Privacy Policy

1. Who We Are

BenefitCheck.ca is operated by Global Web Rise ("we," "us," or "our"), based in Ontario, Canada. BenefitCheck.ca provides an online calculator that estimates eligibility and approximate amounts for federal Canadian and Ontario provincial benefit programs. You may use the calculator for free, create a free account to save and manage information, and purchase a paid full report with application steps, deadlines, official links, and related account features.

This Privacy Policy describes how we collect, use, disclose, and safeguard your personal information in compliance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and Canada's Anti-Spam Legislation (CASL). For all privacy-related inquiries, contact us at contact@benefitcheck.ca. We will acknowledge your inquiry within 5 business days and respond substantively within 30 calendar days, as required by PIPEDA.

2. Information We Collect

2.1 Calculator Inputs

When you use the calculator, you provide inputs such as approximate income, family composition (for example, marital status and number of children in age bands), age, disability status, housing costs, and province of residence. We do not request your legal name, Social Insurance Number, government identification, or banking details, and these inputs are not personally identifying on their own.

We treat these answers as sensitive information under PIPEDA. Income, disability and household details are the kind of information that can reveal a great deal about a person, and PIPEDA asks for safeguards that match how sensitive the information is. In practice that means: your answers are stored under row-level security so only your account can read them, they are never sold or shared for advertising, they are never attached to an analytics event, and the amounts you entered are never printed in an email subject line. If you use the calculator without an account, the calculation is stored against a browser identifier rather than a person (see 2.6).

2.2 Email Address

We collect your email address when you create or access an account, request a magic link, use Google sign-in, purchase the full report, request support, or type it into one of the boxes that offers to send you your report. We use it for three purposes, and we describe all three at the point where we ask:

• Report delivery — sending you the benefits report you asked for, and the link that opens it again later.
• Account notices — signing you in, confirming a purchase, sending the Stripe receipt, answering support and refund requests, and telling you about changes to this policy or to the service.
• Benefit updates — occasional email about changes to the benefit programs you may be able to get, payment dates and filing deadlines, and news about this site.

The first two are transactional: they are messages about something you asked for or bought. The third is commercial email under CASL, and section 4 sets out how we ask for your consent to it and how you stop it. Creating a free account does not by itself give access to the paid full report.

2.3 Account and Sign-In Data

We use Supabase Auth for passwordless email magic links and Google OAuth sign-in. Depending on the method you choose, Supabase may provide us with your email address, user ID, sign-in timestamps, provider information, display name, and profile photo URL. We use this information to create and maintain your account, link eligible purchases to the correct email address, and protect your account from unauthorized access. We do not receive your Google password.

2.4 Payment Information

Payment-card data is collected and processed by Stripe, our payment processor. We never see or store full card numbers, CVV, or expiry dates. Stripe shares with us only the metadata needed to provide the service:

• Last four digits of the card and card brand (for receipts and customer support).
• Billing postal code (for fraud prevention).
• Stripe customer ID and Checkout Session ID.
• Amount, currency, and timestamp of the charge.
• Payment status, refund status, and purchase metadata needed to unlock the report.

2.5 Analytics

We collect first-party analytics events (page views, scroll depth, paywall funnel events, button clicks). Each event is associated with a randomly generated session ID and visitor ID, not your email. Where an event relates to an email subscriber, we record only a one-way SHA-256 hash of the lowercased email — never the raw email address. We also collect:

• Browser and device type.
• Referring URL and UTM parameters on first page view of a session.
• General geographic region inferred from request metadata (no precise location).

We also use Google Analytics and Google Ads measurement on every page. Both use cookies set by Google. Google Ads uses them to count how many visits that started from one of our ads go on to finish a calculation, start a checkout or buy a report. We do not send Google your name, your email address or your calculator answers, and we have turned off Google's ad personalization on this site.

2.6 Visitor ID and Browser Storage

The first time you open the site, your browser generates a random visitor ID and saves it in that browser's local storage. It is a random string. It is not derived from your email, your name, your device, or your IP address, and on its own it does not tell us who you are.

We use it for two things:

• The free calculation limit. Without an account you can save one calculation per browser. The visitor ID is how we count it, and it is stored alongside that calculation so the limit survives a page reload.
• Joining up analytics events from the same visit, so we can see that a page view and a button click came from one session rather than two people.

We also use local storage to hold your recent calculations on your own device, and to remember which report you were about to unlock so that returning from the payment page takes you back to the right place.

You can clear all of this at any time by clearing your browser's site data. Doing so removes the visitor ID and the locally stored calculations. It also resets the free calculation limit for that browser, and it does not delete anything held in your account — for that, see section 8.

2.7 Server Logs

Our hosting provider records standard request logs. Where our application stores request metadata for abuse prevention, rate limiting, or diagnostics, IP addresses are stored as one-way hashes rather than raw IP addresses. We may also retain user-agent strings for diagnostics and security troubleshooting.

2.8 What We Do Not Collect

• Social Insurance Numbers.
• Government-issued identification documents or numbers.
• Full credit card numbers, CVV, or expiry dates.
• Passwords (we use passwordless email magic links).
• Google passwords or full Google account credentials.
• Precise geolocation.

3. How We Use Your Information

• Deliver calculator results and, where purchased, the paid full report.
• Create and maintain free accounts, authenticate sign-ins, and protect account access.
• Send the Stripe receipt and a magic-link sign-in URL after purchase.
• Link paid purchases to the account that uses the same email address.
• Maintain your account so you can review, save, and recalculate reports.
• Provide customer support and respond to refund or access requests.
• Improve the calculator and the website by analyzing aggregated usage.
• Detect fraud and abuse, and protect the integrity of the service.
• Send you updates about benefit programs, payment dates and deadlines, where you have consented to receive them.
• Count free calculations against a browser, so the free limit works without an account.
• Comply with legal obligations, including the six-year record-retention requirement under the Income Tax Act for purchase and tax records.

We never use your calculator answers to target advertising, and we do not sell or rent your email address. Section 4 explains which of our emails are commercial messages under CASL, how we ask, and how you stop them.

4. Email: Consent, Categories, and How to Stop

Canada's Anti-Spam Legislation (CASL) governs commercial email. Under CASL the burden of proving consent is ours, for every address, so this section describes the mechanism we actually use and the record we actually keep.

4.1 How We Ask for Consent

We ask through a labelled field, not a pre-ticked box. Where we ask for your email address — for example the box that offers to send you your report — the field is labelled with what the address is for, and a sentence directly beside it states the purpose before you submit. That sentence reads:

We'll email your report and send you updates about your account and benefits. Unsubscribe anytime.

It is followed by a link to this policy. Typing your address into that field and submitting it is the act we treat as your consent. There is no pre-ticked box and no consent hidden in a longer document.

We record this as implied rather than express consent, because the same action that accepts the updates also requests the report — you cannot decline one and keep the other on that screen. We say so plainly here rather than claim a stronger consent than the screen supports. You can change the answer at any time, and 4.3 says how.

4.2 The Kinds of Email We Send

Some of our email is transactional — it is about something you asked for or bought, and it continues for as long as you have an account or an open purchase, because it is how the service works. That includes your report, sign-in links, receipts, refund correspondence, security notices, and notices about changes to this policy.

The rest is commercial email, and it comes in three categories:

• Benefit updates — changes to the benefits you may be able to get.
• Important dates and deadlines — payment dates and filing deadlines.
• Everything else — occasional news about this site.

You can set these categories on our preferences page at benefitcheck.ca/email-preferences, reached from the link at the bottom of any message we send. You do not need an account, and changes are saved as you make them. We are still rolling the category settings through our sending system, so until that work is finished a category you switch off is recorded and honoured by us, but the setting that reliably stops mail today is unsubscribing, which is described next and takes effect immediately.

4.3 How to Withdraw Consent

You can withdraw your consent at any time, in any of these ways:

• Use the unsubscribe link at the bottom of any email we send. It goes to the preferences page and needs no account and no password.
• Choose "Unsubscribe from all" on that page. This stops every commercial email and takes effect right away.
• Email us at contact@benefitcheck.ca and ask. We will action it within 10 business days, which is the CASL limit, and in practice sooner.

Withdrawing consent stops commercial email. It does not close your account and does not stop transactional messages such as a sign-in link you request or a receipt for a purchase, because those are not commercial messages and stopping them would break the service you paid for. If you want your account and data deleted as well, see section 8.

4.4 What We Keep as Proof of Consent

Because the burden of proving consent is ours, we keep a record of it. For each address that consents, we store:

• The date and time consent was given, and the date and time of any withdrawal.
• A one-way hash of the IP address the request came from — never the raw IP address.
• A version identifier for the exact wording that was on screen when you consented, and which page or box displayed it.
• What you did to consent — for example, submitting a labelled email field under that wording.
• Whether the consent was express or implied, and the current state of your subscription and category settings.

We keep the wording versions rather than a free-text copy, so that the record cannot drift from what was actually displayed. This evidence is used only to demonstrate compliance and to honour your choices. Retention for these records is set out in section 7, and it outlasts an unsubscribe on purpose: proving that we stopped when you asked requires keeping the record that you asked.

5. Stripe — Our Payment Processor

Stripe Payments Canada Ltd., with payment processing performed by Stripe, Inc. (United States), processes all payment card data. Stripe collects and stores that data on its own infrastructure, located outside Canada. We never see or store full card numbers. Stripe's privacy policy is available at https://stripe.com/privacy.

By completing a purchase, you acknowledge that your payment information is transferred to and processed by Stripe in the United States, where it is subject to United States law.

We have entered into the data-protection terms required of Stripe customers, and Stripe is contractually bound to use your payment data only to process the transaction and meet its legal obligations.

6. Where Your Data Is Stored

Your account, calculation, and purchase records are stored in our Supabase database. The Supabase project URL currently configured for production is checked at launch from the Supabase Dashboard, including the project's database region; depending on the configured region, this data may be stored in Canada or the United States. Our website is served by Vercel, which routes traffic through edge locations around the world.

• Accounts, calculations, purchases, analytics events, and authentication records: Supabase (database region as configured for our project).
• Payment-card data: Stripe (United States).
• Outgoing email delivery: Resend (United States).
• Website hosting and edge cache: Vercel (global edge network).

Where personal information is processed outside Canada, we use contractual and technical safeguards consistent with PIPEDA's accountability principle to ensure a comparable level of protection.

7. Retention

• Purchase and tax records (Stripe receipts, invoices, refund records): retained for at least six (6) years to meet the Canada Revenue Agency record-retention requirement.
• Account and calculation data: retained for as long as your account is active. You may request deletion at any time.
• Authentication records and magic-link events: retained as needed for account security, fraud prevention, diagnostics, and legal compliance.
• Analytics events: retained for up to 26 months in raw form, then aggregated or deleted.
• Email subscriber records: retained for as long as you are subscribed, and for 3 years after your last interaction.
• Proof of consent (the timestamp, the hashed IP address, the wording version, and the record of any withdrawal, as described in 4.4): retained for 3 years after consent is given or withdrawn, which is the CASL limitation period. We keep these after an unsubscribe on purpose — the record of your request is what proves we honoured it.
• Visitor ID and locally stored calculations: held in your own browser until you clear its site data. Where a visitor ID is stored with an anonymous calculation on our side, it is retained with that calculation.
• Server logs: rotated by our hosting provider on a rolling basis (typically 30–90 days).

To request deletion of your account or any personal information we hold about you, email contact@benefitcheck.ca. We may retain limited records of completed purchases to satisfy tax-law retention obligations even after your account is deleted; those records are no longer linked to a live account.

8. Your Rights Under PIPEDA

As a user of our Services, you have the following rights:

• Right of Access: request a copy of the personal information we hold about you. We respond within 30 days.
• Right to Correction: ask us to correct information you believe is inaccurate or incomplete.
• Right to Withdraw Consent: withdraw your consent to any optional processing at any time.
• Right to Deletion: request deletion of your account and associated data, subject to legal retention obligations.
• Right to Complain: if you are not satisfied with our response, you may file a complaint with the Office of the Privacy Commissioner of Canada.

To exercise any of these rights, contact us at contact@benefitcheck.ca. We may need to verify your identity before fulfilling your request.

Office of the Privacy Commissioner of Canada: www.priv.gc.ca

9. Disclosure of Personal Information

We do not sell, rent, or trade your personal information. We disclose personal information only to:

• Service providers (Stripe, Supabase, Google OAuth, Vercel, Resend, analytics providers) that process data on our behalf or at your direction and only as needed to operate the Services.
• Authorities, where required by law, court order, or other lawful demand, or where we believe in good faith that disclosure is necessary to protect rights, safety, or to investigate fraud.
• A successor entity in the event of a merger, acquisition, or sale of our business; we will notify you of any such transfer and any choices you may have.
• Other parties with your express consent.

10. Security

• TLS/HTTPS encryption for all traffic between your browser and our servers.
• Row-level security policies in our database so users can only access their own records.
• Passwordless authentication via Supabase email magic links and optional Google OAuth sign-in.
• Stripe webhook signatures verified server-side; payment events deduplicated by event ID.
• Service-role database keys are kept server-side only and never exposed to the browser.

No system is perfectly secure, but we work to use commercially reasonable safeguards appropriate to the sensitivity of the information we hold.

11. Children

Our Services are not directed at children under 13, and we do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal information, please contact us and we will delete it promptly.

12. Data Breach Notification

If a breach of security safeguards creates a real risk of significant harm, we will notify the Office of the Privacy Commissioner of Canada and affected individuals as soon as feasible, in accordance with PIPEDA, and we will keep a record of the breach as required.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the Effective Date at the top of this page and post a notice on the website. For significant changes that affect how we use your personal information, we will email you where we have your address. Your continued use of the Services after a change becomes effective constitutes acceptance of the revised Policy.

14. Contact

Email: contact@benefitcheck.ca

Website: https://benefitcheck.ca