1. Scope & Application

This Privacy Policy applies to all personal information collected, used, or disclosed by Dvorce.ca through our website, calculation platform, and related services. By using our platform, you consent to the collection, use, and disclosure of your personal information as described in this policy.

This policy should be read in conjunction with our Terms of Service, which govern your use of the platform.

2. Information We Collect

A. Information You Provide Directly:

• Account Information: Name, email address, password (encrypted), and account preferences
• Financial Information: Income amounts, income sources, employment details
• Family Information: Dates of birth (for spouses and children), separation dates, cohabitation dates, province of residence
• Case Data: Case names, scenario names, notes, and calculation parameters
• Payment Information: Credit card details (processed securely by Stripe), billing address, transaction history
• Support Communications: Information provided when contacting our support team, including email correspondence and attached documents
• Uploaded Documents: Financial documents you upload, such as Notices of Assessment (NOAs), T4 slips, and Financial Statements (Form 8), for automated data extraction

B. Information Collected Automatically:

• Usage Data: Pages visited, features used, time spent on platform, calculation frequency
• Device Information: IP address, browser type and version, operating system, device identifiers
• Session Data: Login times, authentication tokens, session duration
• Analytics Data: Anonymized usage patterns collected via Google Analytics (see Section 6)

C. Information from Third Parties:

• OAuth Providers: If you sign up using a third-party authentication provider, we may receive your name, email, and profile information
• Payment Processors: Transaction status and payment confirmation from Stripe

3. How We Use Your Information

We use your personal information for the following purposes:

• Provide Services: Generate support calculations, create PDF reports, save and manage cases, and extract data from uploaded financial documents using AI-powered processing
• Account Management: Create and maintain your account, authenticate your identity, manage subscriptions
• Process Payments: Charge subscription fees, process refunds, maintain billing records
• Communications: Send service notifications, receipts, account updates, and respond to support inquiries
• Platform Improvements: Analyze usage patterns to improve features, fix bugs, and optimize performance
• Security & Fraud Prevention: Detect and prevent unauthorized access, abuse, and fraudulent activity
• Legal Compliance: Comply with court orders, regulatory requirements, and tax obligations
• Enforce Terms: Investigate violations of our Terms of Service and take appropriate action

Your Data Privacy Commitment:

We do NOT sell or rent your personally identifiable information to third parties. We do not use your personal data for marketing purposes unrelated to our services. We may share anonymized, aggregated data for research and industry analytics purposes (as described in Section 13), but this data cannot be used to identify you individually.

4. Legal Basis for Processing

We process your personal information based on the following legal grounds:

• Consent: You provide explicit consent when creating an account and using our services
• Contract Performance: Processing is necessary to fulfill our contractual obligations to provide calculation services
• Legitimate Interests: Platform improvements, security measures, and fraud prevention serve our legitimate business interests
• Legal Obligations: Retention of billing records and compliance with court orders are required by law

5. Data Residency & Canadian Jurisdiction

The "Canada-First" Promise: All your personal and financial data is stored exclusively on secure servers located within Canada.

Primary Storage: All data resides in Amazon Web Services (AWS) Canada Central region (ca-central-1). Your data never leaves Canadian jurisdiction for storage purposes.

Cross-Border Access: While data is stored in Canada, AWS employs technical and support staff globally who may have limited technical access to server infrastructure for maintenance, security, and support purposes. However:

• Your data is encrypted, and AWS personnel cannot access the contents without explicit authorization
• AWS is contractually bound to comply with Canadian privacy laws when processing Canadian data
• We only grant AWS support access when necessary for technical assistance (with your knowledge)

Backup & Disaster Recovery: Backups are stored in Canada and encrypted. No backups are transferred outside Canadian borders.

Document Processing Disclosure:

When you upload financial documents (such as NOAs, T4s, or Financial Statements) for automated data extraction, document content is transmitted securely to AWS AI services (Amazon Bedrock) for processing. Due to current regional availability of AI models, this processing may occur in AWS regions outside Canada (United States).

Important safeguards:

• Document data is transmitted securely via encrypted connections (TLS 1.2+)
• Processing is transient — your document content is not stored, retained, or used for model training by the AI provider
• All extracted data and original documents are stored exclusively in Canada (ca-central-1)
• AWS is contractually bound under its Data Processing Addendum to protect data during processing
• Only the document content necessary for extraction is transmitted; no account information, case data, or other personal details are included

If Canada-only AI processing becomes available in the future, we intend to migrate to eliminate cross-border transfer entirely. Document extraction is an optional feature — you can always enter your financial data manually without uploading documents.

6. Third-Party Services & Data Sharing

We share your information with trusted third-party service providers who assist us in operating the platform. All third parties are contractually required to maintain the same privacy and security standards.

Service Providers We Use:

• Amazon Web Services (AWS): Cloud hosting and infrastructure (Canada Central region). AWS Privacy Policy
• AWS Cognito: User authentication and identity management
• AWS Bedrock (AI Services): Document data extraction from uploaded financial documents (NOAs, T4s, Financial Statements). Processing may occur in US AWS regions. Data is transmitted securely and processed transiently — it is not stored or used for model training. See Section 5 for details.
• Stripe: Payment processing for subscriptions and transactions. Credit card data is never stored on our servers. Stripe Privacy Policy
• Google Analytics: Anonymized usage analytics to improve platform performance. We also collect anonymous feedback ratings submitted voluntarily on the results page; no personal information is included in feedback submissions. See Section 7 for cookie details. Google Privacy Policy
• Microsoft Clarity: Session replay and heatmap analytics to understand how users interact with the platform. Sensitive content, including financial input fields, is masked and not recorded in readable form. Clarity is only active when you consent to analytics cookies. Microsoft Privacy Statement

We May Disclose Information When:

• Required by law, court order, subpoena, or government investigation
• Necessary to protect our rights, property, or safety, or that of our users
• Related to a merger, acquisition, or sale of assets (with notice to affected users)
• You provide explicit consent for a specific disclosure

We do NOT sell, rent, or trade your personal information to third parties for marketing purposes.

7. Cookies & Tracking Technologies

We use cookies and similar tracking technologies to provide, secure, and improve our services. Cookies are small data files stored on your device that help us recognize you and remember your preferences.

Cookie Categories:

Our platform uses the following categories of cookies:

• Strictly Necessary: Required for authentication, session management, and core platform functionality. These cookies are essential to provide our services and cannot be disabled. Examples: authentication tokens (CognitoIdToken), session identifiers, security cookies.
• Analytics: Google Analytics cookies (_ga, _ga_*) and Microsoft Clarity cookies (_clck, _clsk) track anonymized usage patterns to help us understand how users interact with the platform and identify areas for improvement. These cookies do not collect personally identifiable information. Financial input values are masked in session replays.
• Marketing: Currently not in use. This category is reserved for future advertising or marketing-related cookies. If we introduce marketing cookies, you will be notified and asked for explicit consent.

Cookie Consent Mechanism:

When you first visit Dvorce.ca, you will see a cookie consent banner at the bottom of the page. This banner complies with PIPEDA and Quebec's Law 25 by providing equal-prominence options:

• Accept All: Enables all cookies, including analytics. This helps us improve the platform.
• Refuse Non-Essential: Only strictly necessary cookies are enabled. Analytics and marketing cookies are blocked.
• Manage Preferences: Opens a preferences modal where you can customize your consent for each cookie category individually.

Your choice is saved to your browser's local storage and will be respected on future visits. If you are logged in, your consent preferences are also saved to your account and synchronized across devices.

Google Consent Mode v2:

We implement Google Consent Mode v2, which allows Google Analytics to respect your privacy choices. When you refuse analytics cookies, Google Analytics operates in a privacy-enhanced mode that sends cookieless "pings" without setting tracking cookies or collecting personally identifiable information. This allows us to measure aggregate usage trends while fully respecting your privacy preferences.

Managing Your Cookie Preferences:

• Footer Link: Click "Cookie Preferences" in the footer of most pages, or manage your preferences from your account Settings.
• Browser Settings: You can also control cookies through your browser settings. Note that disabling strictly necessary cookies may limit platform functionality. Most browsers allow you to refuse cookies or delete existing cookies. Consult your browser's help documentation for instructions.
• Clear Consent: Clearing your browser's local storage or cookies will reset your consent preferences, and you will see the banner again on your next visit.

Consent Record Storage:

For authenticated users, we store your cookie consent preferences in our database for the following purposes:

• Synchronize your preferences across devices and browsers
• Maintain an audit trail for compliance purposes
• Apply your preferences automatically when you log in

Consent records include: your consent choices (analytics: yes/no, marketing: yes/no), timestamp of consent, consent version number, and technical metadata (IP address, user agent) for audit purposes.

Retention: Consent records are retained for the lifetime of your account and for 7 years after account deletion to comply with Canadian record-keeping regulations.

8. Data Retention & Deletion

We retain your personal information only as long as necessary to fulfill the purposes outlined in this policy or as required by law.

Retention Periods:

• Active Accounts: Data is retained while your account is active and in good standing
• After Account Cancellation: Cases and calculations are retained for 90 days to allow reactivation, then permanently deleted
• Billing Records: Retained for 7 years to comply with Canadian tax and accounting regulations
• Support Communications: Retained for 2 years for quality assurance and dispute resolution
• Anonymized Usage Data: May be retained indefinitely for platform analytics and improvements (cannot be linked back to you)
• Legal Hold: Data subject to legal proceedings, investigations, or disputes is retained until resolution

Data Deletion Process:

When you request account deletion or your retention period expires, we permanently delete your data using secure deletion methods. Backup copies are overwritten during the next backup cycle (within 30 days). Data cannot be recovered after deletion.

9. Security Measures

We implement comprehensive technical, physical, and administrative safeguards to protect your personal information from unauthorized access, disclosure, alteration, or destruction.

Security Controls Include:

• Encryption in Transit: All data transmitted between your device and our servers is encrypted using TLS 1.2 or higher (HTTPS)
• Encryption at Rest: All stored data is encrypted using AES-256 encryption
• Access Controls: Role-based access, principle of least privilege, and support for multi-factor authentication where available
• Account Isolation: Your data is logically isolated and accessible only through your authenticated account
• Password Security: Passwords are hashed using industry-standard algorithms (bcrypt) and never stored in plain text
• Regular Security Audits: Ongoing monitoring, vulnerability scanning, and penetration testing
• Employee Training: Staff are trained on privacy obligations and data handling procedures
• Secure Development: Security-by-design principles in all platform development

Your Responsibility: You are responsible for maintaining the confidentiality of your account credentials. Use a strong, unique password and notify us immediately of any unauthorized access.

10. Data Breach Notification

In the event of a data breach that poses a real risk of significant harm, we will notify affected users and the Office of the Privacy Commissioner of Canada as required by PIPEDA.

Notification Process:

• Affected Users: Notified via email within 72 hours of discovering the breach
• Privacy Commissioner: Notified as soon as feasible if breach meets reporting threshold
• Notification Content: Description of breach, affected data, potential risks, mitigation steps, and contact information

Your Actions After a Breach:

If notified of a breach, immediately change your password, monitor your account for suspicious activity, and review your financial statements if payment information was affected.

11. Your Privacy Rights Under PIPEDA

Canadian privacy law grants you significant rights over your personal information. We are committed to facilitating the exercise of these rights.

A. Right to Access

You have the right to request a copy of all personal information we hold about you, including how it is being used and to whom it has been disclosed. We will respond within 30 days.

B. Right to Correction

You can request correction of inaccurate or incomplete personal information. We will update your data or, if we disagree, note your correction request in our records.

C. Right to Deletion

You can request deletion of your account and all associated data. Exceptions: Legal obligations (e.g., 7-year billing records) and data subject to legal hold. Deletion is completed within 90 days.

D. Right to Data Portability

You can receive your personal information in a portable, machine-readable format (JSON or PDF). This includes:

• Account information and preferences
• All saved cases, scenarios, and calculations
• Historical calculation results and reports
• Report generation history

Process: Email privacy@dvorce.ca with your request. We will verify your identity and provide the data within 30 days (or 60 days for complex requests with written notice). No charge for reasonable requests.

E. Right to Withdraw Consent

You can withdraw consent for non-essential data processing (e.g., analytics cookies). Note that withdrawing consent may limit our ability to provide certain services.

F. Right to Object

You can object to certain data processing activities. We will explain our legal basis for processing and accommodate your request where possible.

G. Right to File a Complaint

You have the right to file a complaint with the Office of the Privacy Commissioner of Canada:

• Website: www.priv.gc.ca
• Phone: 1-800-282-1376
• Email: info@priv.gc.ca

How to Exercise Your Rights:

Email our Privacy Officer at privacy@dvorce.ca with:

• Your full name and email address associated with your account
• Specific right you wish to exercise
• Any additional details to help us locate and verify your data

We will respond within 30 days (or 60 days for complex requests with written notice). All requests are free of charge unless deemed unreasonable, excessive, or repetitive.

12. Children's Privacy

Dvorce.ca is not directed at children under the age of 18. Our service is designed for adults navigating family law matters. While our platform collects dates of birth for children as part of support calculations, this information is provided by parents or legal guardians, not by children themselves.

Parental Responsibility: If you are a parent or legal guardian entering information about your children, you are responsible for ensuring that you have the legal authority to provide such information.

Child Data Protection: Children's dates of birth are treated with the same security standards as all other personal information and are used solely for the purpose of calculating support amounts in accordance with Canadian guidelines.

13. Data Anonymization & Aggregation

We are committed to protecting your privacy when using data for analytics and platform improvements. We may anonymize and aggregate user data to gain insights into platform usage, support calculation trends, and family law patterns while ensuring individual privacy is maintained.

Anonymization Standards:

If and when we anonymize data, we will adhere to the following principles to ensure re-identification is not possible:

• De-identification: Remove all direct identifiers including names, email addresses, account IDs, and IP addresses
• Aggregation: Combine data from multiple users to prevent identification of individuals
• Generalization: Replace precise values with ranges (e.g., "$75,000-$100,000" instead of "$87,450")
• Suppression: Remove rare or unique data points that could lead to re-identification

Uses of Anonymized Data:

Once data is properly anonymized following the standards above, it is no longer considered personal information under PIPEDA. We may use anonymized data for various purposes, including but not limited to:

• Internal platform performance analytics and optimization
• Feature usage statistics and product development
• Aggregate trend analysis and industry benchmarking
• Research collaborations and whitepapers on family law trends
• Sharing with or licensing to research partners, academic institutions, or industry organizations
• Public reporting on support calculation trends and family law statistics

Privacy Protection: Anonymized data, by definition, cannot be used to identify individual users. Once properly anonymized, data is no longer subject to PIPEDA regulations as it is not considered personal information.

14. International Users & Cross-Border Considerations

Dvorce.ca is designed primarily for Canadian residents and focuses on Canadian family law calculations. However, we recognize that users may access the platform from outside Canada.

Data Storage:

Regardless of where you access our platform, all data is stored exclusively in Canada (AWS Canada Central region). By using our services from outside Canada, you consent to the transfer of your data to Canada for storage and processing.

Jurisdictional Limitations:

Our calculations are based on Canadian federal and provincial guidelines. Results may not be applicable or accurate for other jurisdictions. Users outside Canada should consult local legal professionals before relying on any calculation results.

15. Changes to This Privacy Policy

We reserve the right to modify this Privacy Policy at any time to reflect changes in our practices, technology, legal requirements, or business operations.

Notification of Material Changes:

When we make material changes that affect how we collect, use, or share your personal information, we will notify you by email (to the address associated with your account) at least 30 days before the changes take effect. We will also update the "Last Updated" date at the top of this policy.

Your Options:

If you do not agree with the revised Privacy Policy, you may discontinue use of the platform and request deletion of your account before the effective date. Continued use of the platform after the effective date constitutes your acceptance of the changes.

Review Regularly: We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

16. Contact Information & Privacy Officer

For questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact our designated Privacy Officer:

Privacy Officer
Dvorce.ca
Email: privacy@dvorce.ca

General Support: support@dvorce.ca
Legal Inquiries: legal@dvorce.ca

Response Timeline:

We strive to respond to all privacy inquiries within 2 business days. For formal access or deletion requests, we will provide a substantive response within 30 days (or 60 days for complex requests with written notice).