Privacy Policy
1. Introduction
Migrawise ("we", "us", or "our") is committed to protecting the privacy and security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Migrawise platform ("Service").
This policy applies to all users of the Service, including immigration practitioners (firm owners and staff) and their clients who access the platform through the client portal. By using the Service, you consent to the practices described in this policy.
We comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation. Where provincial privacy laws provide stronger protections, those laws take precedence.
2. Data Collected
We collect the following categories of information:
Personal Information
- Full name, email address, phone number, and mailing address
- Professional credentials (RCIC membership number, Law Society membership details)
- Firm name and business contact information
Case and Client Data
- Immigration case details, including case type, status, and applicant information
- Documents uploaded to the platform (identification documents, supporting letters, forms)
- Questionnaire responses and intake form submissions
- Communication records between practitioners and clients within the platform
- Electronic signature records and signed documents
Financial Information
- Invoicing records and payment history (payment card details are handled directly by Stripe and are never stored on our servers)
Usage and Technical Data
- Log data including IP address, browser type, operating system, and access times
- Device information and screen resolution
- Pages visited, features used, and actions taken within the platform
- Error logs and performance metrics
3. How Data Is Used
We use the information we collect for the following purposes:
- Service delivery: To provide, maintain, and improve the Migrawise platform, including case management, document storage, client portal access, and all core features
- Communication: To send you service-related notifications, including account updates, security alerts, billing notices, and feature announcements
- AI features: To power AI-assisted case analysis and document review. Data sent to AI services is anonymized to remove personally identifiable information
- Platform improvement: To understand how the Service is used, identify technical issues, and develop new features based on usage patterns
- Security: To detect, prevent, and respond to fraud, abuse, and security incidents
- Legal obligations: To comply with applicable laws, regulations, legal processes, or governmental requests
We do not sell your personal information to third parties. We do not use your data for advertising purposes.
4. Data Storage
We take the security of your data seriously and employ industry-standard measures to protect it:
- Location: All data is stored on servers located within Canada. We do not transfer data outside of Canada without your explicit consent
- Encryption at rest: All sensitive data, including documents and personal information, is encrypted at rest using AES-256 encryption
- Encryption in transit: All data transmitted between your device and our servers is protected using TLS 1.2 or higher
- Tenant isolation: Each firm's data is logically isolated at the database level. Multi-tenant architecture ensures that no firm can access, view, or modify another firm's data
- File storage: Uploaded documents are stored outside the web-accessible directory and are accessible only through authenticated API requests with proper authorization
- Access controls: Role-based access controls ensure that users can only access data appropriate to their role within the firm
5. Third Parties
We share data with the following third-party service providers, strictly as necessary to deliver the Service:
- Stripe (payments): When you make or receive payments through the platform, your payment information is processed directly by Stripe. Stripe is PCI-DSS Level 1 certified. We share only the minimum information necessary to process transactions (amount, currency, customer identifier). We do not have access to your full credit card number.
- Anthropic (AI features): AI-powered features such as case analysis and document review use Anthropic's Claude API. We anonymize queries before sending them to ensure no personally identifiable information is transmitted. AI interactions are not used to train third-party models.
- Hosting provider: Our infrastructure provider hosts the servers and databases that run the Migrawise platform. The hosting provider operates Canadian data centres and is bound by data processing agreements that require compliance with PIPEDA.
We do not share your personal information with any other third parties except when required by law or with your explicit consent.
6. Your Rights Under PIPEDA
Under the Personal Information Protection and Electronic Documents Act (PIPEDA), you have the following rights regarding your personal information:
- Right to access: You may request a copy of the personal information we hold about you. We will respond to access requests within 30 days
- Right to correction: You may request that we correct any inaccurate or incomplete personal information. You can also update most information directly through your account settings
- Right to deletion: You may request that we delete your personal information, subject to any legal obligations that require us to retain certain data
- Right to withdraw consent: You may withdraw your consent for the collection, use, or disclosure of your personal information at any time, subject to legal or contractual restrictions. Withdrawal of consent may limit your ability to use certain features of the Service
- Right to complain: If you are not satisfied with how we handle your personal information, you have the right to file a complaint with the Office of the Privacy Commissioner of Canada (OPC) at www.priv.gc.ca
To exercise any of these rights, please contact our Data Protection Officer at the email address provided in the Contact section below.
7. Data Retention
We retain your data according to the following schedule:
- Active accounts: Your data is retained for as long as your account is active and you continue to use the Service
- Deleted accounts: When you delete your account or request data deletion, your data remains accessible for a 30-day grace period to allow for data export. After this period, your data is permanently purged from our systems, including all backups, within 90 days
- Legal hold: Electronically signed documents and their associated audit trails may be retained for up to seven (7) years to comply with legal requirements and to preserve the evidentiary value of signed agreements
- Anonymized data: Aggregated, anonymized usage statistics that cannot be linked to any individual may be retained indefinitely for platform improvement purposes
9. Data Breach Notification
In the event of a security breach that results in unauthorized access to, or disclosure of, personal information under our control, we will:
- Assess the breach to determine if it creates a real risk of significant harm to affected individuals, as required under PIPEDA's mandatory breach reporting provisions
- Notify affected users within 72 hours of confirming a breach that poses a real risk of significant harm, providing details of the breach, the type of information involved, and recommended steps to protect themselves
- Report the breach to the Office of the Privacy Commissioner of Canada (OPC) as required by law
- Maintain records of all breaches, including those that do not meet the reporting threshold, for a minimum of 24 months
- Take immediate steps to contain the breach, investigate its cause, and implement measures to prevent recurrence
10. Children's Privacy
The Migrawise platform is designed for use by immigration professionals and their adult clients. The Service is not intended for use by individuals under the age of 18.
We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a child under 18 without appropriate parental consent, we will take steps to delete that information promptly.
Note: Immigration cases may involve minor applicants. In such cases, personal information about minors is entered and managed by the authorized immigration practitioner or a parent/guardian, not by the minor directly.
11. International Transfers
Migrawise stores and processes all data within Canada. We do not transfer personal information to servers or service providers located outside of Canada.
If a future need arises to transfer data internationally (for example, to support users in other jurisdictions), we will:
- Obtain your explicit consent before any cross-border transfer
- Ensure that the receiving jurisdiction provides an adequate level of data protection
- Implement appropriate contractual safeguards, such as data processing agreements, to protect your information
- Update this Privacy Policy to reflect any changes in our data transfer practices
12. Changes to This Policy
We may update this Privacy Policy from time to time. When we make changes:
- We will provide at least thirty (30) days' advance notice via email to the address associated with your account
- The updated policy will be posted on this page with a revised "Last updated" date
- For significant changes that affect how we collect, use, or share your personal information, we will seek your renewed consent where required by PIPEDA
We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.
13. Contact
If you have questions about this Privacy Policy, wish to exercise your privacy rights, or have concerns about how your personal information is handled, please contact our Data Protection Officer:
Migrawise Data Protection Officer
Email: privacy@migrawise.com
If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada:
Office of the Privacy Commissioner of Canada
Website: www.priv.gc.ca
Phone: 1-800-282-1376