Privacy Policy

This policy explains how Miles Rae, operating as Advirra ("Advirra", "we") handles personal information. Advirra provides a hosted CRM to Canadian financial advisory firms. Two very different kinds of personal information flow through our business, and this policy treats them separately:

• Platform data — information about the people who deal with us: visitors to advirra.com, firm contacts who sign up, and billing contacts. For this data, Advirra decides purposes and means (we act as the organization accountable under PIPEDA).
• Customer instance data — information that advisory firms (our customers) place in their own CRM instances about their clients, including contact details, dates of birth, Social Insurance Numbers, and know-your-client records. For this data we act strictly as a service provider processing on the firm's instructions. The firm is the organization accountable to its clients; individuals should direct requests about this data to their advisory firm. Our handling of it is governed by our contracts with firms (Terms of Service and Data Processing Addendum), summarized in Section 5.

1. Platform data we collect

Category	Examples	Source
Signup and account data	firm name, contact name, business email, province, estimated seats	signup form
Billing data	billing contact, billing address, tax status; payment card details are collected and stored by Stripe, not by us	checkout
Support data	tickets, emails to support, in-app feedback	you
Operational logs	authentication events, audit trails of administrative actions, IP addresses, technical logs	automatic
Website analytics	page views and events, collected only with consent where required	advirra.com

We collect platform data directly, and we deliberately collect the minimum needed to vet, onboard, bill, and support firms.

2. Why we use platform data

• To assess and approve signups (we serve Canadian firms only and vet each application).
• To provision, operate, secure, and support each firm's instance.
• To bill (through Stripe) and maintain business records.
• To communicate service, security, and legal notices.
• To meet legal obligations.

We do not sell personal information. We do not use customer instance data for marketing, analytics, or model training.

3. Where data lives

All Service data — platform database, customer instance databases, file storage, and backups — is hosted in the AWS Canada (Central) region (ca-central-1). Limited platform data leaves Canada only where a listed service provider requires it (notably Stripe for payment processing); see the subprocessor list in the DPA.

4. Who we share platform data with

Only with the service providers needed to run Advirra, under contracts limiting their use of it:

• Amazon Web Services — hosting (Canada Central).
• Stripe — payment processing and tax calculation.
• GitHub — source code hosting; no customer personal information is stored there.
• Push notification provider ntfy (ntfy.sh) — operational alerts to Advirra staff; alert content is limited to system identifiers, never client personal information.

We disclose personal information to authorities only where required by law, and we notify the affected firm unless legally prohibited.

5. Customer instance data — how we protect it as a service provider

• Each firm's instance is isolated: dedicated application container, dedicated database with unique credentials, dedicated file storage, dedicated encryption key.
• Sensitive identity fields (e.g. Social Insurance Numbers) are encrypted at the field level with the firm's dedicated key, in addition to encryption at rest and in transit.
• Advirra staff have no standing access to instance databases. Access requires a break-glass procedure: a recorded reason, time-boxed credentials, automatic revocation, and an audit trail.
• Every administrative change in an instance is captured in that firm's own audit log, visible to the firm.
• We process instance data only to provide the Service (hosting, backup, support the firm requests, and legally required processing) and delete it on the schedule in our Terms (60-day export window after cancellation, then deletion with confirmation available).

6. Retention

Data	Retention
Customer instance data	Life of the subscription + 60-day export window, then deleted (backups expire on their schedule, ≤ 35 days after deletion)
Signup applications (rejected)	12 months, then deleted
Billing records	7 years (tax and audit obligations)
Support tickets	Life of the customer relationship + 24 months
Operational/audit logs	24 months

7. Your rights

For platform data, you may request access to, correction of, or (where applicable) deletion of your personal information, withdraw consent where consent is the basis for processing, and ask questions or complain — first to our Privacy Officer (below), and if unsatisfied, to the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d'accès à l'information.

For customer instance data, contact your advisory firm; we support firms in fulfilling these requests.

8. Breach notification

We maintain an incident-response process under which confirmed breaches of security safeguards involving personal information are assessed for real risk of significant harm; where the threshold is met we notify affected firms without undue delay and support their notifications to individuals, the Privacy Commissioner of Canada (PIPEDA) and, where Quebec residents are affected, the Commission d'accès à l'information (Law 25). We keep a register of all breaches regardless of severity.

9. Cookies and analytics

advirra.com uses only the cookies needed to operate (session, security) and — with consent where required — privacy-respecting analytics. The CRM application itself uses only functional cookies (authentication sessions); it contains no advertising or cross-site tracking.

10. Privacy Officer

Advirra's designated Privacy Officer (Law 25: "person in charge of the protection of personal information") is:

Miles Rae privacy@advirra.ca

The Privacy Officer is responsible for this policy, privacy impact assessments (see docs/compliance/law25-checklist.md), breach response, and handling requests and complaints.

11. Changes

We will post changes here with a new version number and effective date, and give firms at least 30 days' notice of material changes.