IR Immigration

IR Immigration App — Privacy Policy

Effective date: November 4, 2026

This policy explains how [À COMPLÉTER : dénomination légale de l’entreprise et numéro d’entreprise du Québec (NEQ)], doing business as IR Immigration ("IR Immigration", "we", "us"), collects, uses, discloses, retains and protects your personal information in the IR Immigration mobile app and its companion website (the "Service").

It complies with Québec's Act respecting the protection of personal information in the private sector (as amended by Law 25), Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), and the requirements of Apple's App Store and Google Play.

At a glance

  • The Service is free and may show clearly identified, frequency-limited IR Immigration promotional messages, without third-party ad trackers or audience analytics tools.
  • An account is optional. Without an account, we collect no information that identifies you.
  • We do not sell or rent your personal information.
  • Your account data is hosted in Canada.
  • You can delete your account at any time in the app or online.

1. Person in charge of the protection of personal information

The person in charge of the protection of personal information is the management of IR Immigration. You can reach them through the support form by choosing the subject "Privacy and personal information".

2. Information we collect

If you use the app without an account

  • Preferences stored on your device: language, theme, interests, favourites, notification preferences and cached content. This data stays in your phone's local storage (AsyncStorage) and is not sent to us.
  • Technical data: when the app downloads content, our hosting providers necessarily receive your IP address and technical information (device type, operating system version, date and time of the request). This information is used only to deliver content and to keep the Service secure.

If you create an account

  • Identification: email address, name (or display name) and password. The password is hashed by our authentication provider; we never have access to it in plain text.
  • Profile (optional): province or territory, profile type (e.g., student, worker, family), language and interests.
  • Account activity: favourites and the comments you post.
  • Notification token: only if you turn on push notifications. This is a technical identifier used to send notifications to your device.

If you fill out a form on our website

Your email address, your name (optional), your message, the page language and the type of request (support, privacy or account deletion).

We do not collect your precise location, contacts, photos, health data, social insurance number or immigration documents. Never send such information in a comment or a form.

3. Purposes

We use your information only to:

  1. create and manage your account, authenticate you and secure access (for example, by emailing you a verification code);
  2. tailor the news and programs shown to you based on the province, profile and interests you choose yourself;
  3. sync your favourites across your devices;
  4. publish and moderate your comments;
  5. send you notifications, if you turn them on;
  6. respond to your support, access, correction or deletion requests;
  7. keep the Service secure and prevent fraud and abuse;
  8. comply with our legal obligations.

With optional personalization consent, your stated profile type may select IR Immigration promotional messages. Without it, only general messages appear. With separate email consent, we may send advice, onboarding messages or service offers. Creating an account enables neither promotional consent. We make no eligibility decisions based exclusively on automated processing and use no location or profiling technology without your knowledge.

Your manually entered city, profile details, preferences and consent choices are synchronized to a private CRM for authorized staff, with follow-up stage and notes. Passwords remain handled by the authentication provider. If Google or Apple are enabled and selected, we do not receive their passwords. TEF drafts, budgets and message counters remain on the device. Account deletion also removes its CRM contact and linked deliveries.

Personalization and marketing emails are separate Settings choices, off by default; declining them does not block public content. The preferences link in each email also allows authenticated consent withdrawal. Essential account-security messages are separate. The planned email adapter uses Resend: the confirmed address, optional name and message content may be transmitted after consent checks. Promotional sending remains disabled until the provider is configured; processing may take place outside Canada.

By creating an account, you consent to the collection and use of your information for the purposes described above. Profile information is optional. You may withdraw your consent at any time by editing your profile, turning off notifications or deleting your account, subject to legal restrictions.

Persons under 14 must obtain the consent of a parent or guardian before creating an account.

5. Disclosure to third parties and service providers

We disclose your information only to the providers that help us operate the Service, and only to the extent necessary. These providers are bound by contractual confidentiality and security obligations.

  • Supabase (database, authentication and server functions): account data is hosted in the Canada (ca-central-1) region.
  • Cloudflare (website hosting and content delivery network): the website is served from the Cloudflare server closest to the visitor, which may be located outside Québec or Canada.
  • Push notification services (Expo, Apple Push Notification service and Google's Firebase Cloud Messaging): only if you turn on notifications. They receive the notification token and the notification content.
  • Apple and Google, as app store operators, collect data under their own policies when you download the app.

We may also disclose information where required or permitted by law, for example in response to a court order.

Links to government websites and to the IR Immigration website open sites that have their own privacy policies. Appointments are booked on ir-immigration.com and are governed by that site's policy.

6. Transfers outside Québec

Some providers, or the companies that control them, are located outside Québec, notably in the United States. Your account data is stored in Canada, but these providers may access it remotely for maintenance and support, and the website is delivered through Cloudflare's global network. Before disclosing information outside Québec, we assess, as required by law, the sensitivity of the information, the purposes of its use, the contractual safeguards and the applicable legal framework. Information located outside Québec may be subject to the laws of the countries concerned.

7. Retention

  • Account, profile, favourites and comments: kept for as long as your account is active and deleted as soon as you delete your account. An account that has been inactive for more than three years may be deleted after notice by email.
  • Requests sent through our forms: kept for up to 24 months after they are handled, then destroyed, unless the law requires longer retention.
  • Backups: deleted data disappears from automatic backups at the end of their rotation cycle, within 30 days at most.
  • Technical logs: kept by our providers for a limited time for security and troubleshooting purposes.
  • Local data: stays on your device until you clear it, uninstall the app or sign out (for account-related data).

8. Security

We use reasonable security measures appropriate to the sensitivity of the information:

  • encryption in transit (HTTPS/TLS);
  • password hashing;
  • database row-level access rules (Row Level Security), so that each user can access only their own data;
  • administrative access restricted to authorized staff;
  • secret keys kept on the server side only.

However, no method of transmission or storage is completely secure.

9. Confidentiality incidents

If a confidentiality incident affects your information (unauthorized access, use or disclosure, or loss), we promptly take steps to reduce the risk of harm. Where the incident presents a risk of serious injury, we notify the Commission d'accès à l'information du Québec, the Office of the Privacy Commissioner of Canada and the affected individuals. We keep a register of incidents, as required by law.

10. Your rights

Subject to the exceptions provided by law, you have the right to:

  • access: know what information we hold about you and obtain a copy;
  • correction: have inaccurate, incomplete or equivocal information corrected (you can also edit your profile directly in the app);
  • withdraw consent and have your information deleted;
  • portability: receive your computerized information in a structured, commonly used technological format;
  • be informed of the information used to personalize what you see, and request that its dissemination cease or that it be de-indexed where the law allows.

To exercise these rights, use the support form (subject "Privacy and personal information"). We may ask you to confirm your identity, for example by writing from the email address linked to your account. We respond free of charge within 30 days of receiving your request.

If you are not satisfied with our response, you may file a complaint with the Commission d'accès à l'information du Québec or the Office of the Privacy Commissioner of Canada.

11. Deleting your account and data

You can delete your account in two ways:

  1. In the app: Profile › My account › Delete my account. Deletion is immediate.
  2. Online, without the app: through the deletion request form. We process the request within 30 days after verifying that you own the account.

Deletion erases your account, profile, synced favourites, comments and notification token. Local data stays on your device until you uninstall the app. We keep only the data that the law requires us to retain, and backups until the end of their rotation cycle (see section 7).

12. Cookies and website

The landing page uses no advertising cookies or audience analytics tools. The administration and preferences pages use necessary authentication-session cookies. Cloudflare may use security cookies. The app uses local storage for preferences and daily promotional-message counters; these counters are not transmitted to an advertising network.

13. Changes

We may amend this policy. The effective date will then be updated. If a change is material, we will notify you in the app or by email before it takes effect.

14. Contact us

For any question, use the support form. This policy is written in French; an English translation is provided and, in case of discrepancy, the French version prevails.