Privacy

01Who is responsible

BoomVersity is operated by JD Vortex, a business based in Ontario, Canada. JD Vortex is responsible for the personal information handled on the platform and follows Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA).

Privacy questions and requests: support@boomversity.com.

02What we collect

Agencies and colleges: names, work emails, roles, the organisation and its address, and, for agencies, the details reviewed before they can file.

Students: the details and documents an application needs, entered by the student or their agency. This can include passport details, date of birth, citizenship, contact details, transcripts, test scores, study background, budget, previous study-permit refusals and notes about the application.

Guardians of students under 18: a name, relationship, email and phone, the approval or change request they give, and a record that they verified their email.

Use of the platform: sign-in records, server logs kept by our hosting providers, and minimal error reports (a category and the area of the app, with no names, messages or file content). The public site uses no advertising or analytics trackers.

03Why we use it

To carry an application from the agency to the college and back, to keep the record of it, and to show each person on a file what they are allowed to see.

To send the emails the platform needs, such as sign-up confirmations, password resets and guardian verification codes.

To run the pilot: to review agencies, answer questions, keep the service secure and working, and keep the business records the law requires.

04Who sees what

A file is visible to the agency that opened it, the student, the guardian who approves it, and the college it was sent to. Nobody else sees it, and files are not shared between colleges.

A small JD Vortex team can see files to run the service, review submissions and answer support requests, and keeps that access to a minimum.

05AI program suggestions

When an agency asks for program suggestions for a student, we send OpenAI the student’s age, citizenship, country of residence, whether they are international or local, study background and grades, English test, budget, field of interest, study gap, refusal history, preferences and any notes, together with the program catalogue. We do not send the student’s name, email or phone number.

We ask OpenAI not to store these requests; under its API terms the data is not used to train its models, though it may be kept for a limited time for abuse monitoring. Agencies should not put names or details the suggestion does not need into notes.

06Service providers

We use a small number of providers to run the platform. Each one handles information only to provide its service to us:

Supabase: database, sign-in and document storage, in Canada (Montréal). Cloudflare: delivering the website and protecting it from attacks. Microsoft (Azure Communication Services) and Listmonk, our email tool hosted with Railway: sending the platform’s emails. OpenAI: AI program suggestions. Google: only if you choose to sign in with Google.

Some of these providers process information outside Canada, mainly in the United States. Information processed there may be accessible to authorities in that country under its laws.

07Where it is kept and how it is protected

The platform’s database and documents are stored in Canada. Information is encrypted in transit and at rest; documents are kept in private storage and opened through links that expire. Access inside the platform is limited by role and by file.

08How long we keep it

Files are kept while an application is open and for two years after it closes (withdrawn, refused, or the student enrolled or did not enrol), so letters and outcomes stay available. They are then deleted.

Commission, invoice and payment records are kept as long as Canadian tax law requires. Backups expire on their own schedule after deletion. A college’s own copies of what it received are the college’s to keep.

You can ask us to delete your information sooner. We will, unless the law requires us to keep it or it is needed to settle a dispute.

09Students under 18

A student under 18 can use the platform with their agency, but their applications need a parent or guardian’s approval before they are sent. The guardian proves control of their email address with a one-time code before seeing or answering the request.

10Browser storage

The platform keeps your sign-in in your browser’s storage so you stay signed in, and remembers a few display choices. It does not use advertising cookies.

11Your rights

You can ask to see the information we hold about you, to correct it, to withdraw consent or to have it deleted. Write to support@boomversity.com; students and guardians can do this without an account, from the email the platform knows them by. We answer within 30 days.

If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca).

12If something goes wrong

If a breach of security puts people at real risk of significant harm, we tell the people affected and the Privacy Commissioner of Canada, as the law requires, and keep a record of every breach.

13Changes

This policy may change. The date at the top is the version that applies, and we will tell account holders about changes that matter.