Privacy Policy

1. Introduction

Edpace (“we”, “us”, “our”) provides a learning management system for Ontario inspected private schools delivering Ontario Secondary School Diploma (OSSD) credits. This policy explains how we collect, use, disclose, and protect personal information in compliance with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA).

2. Data We Collect

We collect only the personal information necessary to deliver educational services:

• Student information — name, Ontario Education Number (OEN), date of birth, grade level, contact details, and relevant educational accommodations (IEP, ESL/ELD status).
• Academic records — grades, assessment evidence, Achievement Chart (KTCA) scores, Learning Skills ratings, report cards, and transcript data.
• Submissions & engagement — student work products, lesson progress, time-on-task logs, and community involvement hours.
• Parent/guardian information — name, contact details, and relationship to student.
• Staff information — name, email, role, and Ontario College of Teachers registration number (where applicable).
• Account credentials — email address and hashed authentication tokens (we do not store passwords in plaintext).

3. How We Use Your Data

• Delivering course content and managing student enrolments.
• Calculating grades in accordance with Growing Success and the Ontario Achievement Chart.
• Generating Provincial Report Cards, Ontario Student Transcripts (OST), and Office Index Cards.
• Producing data files for the Ontario Universities’ Application Centre (OUAC) and the Ontario College Application Service (OCAS).
• Tracking OSSD graduation requirements (credits, OSSLT, community hours).
• Communicating with parents and guardians about student progress.
• Supporting Ministry of Education inspections (Form 3003E compliance).

4. Canadian Data Residency

All student personal information is stored exclusively in Canadian data centres. Our primary database is hosted in Supabase’s ca-central-1 (Montreal) region on AWS Canada infrastructure. Application hosting is provided by Vercel’s Montreal (yul1) edge location. No student data is transferred outside of Canada without explicit, informed consent.

5. Data Retention

• Academic grades and transcript data — retained for a minimum of five (5) years after the student’s last enrolment, consistent with Ontario Student Record (OSR) retention requirements.
• Student submissions and work products — retained for two (2) years after course completion, then securely deleted.
• Course content and curriculum materials — retained indefinitely while the school remains an active tenant.
• Audit logs — retained for five (5) years for compliance and security purposes.

6. Third-Party Data Processors

We use a limited number of third-party service providers, each bound by data processing agreements that require Canadian data residency or equivalent safeguards:

• Supabase — database hosting and authentication (ca-central-1).
• Vercel — application hosting and edge delivery (yul1 Montreal).
• Resend — transactional email delivery (report card notifications, account invitations).

We do not sell, rent, or share personal information with advertisers, data brokers, or any third party for marketing purposes.

7. Student & Parent Rights

Under PIPEDA, you have the right to:

• Access — request a copy of the personal information we hold about you or your child.
• Correction — request correction of inaccurate or incomplete information.
• Deletion — request deletion of personal information, subject to Ontario Student Record (OSR) retention requirements and legal obligations.
• Withdraw consent — withdraw consent for optional data processing at any time. Note that withdrawing consent for essential educational processing may affect the school’s ability to issue credits and report cards.

To exercise any of these rights, contact your school’s administration or email us at privacy@edpace.ca.

8. Artificial Intelligence

Edpace does not use artificial intelligence to interact directly with students. AI tools are used exclusively in our internal content development pipeline for course authoring and curriculum alignment. Students never communicate with or receive responses from an AI system. All grading, feedback, and academic decisions are made by qualified Ontario Certified Teachers.

9. Cookies

Edpace uses only essential cookies required for authentication (Supabase session tokens). We do not use tracking cookies, advertising pixels, or third-party analytics that collect personal information. No cookie consent banner is required because we do not set non-essential cookies.

10. PIPEDA Compliance

Edpace is committed to full compliance with PIPEDA’s ten fair information principles: accountability, identifying purposes, consent, limiting collection, limiting use/disclosure/retention, accuracy, safeguards, openness, individual access, and challenging compliance. Our Privacy Officer can be reached at privacy@edpace.ca.

11. Security Safeguards

We protect personal information with industry-standard security measures including: encryption in transit (TLS 1.3) and at rest (AES-256), role-based access control, row-level tenant isolation, comprehensive audit logging, and regular security reviews. For more details, see our Security page.

12. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated to schools via email and posted on this page with an updated effective date. Continued use of Edpace after changes constitutes acceptance of the revised policy.

13. Contact Us

If you have questions about this privacy policy or our data practices, please contact: