Navisa Prep — Privacy Addendum

This addendum applies to individuals using Navisa Prep. It supplements the Navisa Privacy Policy, which describes our general practices, subprocessors, and security measures. Where this addendum and the general policy differ for Prep users, this addendum governs.

On the Navisa platform for firms, an immigration firm is our customer and controls its clients’ data; we process it on the firm’s behalf. Prep is different: you are both the customer and the person the data is about.NovaCore Systems Inc. is directly accountable to you for your personal information under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), and you exercise your privacy rights directly with us — no firm or intermediary is involved.

• ·Account information: your name, email address, and password (stored as a salted hash).
• ·Intake answers: the information you enter about your background, education, work history, language results, family, and immigration history.
• ·Uploaded documents: passports, letters, test results, certificates, and other files you upload, plus the data extracted from them for your review.
• ·Generated content: the comparisons, flags, options, worksheets, and drafts Prep produces from your data.
• ·Consent and decision records: your terms acceptance (version and timestamp), point-of-risk acknowledgments, and your accept/dismiss choices on presented options.
• ·Billing: payment details are collected and stored by Stripe. We receive a tokenized reference and the last four digits of the card only.
• ·Usage data: product analytics about how Prep is used, to operate and improve it.

Your information is used to provide Prep to you:

• ·Organizing your documents and extracting data from them for your review.
• ·Computing cited comparisons of your entered facts against publicly published Government of Canada requirements.
• ·Pre-filling form worksheets and drafting text for your review and approval.
• ·Assembling packages and summaries that you choose to download.
• ·Operating your account, processing payments, providing support, and meeting legal obligations.

We do not sell your personal information, and we do not use it for advertising to third parties.

Prep processes your documents and entered data using large language models provided by Anthropic (Claude), and text embeddings for policy search generated using OpenAI models. Both providers are engaged under enterprise data processing agreements that prohibit them from using submitted data to train or improve their models. Data sent to these services is processed transiently and is not retained by the AI provider beyond the duration of the API call.

AI outputs in Prep are general information for your review — see the Navisa Prep Terms of Use for what Prep is and is not.

Your data is shared only with the subprocessors needed to run the product (hosting, database, AI providers, payments, email) — the current list is in the Navisa Privacy Policy. Beyond that:

• ·Nothing is shared with immigration professionals or IRCC at our initiative. The professional handoff summary is a document you download and choose to share yourself.
• ·We disclose personal information to authorities only where required by law.

You may, at any time:

• ·Access the personal information we hold about you (your workspace shows most of it directly; email us for a complete export).
• ·Correct inaccurate information — most fields are directly editable in Prep.
• ·Withdraw consent and close your account, subject to the retention periods below.
• ·Ask questions or object to how your information is handled by emailing privacy@navisa.io.

If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada (OPC).

Your case data remains available while your account is active. After account closure, it remains available for export for 30 days and is then deleted, except where a longer retention period is required by applicable law (for example, billing records). Consent and decision records are retained with the case file for as long as the case file exists.

Prep runs on the same infrastructure and security controls as the Navisa platform: encryption in transit and at rest, access controls, and tenant isolation (your case data is scoped to your account alone). Details are in the Navisa Privacy Policy.

• ·Privacy questions: privacy@navisa.io
• ·Legal: legal@navisa.io
• ·Company: NovaCore Systems Inc., British Columbia, Canada
• ·Regulator: Office of the Privacy Commissioner of Canada — priv.gc.ca