Privacy Policy

1. Introduction

MaplePass ("we," "us," or "our") operates the website getmaplepass.com and provides a document preparation service for Canadian citizenship applications under Bill C-3. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or use our services.

By using MaplePass, you agree to the collection and use of information in accordance with this policy. If you do not agree with the terms of this Privacy Policy, please do not access the site or use our services.

The company that operates MaplePass is being registered. This page will name it and give its address once registration is complete. Until then, reach us at support@getmaplepass.com.

2. Information We Collect

We collect information that you provide directly to us, as well as information collected automatically when you use our service.

2.1 Personal Information You Provide

• Identity information: Full legal name, date of birth, place of birth, gender, and current address.
• Contact information: Email address and phone number.
• Ancestry and family data: Names, birth dates, birthplaces, and citizenship status of your parents, grandparents, and other ancestors relevant to establishing your Canadian citizenship by descent.
• Documents: Scanned or photographed copies of birth certificates, marriage certificates, passports, citizenship certificates, and other vital records you upload for verification and application preparation.
• Payment information: Payment details are collected and processed by our payment processor, Stripe. We do not store your full credit card number, CVV, or other sensitive payment data on our servers.
• Signatures: Electronic signatures provided during the application process for inclusion on your CIT 0001 form.

2.2 Information Collected Automatically

• Device and browser data: IP address, browser type, operating system, device type, and screen resolution.
• Usage data: Pages visited, time spent on pages, click patterns, referral URLs, and interactions with site features.
• Cookies and similar technologies: See Section 6 below for details on our cookie usage.

3. How We Use Your Information

We use the information we collect for the following purposes:

• Application preparation: To populate and generate your CIT 0001 application form and supporting documentation package for submission to Immigration, Refugees and Citizenship Canada (IRCC).
• Document verification: To verify that your uploaded documents meet IRCC requirements using our AI-powered verification system, including checking document format, name consistency, and completeness.
• Eligibility assessment: To determine whether your family history qualifies you for Canadian citizenship by descent under Bill C-3.
• Communication: To respond to your inquiries, send service-related notifications (such as application status updates), and provide customer support.
• Service improvement: To analyze usage patterns, diagnose technical issues, and improve the functionality and user experience of our platform.
• Legal compliance: To comply with applicable laws, regulations, and legal processes.

4. Third-Party Services

We use the following third-party service providers to operate MaplePass. Each provider has its own privacy policy governing how they handle data:

4.1 Stripe (Payment Processing)

We use Stripe to process payments securely. When you make a payment, your credit card information is transmitted directly to Stripe and is never stored on our servers. Stripe is PCI DSS Level 1 certified. See Stripe's Privacy Policy.

4.2 Supabase (Data Storage & Authentication)

We use Supabase for secure data storage, user authentication, and file storage. Your personal information, application data, and uploaded documents are stored in Supabase's SOC 2-compliant infrastructure with encryption at rest and in transit. See Supabase's Privacy Policy.

4.3 AI Services (Document Verification & Application Assistance)

We use AI language models (including Claude by Anthropic) to power our document verification and application guidance features. When you use these features, relevant portions of your application data and document content may be processed by the AI service to provide verification results and guidance. We do not use your data to train AI models. See Anthropic's Privacy Policy.

4.4 Render (Hosting) and Twilio SendGrid (Email)

Render runs the website in the United States. SendGrid delivers the emails we send you, such as sign-in links, receipts, and reminders about an unfinished application. Every reminder has an unsubscribe link. When you unsubscribe, we keep your email address on a do-not-email list so that we never send to it again.

4.5 Analytics and Advertising

Google Analytics 4 and Microsoft Clarity load only if you accept analytics cookies in the banner. They show us which pages people use and where they get stuck. We never send them your application answers or your documents.

The Meta Pixel loads only if you turn on advertising cookies. It lets us show MaplePass ads on Facebook and Instagram to people who visited, and count how many of them came back. Meta receives the page you viewed and a few generic steps: that you started the eligibility check, started a chat, created an account, began checkout, or paid, with the price. It never receives your name, your email, your answers, your ancestry, or your documents, and it is not sent pages whose address holds personal details, such as unsubscribe links. Meta's own use of this data is covered by Meta's Privacy Policy.

The Reddit Pixel follows the same rules. It loads only if you turn on advertising cookies, lets us show MaplePass ads on Reddit to people who visited, and receives the same generic steps and nothing more. If you have it on when you pay, our server also confirms that purchase to Reddit: the amount, a payment reference, and the Reddit cookie already in your browser, so the sale counts even when the pixel is blocked. We do not send Reddit your email or any other identifier. Reddit's own use of this data is covered by Reddit's Privacy Policy.

5. Data Sharing & Disclosure

We do not sell, rent, or trade your personal information to third parties for marketing purposes. We may share your information only in the following circumstances:

• Service providers: With the third-party providers described in Section 4 above, solely to the extent necessary to provide our services.
• Legal requirements: If required by law, subpoena, court order, or other legal process, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
• Business transfers: In connection with a merger, acquisition, or sale of all or a portion of our assets, your data may be transferred as part of that transaction. We will notify you via email or prominent notice on our site before your data is transferred and becomes subject to a different privacy policy.
• With your consent: We may share your information for any other purpose with your explicit consent.

6. Cookies & Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience on our site:

• Essential cookies: Required for the website to function (e.g., authentication tokens, session management). These cannot be disabled.
• Functional cookies: Remember your preferences and settings (e.g., eligibility checker progress).
• First page you visited: Your browser stores the first MaplePass page you landed on and the site or campaign that sent you, in local storage on your device. If you use the chat or start checkout, we save that with it so we can tell which pages help people. It is never shared with ad networks.
• Analytics cookies: If you accept, we load Google Analytics 4 and Microsoft Clarity to understand how visitors use our site.
• Advertising cookies: Off by default. If you turn them on, we load the Reddit Pixel and the Meta Pixel described in Section 4.5.

The banner on your first visit lets you accept all, reject all, or choose each kind. You can change your mind at any time with Cookie settings at the bottom of every page; turning a kind off deletes its cookies. You can also control cookies through your browser settings. Disabling essential cookies may prevent you from using certain features of the site.

7. Data Retention

We keep your data only as long as it helps you finish your application. A job runs every day and deletes anything past these limits. You do not have to ask.

• Chat with no account and no purchase: deleted 6 months after the last message.
• Uploaded documents: deleted 12 months after you last used your account, meaning your last sign-in or your last change to the application. You can delete any file yourself sooner.
• Your account and application: deleted with everything in it 3 years after your last activity.
• Checkout error reports: deleted after 90 days.
• Payment records: Stripe keeps the record of each charge (name, email, amount, date, and card brand) for 7 years, because tax law requires it. It never contains your documents or your family history.
• Database backups: deleted data can stay in encrypted backups for up to 30 days, until those backups expire. Nobody restores from them to recover deleted accounts.
• Chat improvement notes: we read chat transcripts to find questions the chat answers badly. The notes we keep from that are paraphrased and never contain names, email addresses, or street addresses.

8. Your Rights

The first three need no email and no waiting. They are buttons in Settings.

• Delete everything: Delete account removes your account, application, family chain, uploaded files, chats, and support messages at once. The same account works on Linha Reta and Línea Recta, and it is deleted from those sites too. If any step fails, nothing is half-deleted: you see an error and can try again.
• Delete one file: remove any document from the upload page. It leaves storage right away.
• Get a copy: Export downloads everything we hold about you as one JSON file.
• Correct something: edit it in your application, or write to us.
• Stop emails: use the unsubscribe link in any email.
• No account? If you only used the chat and want it deleted now, email us from the address you gave in the chat. We delete it within 7 days.

For anything else, contact us at support@getmaplepass.com. We will respond to all requests within 30 days.

9. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to know: You may request the categories and specific pieces of personal information we have collected about you, the categories of sources, the business purpose for collecting it, and the categories of third parties with whom we share it.
• Right to delete: You may request deletion of your personal information, subject to certain exceptions.
• Right to opt-out: We do not sell personal information. We share it with Reddit and Meta for advertising only if you turn on advertising cookies, and you can turn them off at any time with Cookie settings at the bottom of every page. We also honor Global Privacy Control signals.
• Right to non-discrimination: We will not discriminate against you for exercising your CCPA rights.

To exercise your CCPA rights, email us at support@getmaplepass.com with the subject line "CCPA Request."

10. Data Security

• Every page and upload travels over HTTPS.
• The database and file storage are encrypted at rest with AES-256 by Supabase.
• Uploaded documents sit in a private storage bucket. There are no public links to your files. Our server checks that you are signed in to the account that owns a file before handing it over.
• Database rules stop one account from reading another account's application.
• Card numbers go straight to Stripe and never touch our servers.
• Only the people who run MaplePass can open the database, and only to answer your support request or fix a fault.

No system is perfectly secure. If we ever find that someone got into your data, we will email you without delay and say what was exposed.

11. Children's Privacy

MaplePass is not directed to individuals under the age of 18. We do not knowingly collect personal information from children under 18. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at support@getmaplepass.com, and we will promptly delete such information.

Note: While a minor may be the subject of a citizenship application (e.g., a parent applying on behalf of a child), the application must be submitted by a parent or legal guardian who is at least 18 years of age.

12. International Data Transfers

Your data is stored in the United States: the database and files with Supabase in Ohio, and the website with Render in Oregon. If you use MaplePass from another country, your information is processed in the United States, where data protection law may differ from yours.

Supabase, Anthropic, Stripe, Render, and Twilio SendGrid are bound by data processing agreements that are part of their terms. Each one includes the European Commission's standard contractual clauses (Decision 2021/914) for transfers from the EU. Stripe, Render, and Twilio SendGrid are also certified under the EU-U.S. Data Privacy Framework. If you turn on advertising cookies, Meta receives the limited data described in Section 4.5; for visitors in the EU, Meta Platforms Ireland is responsible for it under Meta's terms. Reddit is likewise responsible for what the Reddit Pixel sends it, under Reddit's terms.

If you are in the EU or the UK, our legal basis under the GDPR is: providing the service you asked for, for your application, files, and payment state; a legal obligation, for the charge record Stripe keeps for tax; our legitimate interest, which you can object to at any time, for reminders about an unfinished application, site security, and reading chats to improve the answers; and your consent, which you can withdraw, for analytics and advertising cookies.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date at the top. We encourage you to review this Privacy Policy periodically. Your continued use of MaplePass after any changes constitutes your acceptance of the updated policy.

14. Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us: