Privacy Policy

• Account details: your name, email address and a hashed password, plus your account role (student or administrator).
• Enrollment and payment records: the courses you are enrolled in, start and expiry dates, and the payment reference returned by our payment processor. We never see or store your full card number.
• Learning progress: chapters viewed and completed, flashcard and practice activity, and reading positions so that you can resume where you left off.
• Mock-exam attempts: the questions served, your answers, timings, scores and review activity for each attempt.
• Access and security logs: sign-in attempts, pages and protected documents opened, video sessions, the time of each event, your browser type, and the network (IP) address of the request. For sign-in and password-reset throttling the address is held together with the email address for a short window (minutes to an hour) and appears in our server logs only as a one-way hash; protected-content viewing sessions keep the address and browser type so that suspected sharing can be investigated.
• Support correspondence: anything you send to our support mailbox.

We do not collect patient information and ask that you never enter any into the portal.

• to create and secure your account and sign you in;
• to provide the courses you have purchased and track your progress;
• to run, score and let you review mock examinations;
• to take payment and keep the financial records the law requires;
• to protect our content and other students, including detecting account sharing, redistribution and attacks on the portal;
• to answer your questions and send essential service emails such as password resets and enrollment notices;
• to meet our legal obligations.

We rely on your consent and on the need to perform our agreement with you. We do not sell personal information and do not use it for third-party advertising.

We use a small number of service providers who process information only on our instructions and under contract:

• Supabase — database, authentication and file storage for the portal (account, enrollment, progress, exam and access-log records; course files).
• Vercel — hosting and delivery of the portal application and its server logs.
• Stripe — payment processing. Stripe collects your card details directly under its own privacy policy; we receive only a payment reference, amount and status.
• Resend — delivery of service emails such as password-reset links.
• Video DRM provider — secure, licensed playback of course videos, when protected video playback is enabled. The provider receives a short-lived playback token, the network (IP) address of the device playing the video, a pseudonymous account code that is shown as a moving watermark on the video, and technical playback data; it does not receive your name or email.[OWNER TO CONFIRM]

In practical terms, this is what each provider receives. Stripe receives your name, email address and payment details when you pay, and shares the payment reference, amount and status with us. Supabase hosts the database that holds your account, enrollment, progress, mock-exam and access-log records, and sends our sign-in and password-reset emails. Vercel serves the portal and sees the network address of each request in its short-lived server logs. Resend receives your email address and the content of the service emails we send you. When protected video playback is enabled, the video DRM provider (VdoCipher) receives the network (IP) address of the device playing the video and a pseudonymous account code used for the on-screen watermark, never your name or email. Anything you send to our support mailbox is held in that mailbox.[OWNER TO CONFIRM]

We disclose personal information to others only when the law requires it or to protect our rights, our students or the public.

The academy is based in Canada. Our primary database and file storage are hosted in a Canadian region[OWNER TO CONFIRM]. Some of our providers, including Vercel, Stripe, Resend and the video DRM provider, operate from or route data through the United States and other countries. While information is outside Canada it is subject to the laws of those countries, and authorities there may be able to access it under their own legal processes. We choose providers with recognised security practices and contractual commitments, and we limit what each one receives to what its service needs.

We keep account, enrollment, progress and mock-exam records for as long as your account is open, and for up to 365 days[OWNER TO CONFIRM] after your last enrollment ends or your account is closed, whichever is later; deletion or de-identification of those records is carried out by the academy under its internal privacy procedure and is not yet automated. Access and security log records are currently retained. We have set a retention period of 365 days for them, which will apply once their scheduled deletion is activated; until then those records are kept and are not deleted automatically. Payment records are kept for the period required by Canadian tax law (currently seven years). Encrypted backups are rotated on a schedule and may hold a copy for a short time after deletion from the live database[OWNER TO CONFIRM]. Hosting and email provider logs are retained by those providers for their own short operational periods.

The portal sets only essential cookies: the authentication cookies that keep you signed in and protect your session. They are first-party, are marked secure and HTTP-only, and expire when your session ends or you sign out. We do not use advertising, tracking or third-party analytics cookies, so no cookie banner or consent choice is needed. Blocking these cookies will prevent you from signing in.

Information is encrypted in transit and at rest, access to it is limited by role and database-level policies, administrative actions and protected-content access are logged, and passwords are stored only as salted hashes. No system is perfectly secure; if we become aware of a breach that creates a real risk of significant harm, we will notify you and the Privacy Commissioner as the law requires.

You may ask to see the personal information we hold about you, ask us to correct it, withdraw consent (which may mean we can no longer provide the course), or ask us to close your account and delete your information subject to the retention rules above. Write to support@spreadasmileacademy.ca; we aim to respond within 30 days. You may also complain to the Office of the Privacy Commissioner of Canada or the Office of the Information and Privacy Commissioner for British Columbia.[OWNER TO CONFIRM]

We may update this policy. The version and effective date are shown at the top of this page.