Privacy Policy
Effective: June 2026 · Governed by Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).
1. Who we are
Altaris AI Academy ("we", "us") is a Canadian online education provider. Our Privacy Officer can be reached at privacy@altarisai.ca.
2. What we collect
- Account information: name, email, province of residence, password hash.
- Education records: enrollments, lesson progress, capstone submissions, diplomas, verification codes.
- Payment metadata: provider transaction IDs only — full card numbers are processed by Stripe and never touch our servers.
- Mini-course subscribers: email and progress for the free 7-day drip course.
- Coach conversations: messages exchanged with our AI Career Coach, stored to improve recommendations.
- Usage data: pages visited, IP address, browser type, captured by our hosting platform and used for security and analytics.
3. Why we use it
To deliver programs you enroll in, issue and verify diplomas, process tuition, run the free mini-course drip, operate the AI Career Coach, process refund requests, calculate referral credit, and meet our regulatory record-keeping obligations.
4. Who we share with
- Stripe Inc. — payment processing.
- Supabase / Cloudflare — Canadian-region database, authentication, edge hosting.
- Google (Gemini via Lovable AI Gateway) — AI Career Coach inference.
- Employers and post-secondary institutions — only when you publish your verification code or student ID.
5. Where data lives
Primary storage is in a Canadian-region database. Edge functions run on globally distributed Cloudflare Workers; minimal request metadata may transit outside Canada at execution time.
6. Your rights under PIPEDA
You may request access, correction, or deletion of your personal information at any time by emailing privacy@altarisai.ca. We respond within 30 days. Complaints may be escalated to the Office of the Privacy Commissioner of Canada.
7. Retention
Education records (enrollments, diplomas, verification codes) are retained for 7 years to support employer verification. Other records are deleted on request or after 24 months of inactivity, whichever comes first.
8. Cookies
We use only first-party cookies necessary for authentication and CSRF protection. No advertising or third-party trackers.
9. Changes
We will post any material change to this policy with a new effective date and, where required, notify enrolled students by email.