Privacy Policy | ExamCAN

Last updated: April 2026

We collect the minimum necessary to run a study tool. We never share your data with immigration authorities. You can export or delete your data at any time.

Data We Collect

Email address (for account creation), quiz scores and progress data, and locale/province preference. We do NOT collect immigration status, UCI numbers, or application details.

How We Use Your Data

To provide personalized progress tracking, administer the pass guarantee program, and improve our question bank. We never sell your data.

Immigrant Data Protection

We will NEVER share your data with immigration authorities, law enforcement, or any government agency unless required by law.

Your practice test scores and study data cannot be used against your citizenship application.

Data Retention

Quiz attempts and progress data: retained while your account is active, then deleted 12 months after the last sign-in. Account deletion requests are honoured within 30 days. Server logs (IP, user-agent) are retained for 30 days for abuse prevention, then purged.

Your Rights

Under PIPEDA (Canada), you have the following rights:

Access: request a copy of all data we hold about you.
Correction: ask us to fix incorrect or out-of-date information.
Deletion: request that we erase your account and all associated data.
Portability: receive your data in a machine-readable format (JSON).
Withdraw consent: withdraw consent from optional features at any time; account deletion removes all associated data within 30 days.
Complain: to the Office of the Privacy Commissioner of Canada (priv.gc.ca) if you believe we have mishandled your data.

Exercise your rights

Email support@examcan.ca with the subject "Data request", or use the contact form. We respond within 30 days.

Third-Party Processors

We use the following sub-processors to operate the service. Each is bound by a Data Processing Agreement.

Name	Purpose	Region
Supabase	Database and authentication	Canada (ca-central-1)
Cloudflare	Hosting and content delivery (Workers)	Global edge (closest to user)
Stripe	Payment processing	United States, Ireland
Resend	Transactional email (sign-in, contact replies)	United States
Upstash	Rate limiting (anonymised IP hashes)	United States
Umami	Cookieless aggregate usage analytics (no personal data collected)	European Union (Umami Software, Inc.)

PIPEDA Compliance

We comply with the Personal Information Protection and Electronic Documents Act (PIPEDA). You may request access to, correction of, or deletion of your data by emailing support@examcan.ca.

Cookies

We use essential cookies for authentication only. For analytics we use Umami, a privacy-friendly, cookieless tool: it collects no personal data and sets no cookies. Because Umami requires no consent, there is no analytics opt-out banner. We do not use advertising or cross-site tracking cookies.

Data Residency

Primary data is stored in Canada (Supabase ca-central-1). Some sub-processors operate in the United States and may process data there under standard contractual clauses.

Contact

Privacy questions: support@examcan.ca. We do not have a designated DPO; the founders handle privacy requests directly.