Privacy PolicyPrivacy Policy

1. Introduction

This Privacy Policy (“Policy”) explains how Lexpoint Inc. (“Lexpoint,” “we,” “us,” or “our”) collects, uses, and protects your personal information across our multi-platform immigration technology ecosystem.

1.1 Services Covered

This Policy governs data collection and processing across our platforms:

• ImmiReport — Immigration assessment tools and shareable reports
• ImmiWatch — Source monitoring and immigration data analytics
• Employer / workforce portal — Work authorization and workforce link infrastructure
• Partner / professional workspace — Practice tools for approved Lexpoint professional partners
• Free Tools — NOC Navigator, CLB Navigator, CRS Calculator, FSW Calculator, Wage Navigator

1.2 Data Processing Categories

We process data in two distinct categories:

• Educational Data — Information collected through free educational tools and resources
• Professional Data — Information collected through formal retainer agreements and professional services

2. Information We Collect

2.1 Information You Provide

We collect personal information you voluntarily provide when using our Services:

Educational Tools Data:

• Basic contact information (name, email, phone)
• Immigration assessment responses and preferences
• Tool usage patterns and educational interests
• Marketing preferences and communication history

Professional Services Data:

• Comprehensive personal and family information
• Immigration history and documentation
• Financial information for payment processing
• Legal case files and professional correspondence
• CICC-regulated professional client data

2.2 Automatically Collected Information

• Usage Data: IP address, browser type, device settings, pages viewed, features used
• Device Data: Device type, operating system, unique identifiers
• Location Data: Approximate location via IP address (configurable)
• Analytics Data: User behavior patterns, tool performance metrics

2.3 AI and Third-Party Processing

Some features use AI to read documents and to answer questions about your file. AI is used to read and organize information. It does not decide your case — a licensed representative is responsible for every decision, and for what is submitted on your behalf.

Where you use AI-assisted features, relevant content is sent to model providers for inference only. We use:

• OpenAI — document analysis and the in-product assistant. Document analysis always runs on OpenAI and cannot be switched by a user.
• Anthropic
• xAI

These providers process that content to return a result for your request. We do not authorize them to use Lexpoint customer data — including any Google user data we receive through Google APIs — to create, train, or improve foundational or generalized AI/ML models. Separately, we use ordinary product analytics and security tooling to operate and secure the Services; that is not model training.

Your documents do not stay with the AI provider. When a document is analyzed, it is deleted from the provider as soon as the analysis finishes — normally within seconds. It also carries an automatic expiry, so it is removed even if that step does not complete. We do not retain the analysis request in the provider’s request history.

We process this content under an enterprise agreement with OpenAI. Under that agreement, the content of our requests is kept out of that provider’s general monitoring logs and away from routine human review.

3. How We Use Your Information

3.1 Educational Tools Usage

For free educational tools, we use your information to:

• Provide immigration assessment results and educational content
• Improve tool functionality and user experience
• Generate leads for professional services
• Send educational materials and marketing communications
• Analyze usage patterns for service improvement

3.2 Professional Services Usage

For retained professional services, we use your information to:

• Provide comprehensive immigration advice and representation
• Manage client relationships and case files
• Process payments and maintain financial records
• Comply with CICC regulations and professional standards
• Facilitate legal proceedings and documentation

3.3 Lead Generation and Marketing

Our lead generation ecosystem uses data to:

• Connect users with appropriate professional services
• Send targeted marketing materials and promotional offers
• Facilitate business partnerships and network relationships
• Analyze market trends and service demand

4. Data Sharing and Disclosure

4.1 Service Providers

We share data with trusted service providers for:

• Payment Processing: Stripe, Inc. for secure payment handling
• Hosting and Infrastructure: Cloud service providers
• Analytics and Marketing: Performance tracking and communication
• AI inference: OpenAI, Anthropic, and xAI, for the AI-assisted features described in Section 2.3

4.2 Google API Limited Use

Lexpoint's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google Workspace Directory data (names and email addresses) is used only so an employer administrator can invite their own colleagues to that employer's workforce roster in Lexpoint, and is never transferred to or processed by any third-party AI or machine-learning service.

4.3 Professional Network

For professional services, we may share data with:

• Legal Partners: Licensed practitioners in our network
• Immigration Authorities: As required for legal proceedings
• Regulatory Bodies: CICC and other professional regulators

4.4 Legal Requirements

We may disclose information when required by:

• Canadian immigration laws and regulations
• Court orders or legal proceedings
• Government investigations or audits
• Professional regulatory requirements

5. Data Retention and Security

5.1 Retention Periods

• Educational Data: Up to 36 months after last activity
• Professional Data: As required by CICC regulations and legal obligations
• Client Records: As per CICC Client File Regulations and professional standards
• Financial Records: As required by tax and accounting laws
• AI Providers: Documents are deleted from the AI provider immediately after analysis — see Section 2.3

5.2 Security Measures

• Encryption: Encrypted in transit (TLS) and at rest; documents are held in encrypted storage accessible only to your representative and staff working your file
• Access Controls: Role-based access and authentication
• Regular Audits: Security assessments and compliance monitoring
• Professional Standards: CICC-regulated security protocols

6. Your Privacy Rights

6.1 General Rights

You have the right to:

• Access and review your personal information
• Correct inaccurate or incomplete data
• Request deletion of your data (subject to legal requirements)
• Opt out of marketing communications
• Withdraw consent for data processing

6.2 Professional Services Rights

For retained clients, you also have:

• Right to professional confidentiality under CICC regulations
• Access to complete case files and documentation
• Control over information sharing with third parties
• Professional privilege protection for legal communications

6.3 GDPR and PIPEDA Compliance

For EU and Canadian residents, you have additional rights under GDPR and PIPEDA:

• Data portability and transfer rights
• Right to restrict processing
• Right to object to automated decision-making
• Right to lodge complaints with supervisory authorities

7. Cookies and Tracking Technologies

7.1 Types of Cookies

• Essential Cookies: Required for basic functionality
• Analytics Cookies: Performance and usage tracking
• Marketing Cookies: Targeted advertising and communications
• Preference Cookies: User settings and customization

7.2 Cookie Management

You can manage cookies through:

• Browser settings and privacy controls
• Third-party opt-out mechanisms (where available)
• Direct requests to our privacy team at privacy@lexpoint.io

8. International Data Transfers

8.1 Data Location

Your data is primarily processed in Canada, with safeguards for international transfers:

• Primary Storage: Canadian servers under Canadian privacy laws
• Backup Storage: Secure international backup locations
• Service Providers: Third-party processors with appropriate safeguards

8.2 Transfer Safeguards

• Standard Contractual Clauses (SCCs) for EU transfers
• Adequacy decisions where applicable
• Data processing agreements with service providers
• Regular transfer impact assessments

9. Children's Privacy

Our Services are not intended for children under 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately.

10. Changes to This Policy

We may update this Policy periodically. Material changes will be communicated through:

• Email notifications to registered users
• Website notices and banner alerts
• Updated “Last Updated” date
• Professional client communications for retained services

11. Contact Information

For privacy-related inquiries, contact us at:

• Lexpoint Inc.
• 1000 Innovation Drive, Suite 500
• Ottawa, Ontario K2K 3E7
• Phone: 604-757-4400
• Privacy Inquiries: privacy@lexpoint.io
• General Support: support@lexpoint.io