Version 2026-10-25
Privacy Policy
This describes what personal information Polaris Institute collects, why, and how we protect it — in line with PIPEDA.
1. What we collect
When you register, apply, or enrol, we collect your name, email, and phone number. If you reserve a spot at one of our events (no account needed), we collect your name, email, phone number, how many people are coming, and any note you add. If you pay for a course, Stripe processes your payment directly — we never see or store your full card details, only a payment reference and the amount. If you sign in with Google, we receive your name, email, and profile photo from Google — used only to identify your account, never to access anything else in your Google account.
2. Why we collect it
We use your information to create and manage your account, process enrolments and payments, send enrolment confirmations, receipts, and schedule updates, verify your email address, issue certificates, and respond to support requests. For an event reservation, we use your details only to hold your spot, send your confirmation (with a link to cancel), and tell you if the event changes or is cancelled; we do not add you to our mailing lists because you reserved. We do not use your information for advertising, and we do not sell your information to anyone.
3. Who we share it with
We share the minimum necessary information with the services that make the Institute run: Stripe (payment processing), Google (sign-in only, if you use it), our email provider (sending you account and course emails), and our hosting and database providers (MongoDB Atlas, Contentful) who store the data on our behalf under their own security commitments. None of these providers may use your information for their own purposes.
4. Cookies & sessions
We use a single, essential session cookie to keep you signed in. We do not use advertising or tracking cookies, and we do not run third-party analytics on this site. To see which pages are useful, we count visits ourselves, anonymously: your browser keeps a random visitor number (not a cookie, and not linked to your name or email), and we record the page, the website that sent you, your device type and an approximate city. We never store your IP address, these records are deleted after 90 days, and if your browser sends a Global Privacy Control signal we do not count your visits at all.
5. How long we keep it
We keep account and enrolment records for as long as your account is active and for a reasonable period afterward to meet financial record-keeping obligations and to honour certificate verification. Event reservations are kept with that event’s records so we know who came; ask us and we will delete yours. You can ask us to delete your account at any time; see "Your rights" below.
6. How we protect it
Passwords are hashed, never stored in plain text. Access to student records in our staff portals is role-gated and limited to what each role needs to do its job.
7. Your rights
Under PIPEDA, you can ask us what personal information we hold about you, correct anything that is inaccurate, and request that we delete your account and associated data (subject to what we are required to retain for legal or financial reasons). Email us and we will respond within a reasonable time.
Questions about your data, or want to exercise your rights above? Email info@polarisinstitute.ca.