Privacy Policy

Information we collect

• Account and profile information: name, email, password (hashed), contact details, and profile fields you provide.
• Immigration profile: the answers you give during onboarding and the interview, such as your country of origin, current status in Canada and its expiry date, age, education, language levels, work experience (including your occupation code and months worked in Canada, if you add them), settlement funds, job offer, family composition and whether your partner is a Canadian citizen or permanent resident, plus the text you type in reply to questions. If you choose to, also your official language test scores, the CRS score shown in your IRCC Express Entry profile, and the date you submitted your application and IRCC's decision. If you're sponsoring a family member: who you'd sponsor, your status in Canada and whether you live here, your relationship and how long you've lived together, whether you were sponsored as a spouse or partner yourself, your child's age, and, if you choose to, your family size and household income range. We use these only to check IRCC's rules for you. We never ask about criminal records, social assistance or past refusals.
• What IRCC asked you for: if you record them after applying, the kind of request (for example biometrics or a medical exam), the date IRCC asked, its due date, and whether you've done it. We use these only to remind you before the due date. They are not sent to our AI provider.
• Document checklist: for each document on your checklist, the status you choose (for example, “Ready” or “Doesn't apply”), an expiry date if you add one, and the names of any items you add yourself. We do not accept uploaded files, and we do not store copies of your documents, document numbers, or notes about them.
• Partner clicks: when you click a partner offer, the offer, where you clicked it, the time, a one-way hash of your IP address, your browser's user agent and the referring page. See “Partner offers and click tracking” below.
• Technical data: our hosting provider records your IP address and browser details in its server logs. We don't store your IP address itself: we keep only a one-way hash of it, to limit repeated attempts (for example sign-ins and password resets), record where you accepted our Terms, and count partner clicks. If you accept analytics, Google Analytics records how you use the site (see “Cookies and tracking”); we don't use advertising tools. If something breaks, our error monitoring records technical details about the error and your account ID, without your name or email address.
• Days you use your account: the dates you open NewcomersPath while signed in, and whether you came from one of our emails. We use them only to see whether NewcomersPath is useful enough for families to come back. They are never shared or used for advertising.
• Communications: messages, support requests, and other communication you send through the platform.

How we use your information

We use the information to:

• Provide, operate, and improve NewcomersPath features and services.
• Show your document checklist and progress, and remind you before a date you recorded (your status expiring, a document expiring, or something IRCC asked for): in the app, and by email if you turned on deadline reminders.
• Ask you once, after you've used NewcomersPath for a while, whether you'd like to leave a public review. We record only that we asked, never what you wrote.
• Watch official IRCC sources for changes that affect the path you chose, and list them in your account. If you turn on check-in emails (Premium), we email you when there is something new.
• Communicate updates, security alerts, and support responses.
• Personalize recommendations and guidance relevant to settling in Canada.
• Analyze usage and performance to enhance the product.

How we use AI

To suggest immigration paths that fit your family, check whether a new answer changes them, and write your tasks, we send your immigration profile answers to our AI provider, Anthropic, which processes them on our behalf. This happens during onboarding too, before you create an account. The interview questions themselves are written in advance, not generated by AI. We do not send your name, email address or account details. The results are information to help you understand your options, not legal advice.

Anthropic does not use what we send to train its models. It deletes it within 30 days, except content its safety systems flag as possibly violating its usage policy, which it may keep for up to two years to enforce that policy. See Anthropic's retention policy and training policy. Anthropic processes this data in the United States.

Partner offers and click tracking

We show offers from partners such as banks and insurers, and we earn a commission when you use one (see How we make money). When you click an offer we record the click as described above and pass the partner a random reference number, so they can tell us if you became their customer and the commission owed. We do not give partners your name, email address or immigration profile. Anything you give a partner directly is covered by their own privacy policy. You can dismiss any offer in the app, and partner offers by email are off unless you turn them on in your email preferences.

People you share your family with

With Premium you can invite up to two people, such as your spouse or your immigration representative, to your family with their own login. They see your family's answers, path, tasks, document checklist and path updates. They can also change them, unless they only have view access, but they can't see your billing or download your data. We keep a record of each invitation and of each change they make. You can remove anyone at any time in Settings, and they can leave whenever they like.

Emails

We send account and security emails as needed. Deadline reminders, check-in emails and partner offers by email are optional: they are off until you turn them on, every one has an unsubscribe link, and you can change them at any time in your email preferences.

Cookies and tracking

We use essential cookies and browser storage to keep you signed in and save your answers. Only if you accept analytics, we also use Google Analytics (through Google Tag Manager) to see which pages you visit, how far you scroll, which buttons you use and which steps of the journey you reach, so we can improve the site. It never receives your answers, your name, your email or anything you type; for the path you choose, it only learns its broad type (for example “family sponsorship”). Nothing loads before you accept, and you can change your choice at any time from the Cookie Policy or the site footer. We use no advertising cookies and share nothing for advertising. Google keeps this analytics data for 14 months. For details see our Cookie Policy.

How long we keep it, and security

• Your account, answers, tasks and checklist: until you delete your account. They are then removed permanently after a 30-day grace period in which you can change your mind.
• Where you accepted our Terms (a hashed IP address and the date): as long as your account exists, as a record of your consent.
• Partner clicks: the click record is kept for commission accounting. Its hashed IP address and browser details are removed after 90 days.
• Counts used to limit repeated attempts: deleted when their time window ends, within a day.
• The days you used your account: deleted after 13 months.
• Password reset records and usage records for visitors without an account: deleted after 90 days.
• Our hosting provider's server logs: kept for a short period under the provider's own policies.
• Payment records: kept by Stripe, and by us as required by tax law.

We use administrative, technical and physical safeguards to protect your information, such as encryption in transit, access limited to people who need it, and hashed passwords. No system is completely secure. If a breach creates a real risk of significant harm, we will notify you and the Privacy Commissioner of Canada (and, for Quebec residents, the Commission d'accès à l'information).

Third-party services

We use service providers that act on our behalf and are contractually required to protect your information:

• Vercel (website hosting)
• TiDB Cloud by PingCAP (database)
• Anthropic (AI processing, described above)
• Stripe (payments; we never see or store your full card number)
• Resend (sending email)
• Sentry (error monitoring, configured not to collect personal identifiers by default)
• Google (Google Analytics and Google Tag Manager, only if you accept analytics)

Some of these providers store or process data outside Canada, including in the United States, where it may be accessible to authorities under local law.

Your rights

You can download a copy of your data and delete your account from your account settings. A deleted account is removed permanently after 30 days. Depending on your jurisdiction, you may have further rights to access or correct your personal data. To exercise these rights, contact us at support@newcomerspath.ca.

Children

NewcomersPath is for adults: you must be 18 or older and have reached the age of majority where you live (19 in some provinces). Children usually immigrate as dependants on a parent's application, so a parent can include them in their own family profile. We do not knowingly collect personal information directly from minors. If you believe a minor has given us information, contact us and we will delete it.

Person responsible for your personal information

Our founder is responsible for protecting personal information at NewcomersPath and answers privacy questions and requests. Reach them at support@newcomerspath.ca with “Privacy” in the subject line. We reply within 30 days. If you're not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d'accès à l'information.

Contact

If you have questions about this Privacy Policy or our practices, contact us at support@newcomerspath.ca.