Privacy Policy

Immicase ("we", "us", or "our") operates the Immicase platform, accessible at immicase.ca (the "Service"). This Privacy Policy describes how we collect, use, disclose, and protect your personal information when you use our Service, in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

1. Information We Collect

Information You Provide

• Account Information: When you create an account, we collect your name, email address, phone number, firm name, and professional designation (e.g., RCIC licence number).
• Client Case Data: Immigration case data, client profiles, documents, notes, and communications that you enter into the platform. This data is yours and is processed by Immicase solely on your behalf.
• Billing Information: Payment details such as credit card information, billing address, and invoice history. Payment processing is handled by our PCI-DSS compliant payment processor; we do not store full credit card numbers.
• Support Communications: Messages, emails, and attachments you send to our support team.

Information Collected Automatically

• Usage Data: Pages visited, features used, session duration, and interaction patterns within the Service.
• Device and Browser Information: IP address, browser type, operating system, device identifiers, and screen resolution.
• Cookies and Similar Technologies: We use cookies and local storage to keep you signed in, to remember preferences, and — only if you agree — to measure how the site is used. Section 8 sets out exactly what is collected, and how to change or withdraw your choice.

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service
• Process transactions and send billing-related communications
• Respond to support requests and communicate with you about your account
• Improve and develop new features based on usage patterns
• Monitor and enforce security, including fraud detection and prevention
• Comply with legal obligations and regulatory requirements
• Send product updates and announcements (with your consent)

3. How We Share Your Information

We do not sell, rent, or trade your personal information. We may share information in the following limited circumstances:

• Service Providers: We engage trusted third-party companies to perform services on our behalf (e.g., payment processing, email delivery, infrastructure hosting). These providers are contractually bound to use your data only for the purpose of providing the service and to maintain appropriate security.
• Legal Requirements: We may disclose information if required by law, regulation, legal process, or governmental request, including to comply with a court order or subpoena.
• Business Transfers: In the event of a merger, acquisition, or sale of all or a portion of our assets, your information may be transferred as part of that transaction. We will notify you before your personal information is transferred and becomes subject to a different privacy policy.
• With Your Consent: We may share information with third parties when you have given us explicit consent to do so.

Optional: connected cloud storage (Dropbox, Google Drive, OneDrive)

This is entirely optional and is switched off unless a firm turns it on. Immicase does not connect to any cloud storage account by default, and a firm that never enables it is unaffected by anything in this subsection.

If a firm wants it, its owner or administrator can choose to connect the firm's own cloud storage account. Immicase then saves copies of documents uploaded to Immicase, and scheduled data backups if the firm turns those on separately, into an “Immicase” folder in that account, organised by client and case.

Immicase only asks for permission to add files and to see which account is connected. It does not read, list or delete other files in the account. Access tokens are stored encrypted.

The firm can disconnect at any time from Integrations, which removes the connection from Immicase and stops any further copying. Files already copied stay in the firm's own storage, under its control and its provider's privacy policy — including where that provider stores them, which may be outside Canada. See Section 4.

4. Data Residency and Storage

Everything Immicase stores on your behalf is stored in Canada. Our servers, databases, and backups are located in Canadian data centres. Client records, case files, and documents held in the Immicase platform do not leave Canada, and we do not move them elsewhere. For more information, see our Canadian Data Residency page.

There are two situations where information can reach a provider outside Canada. We set them out plainly rather than leaving the sentence above to cover more than it should:

• Optional cloud storage a firm connects itself. This is off by default. If a firm chooses to turn it on, an owner or administrator connects the firm's own Dropbox, Google Drive or OneDrive account, and copies of documents are placed there. Where those copies physically sit is determined by the firm's chosen provider and account, not by us, and may be outside Canada. A firm that leaves this off keeps everything in Canada, and one that turns it on can disconnect at any time. See Section 3.
• Website analytics, if you accept them. If you consent to analytics on this marketing website, Google processes that data on its own infrastructure, which may be outside Canada. This is website usage data only — no client or case data is ever sent to Google. See Section 8.

5. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Service. If you cancel your account, we will retain your data for a reasonable period (not exceeding 90 days) to allow for reactivation or data export, after which it will be securely deleted. We may retain certain information as required by law or for legitimate business purposes such as resolving disputes or enforcing our agreements.

6. Security

We implement industry-standard technical and organizational measures to protect your personal information, including AES-256 encryption at rest, TLS 1.3 encryption in transit, role-based access control, and continuous security monitoring. For a comprehensive overview of our security practices, see our Security page.

7. Your Rights Under PIPEDA

Under PIPEDA, you have the right to:

• Access: Request access to the personal information we hold about you.
• Correction: Request correction of inaccurate or incomplete personal information.
• Withdrawal of Consent: Withdraw your consent for certain processing activities, subject to legal or contractual restrictions.
• Complaint: File a complaint with the Office of the Privacy Commissioner of Canada if you believe your privacy rights have been violated.

To exercise any of these rights, contact us at the address below. We will respond to your request within 30 days.

8. Cookies and Analytics

Nothing measures you until you say yes

Analytics on this website are off by default. When you first visit, a banner asks whether you agree. Until you choose “Accept”, no analytics identifier is created, no analytics cookie is written to your device, and no events are sent anywhere. If you choose “Decline”, that stays true permanently. The website works identically either way, and we do not ask again unless you reopen the choice yourself.

What we collect if you accept

We use Google Analytics 4 to understand which pages are useful and whether our free tools actually work. With your consent it records:

• Pages visited, and when
• Approximate location, derived at country or region level
• Device and browser type, and screen size
• A randomly generated identifier, stored in your browser, that lets Google tell one visit from another
• For our free PDF tool: that a merge or compression ran, whether it succeeded or failed, roughly how many files were involved, and which size band the input and output fell into

What we never collect from the PDF tool

Our free PDF merge and compress tool runs entirely inside your browser, using your own device to do the work. Your documents are never uploaded to us, never transmitted to any server, and never received by us — we have no technical ability to see them. The analytics events described above record only what happened, never what was in the file. We do not collect file names, file contents, page counts, text, or exact file sizes. Size is recorded only as a wide band, such as “between 4 and 10 MB”.

The reason we collect the success-or-failure signal at all is narrow and practical: IRCC caps uploads at 4 MB, and if the tool regularly fails to reach that limit we would otherwise have no way of knowing. It exists so we can fix the tool, not to learn anything about you.

Is it anonymous?

We want to be precise rather than reassuring here. The analytics data is pseudonymous, not anonymous. We never receive your name, email address, or documents through analytics, and we cannot identify you from it. But the randomly generated identifier described above is still treated as personal information under PIPEDA and as personal data under the GDPR, because it distinguishes one device from another. Anyone telling you that standard web analytics is fully anonymous is overstating it, and we would rather not.

IP addresses are used momentarily to derive approximate location and are not stored by Google Analytics 4. We have also enabled IP anonymisation.

Changing your mind

Select Cookie settings in the footer of any page to reopen the choice and accept or decline again. Withdrawing consent is exactly as easy as giving it, takes effect immediately, and stops any further collection. You can also block or delete cookies in your browser, and install Google's opt-out browser add-on.

Essential storage

One item is stored regardless of your choice: your consent decision itself, kept in your browser's local storage so we do not ask on every page. It contains only the choice, a version number and a timestamp. If you use the signed-in application, an authentication cookie is also required to keep you logged in. Neither is used for analytics or advertising.

Where this data goes

Google Analytics processes data on Google's infrastructure, which may include servers outside Canada and outside the European Economic Area. Google acts as our processor under its data processing terms, which incorporate the European Commission's Standard Contractual Clauses for transfers out of the EEA. This is separate from your immigration case data: client records in the Immicase platform are hosted in Canada, as described in Section 4, and are never sent to Google.

8a. Your Rights Under the GDPR

If you are in the European Economic Area or the United Kingdom, the GDPR gives you the following rights in addition to those in Section 7:

• Access — a copy of the personal data we hold about you
• Rectification — correction of inaccurate data
• Erasure — deletion, where we have no overriding obligation to retain
• Restriction — limiting how we process your data
• Portability — your data in a structured, machine-readable form
• Objection — to processing based on legitimate interests
• Withdrawal of consent — at any time, without affecting the lawfulness of what came before

Our lawful basis for analytics is your consent (Article 6(1)(a)). Our lawful basis for providing the Service to a customer is performance of a contract (Article 6(1)(b)). Where we rely on consent, you may withdraw it at any time using Cookie settings in the footer.

You also have the right to lodge a complaint with your national supervisory authority. In Canada, you may complain to the Office of the Privacy Commissioner of Canada.

9. Children's Privacy

Immicase is designed for use by immigration professionals and is not directed at individuals under the age of 18. We do not knowingly collect personal information from children. If we learn that we have collected information from a child, we will promptly delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or through a prominent notice within the Service prior to the change becoming effective. We encourage you to review this page periodically. Your continued use of the Service after changes are posted constitutes acceptance of the updated policy.

11. Contact Us

If you have any questions, concerns, or requests related to this Privacy Policy or our data practices, please contact us:

• Email: info@immicase.ca
• Privacy Officer: Immicase Privacy Officer, Next Number Consulting, Vancouver, British Columbia, Canada

You may also file a complaint with the Office of the Privacy Commissioner of Canada.