Privacy Policy

1. Accountability

1.1 We are responsible for the personal information under our control. We have designated a Privacy Officer who is accountable for our compliance with this Policy and with PIPEDA. You may reach the Privacy Officer at support@barpreppal.ca or by mail at the address in section 14.

1.2 BarPrepPal is not the Law Society of Ontario and is not affiliated with it. We do not receive examination results, candidate records or any other information from the Law Society. An examination result reaches us only if you choose to send it to us (see section 6).

2. Personal information we collect

We collect only the information we need to operate the Services, process payments, keep your results and handle the limited support requests the Services allow.

Account information. Your email address, the date you created your account and the date you last signed in. We do not use passwords: you sign in with a single-use link sent to your email address.

Purchase information. The product purchased, the amount, the currency, the date, the status of the payment and a payment reference and receipt link issued by our payment processor. Your card number, expiry date and security code are entered on and processed by the payment processor's secure page; we never receive or store them.

Study and results information. The examinations, sets and diagnostics you start; your answers; the time you spend on each question; your scores by subject area; and the dates you start and complete each attempt. We use this to deliver the Services and to show you your own results.

Free Repeat applications. If you apply for a free renewal after an unsuccessful examination, the copy of the official result you send us, showing your name, the examination, the sitting and the result, together with our record of the decision.

Support correspondence. The content of emails and messages you send to us, and our replies.

Technical information. Your IP address, browser and device type, the pages you request and the time of each request, as recorded in the ordinary server logs of our hosting provider, and the first-party usage events described in section 7.

Free Diagnostic use without an account. If you start a Free Diagnostic without signing in, we store your progress against a random identifier kept in a cookie in your browser (see section 7). If you later create an account in the same browser, that progress is attached to your account.

We do not collect your Law Society candidate number, your social insurance number, your date of birth or copies of identification.

3. How we use personal information

We use personal information for the following purposes:

(a) to create, secure and administer your account and to sign you in;

(b) to deliver the products you purchase and to record, grade and display your attempts and results;

(c) to process payments, issue receipts and keep the records required by tax and accounting law;

(d) to send transactional messages that are part of the Services: sign-in links, purchase receipts, a summary of your results after an examination is graded (which you can turn off in your account), and messages about a Free Repeat application;

(e) to decide a Free Repeat application and to keep a record of the decision;

(f) to respond to your support requests;

(g) to detect and prevent account sharing, copying of our content, fraud, security incidents and other misuse, and to enforce our Terms of Use;

(h) to operate, maintain, secure and improve the Site and the Services, using aggregated or de-identified information wherever practicable; and

(i) to comply with legal obligations and respond to lawful requests from public authorities.

We do not sell personal information. We do not share it with advertisers or data brokers. We do not use it to train artificial-intelligence or machine-learning models, and we do not permit our service providers to do so.

4. Consent

4.1 By creating an account, making a purchase, submitting a Free Repeat application or contacting us, you consent to the collection, use and disclosure of your personal information for the purposes described in this Policy. We obtain express consent for any use that is not necessary to provide the Services.

4.2 You may withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice, by contacting us. Withdrawing consent for a use that is necessary to provide the Services (for example, keeping your email address) may mean we are unable to continue providing them.

4.3 Marketing. We send marketing messages only with your express consent, which is sought separately from your account registration and is never pre-selected. Every marketing message contains an unsubscribe mechanism. Transactional messages described in section 3(d) are part of the Services and do not require marketing consent.

5. Disclosure and service providers

5.1 We disclose personal information only to service providers who process it on our behalf, under written terms that restrict their use of it to providing their services to us. Our current providers are:

• Vercel Inc. (United States): hosting of the Site and server logs.
• Neon, Inc. (United States): the database in which account, purchase and study information is stored.
• Stripe, Inc. (United States, with Canadian operations): payment processing and receipts. Stripe's own privacy policy applies to the information you enter on its payment page.
• Resend (United States): delivery of transactional email.

5.2 These providers store and process information on servers located in the United States. While your information is outside Canada it is subject to the laws of that jurisdiction, including laws that permit access by courts, law enforcement and national security authorities. We take contractual and technical measures appropriate to the sensitivity of the information to protect it wherever it is processed.

5.3 We may also disclose personal information: where required or permitted by law, including to comply with a subpoena, warrant or court order; to protect our rights, property or safety or those of our users or the public; to a professional adviser bound by confidentiality; or to a successor in connection with a merger, acquisition, financing or sale of all or part of our business, in which case the information will remain subject to this Policy or one that offers equivalent protection.

6. Free Repeat applications

6.1 A copy of an examination result that you send us to support a Free Repeat application is used only to decide that application and to keep a record of the decision. Access to it within BarPrepPal is limited to the people who need it for that purpose. We do not add it to any marketing list, publish it or share it with any third party other than our hosting and email providers in the ordinary course of storing and receiving it.

7. Cookies, local storage and analytics

7.1 Strictly necessary cookies. The Site uses a small number of first-party cookies that are necessary for it to work: a session cookie that keeps you signed in; a short-lived cookie used during the email sign-in process; a cookie holding a random identifier that keeps your progress in a Free Diagnostic started without an account; and a cookie that protects forms against cross-site request forgery. These cannot be disabled without preventing the Site from working.

7.2 No third-party or advertising cookies. We do not use advertising, remarketing or social-media cookies, and we do not embed third-party analytics scripts. Our payment processor may set its own cookies on its payment page under its own privacy policy.

7.3 First-party usage analytics. To understand how the Site is used, we record a limited set of usage events on our own servers (for example, that a page was viewed, a diagnostic was started, an examination was graded or a package was viewed). These events are tied to your account if you are signed in and are not shared with any third party. They are not used for advertising.

7.4 Browser storage and caching. The Site may store small amounts of non-personal information in your browser's local storage (for example, a remembered preference) and may cache pages and assets in your browser to improve performance. You can clear this information at any time through your browser settings.

7.5 Do Not Track. Because we do not track users across other websites, the Site does not respond differently to browser "Do Not Track" signals.

8. Retention

We keep personal information only as long as necessary for the purposes described in this Policy and as required by law:

• Account, study and results information: for as long as your account is active and for up to twenty-four (24) months after it is closed, so that we can respond to a late Free Repeat application or a dispute.
• Purchase and payment records: seven (7) years after the transaction, as required by Canadian tax law.
• Free Repeat applications: until the application is decided and for twenty-four (24) months thereafter.
• Support correspondence: for as long as needed to resolve the matter and for twenty-four (24) months thereafter.
• Server logs and usage events: up to twelve (12) months.

When a retention period ends we delete or irreversibly de-identify the information, unless the law requires us to keep it or it is relevant to an ongoing dispute or investigation.

9. Safeguards

9.1 We protect personal information with administrative, technical and physical safeguards appropriate to its sensitivity, including encryption of data in transit (TLS) and at rest, access controls that limit personal information to those who need it, email-link authentication with single-use, time-limited links, security headers on the Site, and logging of administrative actions.

9.2 No method of transmission or storage is completely secure. You are responsible for keeping the email account you use to sign in secure and for the security of the devices you use.

9.3 If a breach of security safeguards involving your personal information creates a real risk of significant harm to you, we will notify you and the Office of the Privacy Commissioner of Canada as PIPEDA requires.

10. Your rights

10.1 Access and correction. You may request access to the personal information we hold about you and ask us to correct information that is inaccurate or incomplete. You can see and change your email preferences on your Account page. For other requests, write to the Privacy Officer from the email address on your account. We will respond within thirty (30) days, or inform you if more time is needed as PIPEDA permits. We may need to verify your identity before responding.

10.2 Limits. We may refuse or limit access where PIPEDA permits, for example where the information is subject to solicitor-client privilege, would reveal confidential commercial information or personal information about another person, or was collected in the course of an investigation of a breach of an agreement or a law. We will tell you the reason for any refusal and that you may complain to the Office of the Privacy Commissioner of Canada.

10.3 Account closure. You may close your account at any time by contacting us. Closing an account does not erase records we are required to keep for tax, legal or dispute-resolution purposes, as described in section 8.

10.4 Withdrawal of marketing consent. You may unsubscribe from marketing messages at any time through the link in each message or by contacting us.

11. Children

11.1 The Services are intended for adults preparing for a professional licensing examination. We do not knowingly collect personal information from anyone under 18. If you believe a person under 18 has provided us with personal information, please contact us and we will delete it.

12. Links to other sites

12.1 The Site may contain links to third-party websites, including our payment processor's checkout page. This Policy does not apply to those sites, and we are not responsible for their privacy practices. We encourage you to read their privacy policies.

13. Changes to this Policy

13.1 We may update this Policy from time to time. The updated Policy will be posted on the Site with a new "Last updated" date. Where a change materially expands how we use personal information already collected, we will seek your consent as PIPEDA requires. Your continued use of the Services after an updated Policy is posted constitutes acceptance of it for uses that do not require fresh consent.

14. Questions and complaints

14.1 If you have a question or concern about this Policy or our handling of your personal information, please contact our Privacy Officer first:

Privacy Officer, BarPrepPal
Truepoint One Inc.
6471 Kister Road, Niagara Falls, Ontario L2G 0B8
Email: support@barpreppal.ca

14.2 If we are unable to resolve your concern, you may contact the Office of the Privacy Commissioner of Canada at www.priv.gc.ca or 1-800-282-1376.