your personal information:

• Right of Access: You have the right to request access to the personal information we hold about you, subject to limited exceptions as set out in PIPEDA.
• Right of Correction: You have the right to request the correction of inaccurate or incomplete personal information.
• Right to Withdraw Consent: You may withdraw your consent to the collection, use, or disclosure of your personal information at any time, subject to legal or contractual restrictions and reasonable notice. Withdrawal of consent may affect our ability to provide certain features of the Service.
• Right to Challenge Compliance: You have the right to challenge our compliance with PIPEDA by filing a complaint with the Office of the Privacy Commissioner of Canada.

10.2 Rights Under the GDPR

If you are located in the European Economic Area (EEA) or the United Kingdom, you have the following additional rights:

• Right of Access (Article 15): The right to obtain confirmation as to whether personal data concerning you is being processed and to access such data.
• Right to Rectification (Article 16): The right to obtain rectification of inaccurate personal data.
• Right to Erasure (Article 17): The right to obtain the erasure of personal data (“right to be forgotten”) under certain circumstances.
• Right to Restriction of Processing (Article 18): The right to obtain restriction of processing under certain circumstances.
• Right to Data Portability (Article 20): The right to receive your personal data in a structured, commonly used, and machine-readable format.
• Right to Object (Article 21): The right to object to processing based on legitimate interests or for direct marketing purposes.
• Rights Related to Automated Decision-Making (Article 22): The right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects you.

10.3 Rights Under Quebec Law 25

Residents of Quebec have additional rights under the Act Respecting the Protection of Personal Information in the Private Sector, as amended by Law 25, including the right to data portability, the right to de-indexation, and the right to be informed of automated decision-making. You may exercise these rights by contacting us.

10.4 How to Exercise Your Rights

To exercise any of the rights described above, please submit a written request to privacy@newtocanada.com. We will respond to your request within thirty (30) days of receipt, or within the timeframe prescribed by applicable law. We may require you to verify your identity before processing your request.

10.5 Complaints

If you believe that we have not adequately addressed your privacy concerns, you have the right to file a complaint with the Office of the Privacy Commissioner of Canada (OPC) at www.priv.gc.ca, or with the applicable provincial privacy commissioner or data protection authority in your jurisdiction.

11. International Data Transfers

Your personal information may be transferred to, stored in, and processed in countries other than Canada, including the United States of America, where our third-party service providers (including Google LLC and OpenAI, Inc.) maintain servers and processing facilities.

Where personal information is transferred outside of Canada, we ensure that appropriate safeguards are in place to provide a level of protection that is comparable to that required under PIPEDA. Where personal information is transferred outside of the EEA or the United Kingdom, we rely on appropriate transfer mechanisms, including Standard Contractual Clauses (SCCs) approved by the European Commission and the UK Information Commissioner’s Office, or other lawful transfer mechanisms under applicable data protection legislation.

12. Children’s Privacy

The Service is not directed to, and we do not knowingly collect personal information from, children under the age of sixteen (16). If we become aware that we have collected personal information from a child under the age of 16 without verification of parental consent, we will take steps to delete that information promptly. If you believe that we may have collected information from a child under 16, please contact us immediately at privacy@newtocanada.com.

13. Cookies and Tracking Technologies

We use cookies and similar technologies to operate and improve the Service. For detailed information about the types of cookies we use, the purposes for which we use them, and how you can manage your cookie preferences, please refer to our Cookie Policy.

14. Changes to This Privacy Policy

We reserve the right to modify or update this Privacy Policy at any time. We will notify you of material changes by posting the updated Policy on the Service with a revised “Last Updated” date, and where appropriate, by sending you an email notification or displaying a prominent notice within the Service. Your continued use of the Service after any such changes constitutes your acceptance of the revised Privacy Policy. We encourage you to review this Policy periodically.

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact our Privacy Officer at: