Privacy

Who we are and what this notice covers

Examstead is a brand of Investatech Inc.. This notice explains how we handle information when you visit examstead.ca, contact us, use a learner account or purchase a preparation package.

Access depends on the preparation package and your account’s entitlement. RCIC Entry-to-Practice Exam (EPE) preparation, IRB specialization preparation, RISIA preparation and the private BCIN review program are separate products. RISIA is available for purchase at C$149 plus applicable tax for 90 days. BCIN remains under review and is not open for public purchase. We will update this notice before introducing materially different uses of personal information.

Visits, cookies and choices

Vercel receives technical request information needed for page delivery, security and troubleshooting. Declining optional measurement does not disable those functions.

Cookies, local storage and session storage can keep information on your device. Necessary functions support sign-in, security and requested purchases. Visit measurement and remembering referrals stay off until you accept them. The page address determines language without a persistent language identifier.

Use “Cookie and privacy settings” in the footer of any page to accept, reject or change optional uses. Rejecting does not prevent reading free guides, signing in, buying or studying. Scrolling or continuing to browse does not give consent.

See our cookie and storage inventory, including Google, Stripe and Microsoft services.

Accounts and learning records

To provide your account, we process your email address, chosen language, authentication and confirmation records, password credentials handled by Supabase Auth, access dates and account security information. We do not receive your password by ordinary email. Your browser stores authentication session information in local storage so you can remain signed in; signing out clears the active session used by the app.

We save the study set and content version, your selected answers, flags, attempt and submission times, and results so you can resume practice and review explanations. We use these records to provide the learning experience, investigate defects and improve the service. A practice score is not a professional assessment or prediction of passing. Do not enter confidential client, building-project or payment records into study responses or review notes.

For the private owner and authorized subject-review workspaces, we store question and study-guide review notes, content decisions and confirmations, the reviewer’s account identifier, and event times to track content review. The selected two-step method and recent verification records protect changes to a review. These records are used to protect access and maintain the review history.

Preparation package purchases, discounts and refunds

Stripe processes enabled preparation package payments and collects the payment and billing information needed to complete a transaction and calculate applicable tax. Payment-card details are entered through Stripe, not through the Examstead contact form. We do not store your complete card number or security code in the Examstead learning database. Stripe’s Privacy Policy describes its processing, which may occur outside Canada.

We retain the learner and preparation package identifiers, the accepted offer and terms version, language, purchase and payment references, amounts, taxes, discount information, access dates, receipts and order confirmations, and refund or dispute records. These support access, customer service, fraud prevention and financial recordkeeping. When a billing name or address is needed for a receipt or tax calculation, it is used for those purposes. We track paid-question views and mock starts to administer the disclosed limited-use refund conditions.

Creating an account or buying a preparation package does not subscribe you to marketing. Expiry or cancellation ends the relevant preparation package entitlement; it does not automatically delete study, financial or audit records. Financial records are kept for applicable accounting, tax, dispute and legal obligations. You can ask about access, correction or deletion through the contact form.

Referral links, account attribution and financial records

A link can suggest a code for the current purchase journey without persistent storage. You can request application of a code without accepting optional measurement. Remembering the link for future visits requires your separate choice. Discounts and commissions remain subject to eligibility, confirmation before payment and program terms. Transaction and commission records have their own retention requirements.

Program records can include the referrer’s account identifier, legal payee name, country and eligibility confirmation, accepted terms version, date and language, referral code and status, purchase and discount references, commission calculations, refund or dispute adjustments, payout review notes, payment amounts and external payment references. These records support eligibility checks, calculations, abuse prevention, reconciliation and applicable reporting. Test balances are not real earnings. A referrer’s workspace does not receive buyers’ email addresses, credentials or study records.

These account-linked records are stored in the independent Canadian Supabase project. Administration and payout review are limited to authorized operators. Records remain while needed for administration, adjustments, disputes, accounting and legal obligations; a commission hold or access expiry is not a deletion deadline. Closing account access does not automatically erase financial or audit records that must be retained. Use the contact form to request access, correction or deletion information; do not send a social insurance number, banking credentials or identity documents through it. See the referral program terms.

Information you send us

The contact form collects your name, email address, selected enquiry topic, message, language and agreement to using these details to respond. Our server also receives a security-check token and uses temporary technical identifiers to limit abuse and duplicate submissions. We use your enquiry to respond, investigate a reported issue and keep relevant correspondence. The form does not accept file attachments. Please send only what is needed, and do not include passwords, payment-card details or confidential client or project records.

Submitting the contact form does not subscribe you to marketing. We do not sell personal information received through this website or its contact mailbox.

Sign-in options and two-step verification

You can use an enabled Google or Microsoft sign-in option instead of an Examstead password. The provider and Supabase exchange your account identifier, verified email address and basic profile information to authenticate you. We request identity access, not access to your messages, calendars or files. The provider applies its own privacy policy and may process information outside Canada. An existing account with the same verified email address may be linked to that sign-in identity.

Choose email verification codes or an authenticator app as your additional sign-in check. We retain your method preference, session identifiers, verification times and security limits. Email codes are delivered using AWS SES in Canada Central; our verification database stores a keyed hash rather than the readable code. Codes expire after ten minutes. Supabase Auth manages authenticator factors and their verification records. Changing your method requires verification and may sign you out of other sessions.

An authenticator app provides stronger separation from your email account. A code delivered to the same Google or Microsoft mailbox is an additional check, but does not provide an independent factor if that provider account is compromised. Fresh verification is required for sensitive actions, including review changes.

Expired email challenges and session-proof records are removed during later security activity for that account after they are more than a day old; expiry immediately prevents their use, but does not itself delete stored records. Method preferences and native factor records remain while needed for account security. You may request deletion through the contact form.

Service providers and location

Vercel hosts and delivers this website through its global network; the contact and authentication-email functions are configured for Montreal. AWS Simple Email Service in Canada Central sends your enquiry to our Examstead mailbox, which is provided by SiteGround. Temporary spam and duplicate-submission records are stored in AWS DynamoDB in Canada Central. Supabase in Canada Central stores learner accounts, access, learning and owner review records, including account security records. AWS SES in Canada Central sends account confirmation, password-recovery and security-code messages, and a separate DynamoDB table stores temporary authentication-email limits and delivery-status identifiers. Google provides reCAPTCHA. SiteGround also provides domain-name services. Website delivery, email handling, provider support and security operations may involve processing in Canada, the United States and other countries. Information processed in another country can be subject to that country’s laws.

We use service providers to operate the website and handle correspondence. We may also disclose information where required by law. If you follow an external link, the destination website receives your request and its own privacy policy applies.

The service uses an independent Examstead database. Canadian resource locations do not mean every processing step occurs in Canada: provider support, security, network delivery and your own email provider may process information elsewhere. We do not promise that every service or processing step will take place in Canada.

How long we keep information

We keep enquiry correspondence for as long as reasonably needed to address the enquiry, maintain relevant business records and meet applicable legal obligations. When information is no longer needed, we delete it or remove identifying details, subject to provider backup and recovery processes.

The contact form’s spam records contain keyed hashes derived from the network address, submission fingerprints, counters, delivery status and provider message identifiers, rather than a copy of the enquiry text. These records expire from active use within approximately two days; AWS’s automatic physical deletion can take several additional days. Website and provider operational records are retained according to their service settings and operational, security and legal requirements. Different records and backups may have different retention periods. Contact us if you need information about a particular record. We use technical records for operation, security and troubleshooting. Account and learning records are retained while needed to provide the service, maintain progress and investigate issues; access expiry does not automatically erase them. You can request deletion through the contact form. Private test data may be reset during development. This does not make paid customer records disposable. Provider backups can retain deleted records until their normal expiry. Authentication-email guard records store keyed identifiers, counters and status rather than email bodies, addresses or confirmation tokens; they expire from active use within seven days, with rate-limit counters expiring sooner. AWS’s automatic physical deletion can take several additional days.

Protecting information

We limit access to information to those who need it for the purposes described here and use account access controls and provider security features. No method of storage or transmission offers absolute security. Ordinary email is not a suitable way to send sensitive documents; contact us first if your enquiry requires a more appropriate channel.

Your choices and privacy enquiries

You can read this website without giving us your name or email address. You may ask what personal information we hold about you, request access or correction, or ask us to delete information we no longer need to keep. Requests are subject to applicable legal requirements. We may need to verify your identity, and we will explain any request we cannot fulfil.

For privacy questions, requests or complaints, use our contact form and select “Privacy request” to reach the person responsible for Examstead privacy. If your concern remains unresolved, the Office of the Privacy Commissioner of Canada provides information about available complaint options.

Updates to this notice

We will revise this notice as the service develops and show the date of the latest update. Where a new use requires consent or a separate notice, we will address that before beginning the new use.

Optional measurement and withdrawal

With permission, a random visit identifier and source, medium, campaign and preparation package labels can be linked to your account and an order. No third-party advertising tools are used. We do not retain the full referring URL in these records. A random identifier is not anonymous when linked to an account.

Withdrawal stops new measurement and removes visits and campaign attribution associated with this browser’s choice. In a signed-in, verified account, the application also requests removal of that account’s marketing links. This does not cancel purchases or referral commissions. Clearing browser data may remove our ability to locate records by that identifier; you can make a privacy request.

Retention and choice evidence

We remember your choice for 180 days. We record its version, time, language, selections and privacy signal under a protected identifier. History is limited to the latest 20 changes and removed after 365 days without a change. It contains no email address, sign-in token or card number.

Daily cleanup removes unlinked visits older than 90 days, all visits older than 180 days, and expired permissions from active measurement journeys. Order campaign attribution is retained for up to 365 days, subject to earlier withdrawal. Protected daily hashes used for security limits are removed after two days according to the cleanup schedule. Provider backups and logs have separate retention periods.

External services and help

Google reCAPTCHA loads at contact submission after you agree to its security check. Stripe and sign-in providers receive information when you request those services. Providers may process information outside Canada. Our Reject button does not clear cookies placed on their own websites. See the privacy policies of Google, Stripe and Microsoft, and our Privacy notice.

To exercise privacy rights or report a problem, use the contact form. If you cannot use Google verification, call +1 416-901-9115 or write to Investatech Inc., Privacy Officer, 100 Richmond Street West, Suite 308, Toronto, ON M5H 3K6, Canada. No account is required to make a request.