Privacy Policy

1. Overview

Logics Academy ("we", "us", "our") operates the Foundation platform (foundation.logicsacademy.com), a professional learning community for educators across Canada. This Privacy Policy explains how we collect, use, disclose, and protect your personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation.

2. Information We Collect

Account Information

When you create an account, we collect your name, email address, and optional professional information such as job title, school or organization, and province/territory.

Authentication Data

We support sign-in via email/password, Google OAuth, and Microsoft Azure AD. When you use third-party sign-in, we receive your name and email address from the provider. Passwords are cryptographically hashed and never stored in plain text.

Facilitator Information

If you register as a facilitator, we may additionally collect your mailing address, phone number, Social Insurance Number (SIN), business number, HST/GST registration number, banking or payment information, and compliance documents (e.g., Master Service Agreement, Vulnerable Sector Screening). This information is collected solely for employment, tax reporting (CRA), and payment purposes. SIN and tax numbers are encrypted at the application level using AES-256 encryption.

Usage & Community Data

We collect data generated through your use of the platform, including community posts and messages, event registrations and attendance, professional development progress and certificates, and activity logs for security and support purposes.

3. How We Use Your Information

• To provide, maintain, and improve the platform
• To authenticate your identity and manage your account
• To personalize your experience and recommend resources
• To send event invitations, reminders, and platform updates
• To issue professional development certificates
• To process facilitator payments and tax reporting
• To ensure platform security and prevent misuse
• To improve our services through aggregate, anonymized analytics

4. Data Sharing & Service Providers

We do not sell your personal information. We do not use client-side tracking or analytics scripts. We share data only with the following service providers as necessary to operate the platform:

5. Data Storage & Security

• Your primary data (database, files, authentication) is stored in Canada (AWS ca-central-1 region).
• All connections use TLS/HTTPS encryption in transit.
• Data is encrypted at rest using industry-standard encryption.
• Sensitive financial data (SIN, tax numbers) is encrypted with AES-256-GCM application-level encryption. The encryption key is stored separately from the database.
• Passwords are cryptographically hashed (bcrypt) and never stored in readable form.
• Access to sensitive data is restricted by role-based access controls and row-level security policies.

6. Data Retention

We retain personal information only as long as necessary for the purposes for which it was collected:

• Account data: retained for the duration of your account.
• Facilitator tax data (SIN, invoices): retained for 7 years per CRA requirements, then securely deleted.
• Event registrations and attendance: retained for 3 years for certificate verification.
• Activity and security logs: retained for 12 months.
• Professional development certificates: retained indefinitely as they have ongoing professional value.
• Inactive accounts (no login for 3+ years) may be archived; accounts inactive for 5+ years may be deleted after notice.

7. Your Rights

Under PIPEDA and applicable provincial legislation, you have the right to:

• Access your personal information held by us
• Request correction of inaccurate information
• Request deletion of your account and personal data
• Withdraw consent for optional data collection
• File a complaint with the Office of the Privacy Commissioner of Canada

Deletion requests are processed within 30 days. When your account is deleted, all associated data is permanently removed from our active systems across all platform tables and storage. Deleted data may persist in encrypted backups for up to 7 days before automatic rotation.

8. Cookies & Tracking

We use essential cookies only for authentication and session management. We do not use advertising cookies, analytics tracking scripts, or third-party tracking pixels. We do not participate in cross-site tracking or ad networks.

9. Children's Privacy

Foundation is designed for educators and education professionals. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us immediately.

10. Breach Notification

In the event of a data breach that poses a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada as required by PIPEDA. Notifications will include a description of the breach, the information involved, steps we have taken, and steps you can take to protect yourself.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or platform notification. The "Last updated" date at the top of this page indicates when the policy was last revised.

12. Contact Us

For privacy-related inquiries, data access requests, or complaints, please contact:

You may also file a complaint with the Office of the Privacy Commissioner of Canada at www.priv.gc.ca