Northway Privacy Policy

If you have any questions or requests about your personal information, contact our Privacy Officer:

Zhaoyi Wang, Privacy Officer

Email: privacy@northway.ca

This policy applies to personal information we collect through getnorthway.ca and related Northway services. It reflects our obligations under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and, for users located in Quebec, An Act respecting the protection of personal information in the private sector (Quebec's "Law 25"). Where these laws differ, we apply the stricter standard.

Account information. When you create an account, we collect your email address and the credentials or third-party sign-in identifier you use to log in.

Your self-assessment profile. To calculate your scores and pathway recommendations, we collect the information you enter about your situation. This is deliberately kept general and range-based rather than precise, and may include: your age or age range, marital status, education level, official language test results or benchmark levels, French proficiency, years of work experience (in Canada and abroad), occupational category, provincial preferences and ties, and asset or investment amounts expressed as brackets.

What we deliberately do NOT collect. Northway does not ask for and does not store your passport number, Social Insurance Number (SIN), full date of birth (day precision), precise bank balances or account numbers, or other government-issued identifiers. You never need these to use Northway.

Optional date facts (timeline). If you choose to unlock the score timeline, we may collect birth year-month and other year-month dates you provide (for example language test month, work start month). We collect year and month only — never a specific day. Consent purpose date_facts is recorded separately; you can skip this and still use the core assessment.

Consent records. We keep a record of the consents you give (what you agreed to, and when), so we can honour your choices and demonstrate compliance.

Preferences. Your language/locale choice (for example, English or Chinese).

Anonymous results. You can use Northway without an account and receive results under a short reference ID. If you later create an account, you may link those results to it.

Essential technical data. Basic information needed to operate and secure the site (such as data required to maintain your session). At launch, Northway does not use analytics or advertising cookies or trackers.

We use your personal information only to: run your eligibility and score assessment and generate pathway recommendations; save your profile so you can return to it and update it over time; operate, secure, and support your account; and communicate with you about your account or a request you have made.

We do not sell your personal information, we do not show third-party advertising, and we do not share your information with immigration consultants, lawyers, or other third parties unless you explicitly ask us to or direct us to.

We collect, use, and disclose your personal information only with your consent, which we ask for in clear terms and separately for distinct purposes. You may withdraw your consent at any time (see Section 11); doing so may mean we can no longer provide some or all of the service.

Northway calculates your scores and ranks pathways automatically from the information you provide. These outputs are informational estimates to help you understand your own situation — they are not decisions made about you, and they do not determine any immigration outcome. Immigration decisions are made only by Immigration, Refugees and Citizenship Canada (IRCC) and the relevant provincial or Quebec authorities. Our calculations are designed to be transparent and explainable, and you may contact our Privacy Officer with questions about how a result was produced.

Northway uses essential cookies required to operate and secure the site (for example, to keep you signed in).

TODO(verify-live): Analytics disclosure — optional first-party analytics (currently Vercel Analytics) load only after you opt in via the cookie banner or account privacy controls. No advertising trackers. Legal text to be finalized by the Privacy Officer.

TODO(verify-live): Email alerts — if you opt in, we may email matched immigration data updates (Express Entry, selected PNP provinces, Quebec-related signals, or processing-time changes) based on your saved self-assessment profile and alert preferences. Opt-in is unchecked by default; consent purpose email_alerts is recorded; every message includes an unsubscribe link and a link to change preferences. Legal wording (identity of sender, CASL commercial electronic message framing) to be finalized by the Privacy Officer before production send.

Your information is stored in a managed PostgreSQL database (Supabase) hosted in a Canadian region, with access controls that ensure you can only access your own data. We keep your data in Canada. If we ever needed to transfer personal information outside Canada or Quebec, we would first assess whether it would receive equivalent protection, consistent with Law 25.

We keep your personal information for as long as your account is active. If you ask us to delete it, we delete it (subject to any limited retention required by law). We also delete accounts and associated profiles after a prolonged period of inactivity (currently 24 months). Anonymous results not linked to an account are retained only for a short period.

We use technical and organizational safeguards appropriate to the sensitivity of the information, including encryption in transit and at rest, row-level access controls so each user reaches only their own data, and limits on who can access systems. No system is perfectly secure, but we work to protect your information and to limit what we hold in the first place.

Under PIPEDA and Law 25, you may: access the personal information we hold about you; correct information that is inaccurate or incomplete; delete your account and personal information; export your information in a structured, portable format; withdraw consent to our collection or use of your information; and complain if you believe we have mishandled your information.

To exercise any of these, email our Privacy Officer at privacy@northway.ca. We will respond within the timeframes required by law (generally within 30 days).

We rely on a small number of service providers to run Northway — for example, database hosting, authentication, and email delivery. They may process personal information only on our instructions and only to provide their service to us, and they are bound to protect it. We choose providers that allow us to keep data in Canada wherever possible.

Northway is intended for adults. We do not knowingly collect personal information from children. For Quebec residents, we do not knowingly collect personal information from a minor under 14 without the consent of a parent or guardian.

If a breach of security involving your personal information occurs and it presents a risk of serious harm, we will notify you and the relevant regulator (the Office of the Privacy Commissioner of Canada, and for Quebec residents the Commission d'accès à l'information du Québec) as required by law, and we maintain a record of security incidents.

We may update this policy from time to time. When we do, we will change the "Last updated" date above and, for material changes, take reasonable steps to let you know.

For any privacy question or request, contact:

Zhaoyi Wang, Privacy Officer — Northway

Email: privacy@northway.ca

If you are not satisfied with our response, you may contact: the Office of the Privacy Commissioner of Canada (priv.gc.ca); or, if you are a Quebec resident, the Commission d'accès à l'information du Québec (cai.gouv.qc.ca).