Privacy Policy

Introduction

Portify is operated by Shirah Technologies Inc. (“Shirah”, “we”, “our”, and “us”), a company incorporated in Canada. Shirah recognizes the importance of protecting the privacy and the rights of individuals in relation to their personal information. The purpose of this privacy policy (“Privacy Policy”) is to inform you about our privacy practices on Portify, including how we collect, use and disclose your Personal Information.

This Privacy Policy applies to the Portify website at https://portify.shirah.co/ and the Portify platform, including all accounts, tools and features offered through it (collectively, the “Platform”). It applies to all of our operations in Canada or operations in connection with Canada.

Portify is a marketplace and case management platform. It connects individuals and employers with licensed Canadian immigration consultants, and it gives those consultants the tools to run their practice. Shirah operates the Platform. Shirah does not provide immigration advice or representation. That is done by the licensed consultant you engage. This distinction matters throughout this Privacy Policy and is set out in the next section.

This Privacy Policy governs the Platform only. Shirah operates other products, each with its own privacy policy, and its corporate website at https://shirah.co/ has its own. Nothing in this Privacy Policy applies to those.

Who Holds Your Information, and Who Is Responsible for It

Portify has three kinds of account holder, and it matters which one you are.

Applicants and clients. Individuals seeking Canadian immigration services. You provide information about yourself and your family so that a consultant can advise on and prepare your application.

Consultants. Licensed Canadian immigration consultants, regulated by the College of Immigration and Citizenship Consultants, and other licensed professionals, who use the Platform to manage their clients and cases.

Employers. Businesses seeking support with hiring international talent, including labour market impact assessment and work permit processes.

When you engage a consultant through Portify, that consultant is responsible for the professional handling of your file, including their own professional and regulatory obligations regarding your information. Shirah provides and operates the software the consultant uses, and holds the information on their behalf and on yours.

This means two things in practice. Your consultant can see the information in your case. And when you ask us to delete or correct information that forms part of a case file, we may need to route that request to your consultant, or decline it, where the consultant is required by law or by their regulator to retain it.

Privacy Policy Updates

This Privacy Policy is current as of the “last modified” date which appears at the top of this page. We may make changes to this Privacy Policy from time to time, which will become immediately effective when published in a revised Privacy Policy posted on the Platform unless otherwise noted. You are responsible for checking if any amendments have been made to this Privacy Policy. Your continued use of the Platform will constitute your consent to collection, use, and disclosure of your personal information as described in the amended Privacy Policy.

Please review this Privacy Policy carefully. By submitting your personal information (“Personal Information”) to us, by registering for or using the Platform, or by voluntarily interacting with us, you consent to our collecting, using and disclosing your Personal Information as set out in this Privacy Policy, as revised from time to time.

What is Personal Information?

Personal Information means information about an identifiable individual as described under Canadian privacy laws, which may include, but is not limited to, your name, e-mail address and telephone number. Personal Information does not include any business contact information that is solely used to communicate with you in relation to your employment, business or profession, such as your name, position name or title, work address, work telephone number, or work e-mail address.

Personal Information also does not include information that has been anonymized or aggregated in such a way that there is no serious possibility it can be used to identify an individual, whether on its own or in combination with other information.

We collect, use and disclose your Personal Information with your consent or as permitted or required by Canadian privacy laws. How we obtain your consent may be express or implied and will depend on the circumstances, as well as the sensitivity of the information collected. Because immigration information is sensitive, we rely on your express consent for it, given when you create an account and accept this Privacy Policy, and again when you engage a consultant.

If you wish to withdraw your consent to our collection, use or disclosure of your Personal Information, please contact us using the information in the ‘Contact Information’ section below. In some cases, withdrawal of your consent may mean that we will no longer be able to provide the Platform to you, and it may mean your consultant cannot continue to act for you.

Information We Collect About You

What we collect depends on who you are and what you use the Platform for.

From applicants and clients:

Identity and contact information: name, date of birth, email address, telephone number, mailing address, country of residence and citizenship.
Account information: username, password and account preferences.
Immigration information: your immigration and travel history, current status in Canada or elsewhere, expiry

dates, previous applications and any refusals, and the information required by Immigration, Refugees and Citizenship Canada for the application you are pursuing.

Documents you upload: passports and travel documents, status documents, education and credential documents, employment records, police certificates, medical information where an application requires it, proof of funds and financial records, and civil status documents such as marriage and birth certificates.
Information about your family members and dependants, where your application includes them. You are responsible for having their permission, or the authority as their parent or guardian, before you provide it.
Payment information: the last four digits of your credit or debit card, and other payment method details held by our third party payment processors.
Communications: messages, appointment records and video meeting scheduling information exchanged through the Platform.

From consultants:

Identity and contact information, professional licence number and regulatory standing, practice name and business details.
Account, subscription and billing information, including plan, case volume and payout details.
Information about your clients and cases that you enter into or upload to the Platform.
Calendar availability, where you choose to connect a calendar. See ‘Calendar Connections and Google User

Data’ below. From employers:

Business identity and contact information, including business number and registered address.
Role, wage, location and recruitment information required to support a labour market impact assessment or

work permit process.

Information about the candidates you are hiring, where you provide it. From everyone:
Technical information: IP address, browser type, operating system and device information, collected to ensure the security, performance and functionality of the Platform.
Usage information: pages visited, length of visits, page interaction such as scrolling and clicks, and how you navigate the Platform.

Sensitive Information

Immigration information is sensitive. It can reveal your nationality, your family relationships, your health, your financial position, your criminal record if you have one, and your legal status in a country. We treat it accordingly.

We collect it only where it is needed for the application or service you are pursuing. We do not sell it. We do not use it for advertising, and we do not disclose it for advertising purposes. We do not disclose it to any party other than as set out in ‘How We Share Your Personal Information’ below.

How Do We Collect Your Personal Information?

We use different methods to collect your information, including through:

Information you provide directly, when you register, complete an intake, upload a document, message a consultant, book an appointment, make a payment, or contact us.
Information your consultant enters about you, where you have engaged them.
Information an employer provides about you, where you are a candidate in a process the employer has

started.

Information collected automatically through cookies and similar technologies as you use the Platform. See

‘Automatic data collection technologies’ below.

Information from a calendar you or your consultant chooses to connect. See ‘Calendar Connections and

Google User Data’ below.

How We Use Your Information

We use information that we collect about you or that you provide to us in the following ways:

Service delivery: to operate the Platform, match you with a consultant, run your case, prepare and organize documents, schedule and hold appointments, and process payments.
Form preparation: to populate immigration forms with information you have already provided, so that you and your consultant do not re-enter it. See ‘Immigration Forms and Electronic Signatures’ below.
Automated assistance: to operate Porter, our built in assistant. See ‘Porter and Automated Processing’ below.
Notifications: to tell you about status expiries, deadlines and changes relevant to your case.
Platform optimization: to analyze usage data and improve the Platform.
Customer support: to respond to inquiries and provide assistance.
Marketing outreach: to send updates and promotional content based on your preferences, with the option to

opt out at any time. We do not use immigration information for this.

Regulatory compliance: to meet legal, tax and audit requirements.
Security monitoring: to conduct audits and risk assessments that protect your data from unauthorized access

or breaches.

Porter and Automated Processing

Portify includes a built in assistant called Porter. Porter helps organize case information, drafts and summarizes text, and assists with completing forms and routine tasks on the Platform.

Porter processes the information held in the account and case it is working on. It operates as a tool used by you or by your consultant, and its output is a draft. It is not advice, and it is not a decision.

No immigration decision is made about you by automated means on the Platform. Any application, submission or professional recommendation is reviewed and made by a licensed consultant or by you. Where Porter has produced or assisted with a draft, the consultant remains responsible for what is filed.

We do not use your Personal Information, your documents or your case content to train publicly available artificial intelligence models. Where Porter relies on a third party service provider to operate, that provider is bound by contract to process the information only to deliver the feature and not to use it for its own purposes, including model training.

Immigration Forms and Electronic Signatures

The Platform can populate Immigration, Refugees and Citizenship Canada forms using information already in your case, and can capture an electronic signature on a form or authorization.

Autofill is a convenience. It does not verify that information is accurate, current or complete. You and your consultant are responsible for reviewing every form before it is signed or submitted.

Where you sign electronically, we record the signature together with information that establishes it, including the date and time, the account used and the IP address. We retain that record so the signature can be evidenced later. Shirah does not sign anything on your behalf and does not submit anything to a government authority on your behalf.

Calendar Connections and Google User Data

Consultants may choose to connect a calendar so that consultations booked on Portify appear where they already work. This is optional and is initiated by the consultant.

Where a Google account is connected, Portify accesses only free and busy intervals, in order to offer clients genuinely open times, and creates, updates and removes the calendar events for consultations booked through Portify. Portify does not read the contents, titles, attendees or descriptions of a consultant's other calendar events.

Portify's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, Google user data obtained through the Platform is used only to provide and improve the scheduling features described here, is not transferred to others except as necessary to provide those features, to comply with applicable law, or as part of a merger, acquisition or sale of assets with notice to users, is not used or transferred for advertising purposes, and is not read by humans except where the user has given express consent for a specific case, where it is necessary for security purposes such as investigating abuse, to comply with applicable law, or where the data is aggregated and anonymized for internal operations.

A consultant may disconnect a calendar at any time from Calendar and then Connections. On disconnection we stop accessing the calendar and delete the access tokens.

Google API Services: scopes and Limited Use detail

The following expands on the section above and forms part of this Privacy Policy.

If you choose to connect a Google account (for example, to sync your calendar or schedule client meetings), Portify accesses a limited set of Google user data through Google APIs, strictly to power that feature. Connecting is always optional and initiated by you, and you can disconnect at any time.

What we access and why

Calendar events (calendar.events): We create, update, and cancel the appointment events that Portify itself schedules on your calendar, carrying the meeting details and any joining link for the meeting, and we read those same events back to show their status. We only act on the events Portify creates for your Portify appointments.
Free/busy availability (calendar.freebusy): We read your busy time blocks (start and end times only, never the titles, descriptions, guests, or contents of your other events) so we can offer open time slots and prevent double-booking.
Calendar list (calendar.calendarlist.readonly): Where you connect a calendar for booking, we read the list of your calendars so you can choose which one to connect.
Basic profile (userinfo.email, userinfo.profile): Your email and name, to identify and label the connected account.

We request the narrowest scopes needed for these features. We do not request access to read, edit, share, or delete all of your calendars or events.

Limited Use commitment

Portify's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

We only use Google user data to provide and improve the scheduling and calendar features described above.
We do not sell Google user data, and we do not transfer it to third parties except as needed to provide or improve these features, to comply with applicable law, or as part of a merger, acquisition, or sale of assets after notice to you.
We do not use Google user data for advertising.
We do not use Google user data to train, develop, or improve generalized or non-personalized artificial intelligence or machine learning models.
We do not allow humans to read Google user data unless we first obtain your consent to view specific data, it is necessary for security purposes (such as investigating abuse) or to comply with applicable law, or the data has been aggregated and anonymized.

Storage and revoking access

Access and refresh tokens for your Google account are stored encrypted and are used only to perform the actions above on your behalf. You can revoke Portify's access at any time by disconnecting the calendar in your Portify settings, or from your Google Account at myaccount.google.com/permissions. Disconnecting revokes the token and deletes the stored credentials for that connection.

Payments

Payments on the Platform are processed by third party payment processors. We do not store full payment card numbers.

Where you pay a consultant through the Platform, the professional fee is the consultant's fee. Shirah facilitates the payment and remits it to the consultant, and charges its own platform and subscription fees separately. Information about your transactions is used for the same purposes as other information collected in connection with the Platform, and to meet our accounting and tax obligations.

We share your information in the following ways, and no others.

With the consultant you engage, so that they can act for you. This is the purpose of the Platform.
With members of that consultant's team on the Platform, where the consultant has added them to your case.
With an employer, where you are a candidate in a process that employer has started, and only the

information relevant to that process.

With third party service providers who perform services on our behalf, such as data storage (Google Cloud),

email delivery and marketing (Mailchimp), payment processing, and video meetings. They are required to keep your Personal Information secure and to handle it only for the limited purposes for which we disclose it to them. They are not authorized to disclose it to unauthorized parties or to use it for their own direct marketing purposes. Additionally, we may use and disclose your information when we believe such use or disclosure is permitted, necessary or appropriate: (a) under applicable law, including laws outside your country of residence; (b) to comply with legal process; (c) to respond to requests from public and government authorities, including public and government authorities outside your country of residence; (d) to enforce the terms of the agreements for our

products and services; (e) to protect our rights, operations or property; (f) to allow us to pursue available remedies or limit the damages that we may sustain.

If we otherwise intend to disclose your Personal Information to a third party, we will identify that third party and the purpose for the disclosure and obtain your consent.

We do not sell your Personal Information, and we do not disclose it to other organizations for their own direct marketing purposes.

Direct Marketing Communications

We may send you direct marketing communications and information about our services that we consider may be of interest to you, in accordance with applicable marketing laws, including Canada’s Anti-Spam Legislation (CASL). At any time you may opt out of receiving marketing communications from us by contacting us (see ‘Contact Information’ below) or by using the unsubscribe mechanism provided in our marketing communications. Opting out of marketing does not stop the operational messages you need about your case, such as deadline and status notifications.

Security of Your Personal Information

The security of your personal information is very important to us. We take reasonable steps to ensure your personal information is protected from misuse and loss and from unauthorized access, modification, or disclosure, including access controls that limit each account to the cases it is entitled to see.

The safety and security of your information also depends on you. You are responsible for keeping your password confidential and for the activity on your account. We ask you not to share your password with anyone, including a consultant.

Unfortunately, no data transmission over the Internet can be guaranteed to be totally secure. Accordingly, any personal information which you transmit to us online is transmitted at your own risk. Once we receive your transmission, we make our best efforts to ensure its security on our systems.

Transferring Your Information

We may transfer personal information that we collect or that you provide to contractors and service providers we use to support our business, who are contractually obligated to keep personal information confidential, use it only for the purposes for which we disclose it to them, and process it to the same standards set out in this policy.

We may process, store, and transfer your personal information in and to a foreign country, with different privacy laws that may or may not be as comprehensive as Canadian law. In these circumstances, the governments, courts, law enforcement, or regulatory agencies of that country may be able to obtain access to your personal information through the laws of the foreign country. Whenever we engage a service provider, we require that its privacy and security standards adhere to this policy and applicable Canadian privacy legislation. You are welcome to contact us to obtain further information about our policies regarding service providers outside of Canada.

We only collect information by lawful means. When we do, we will collect, use or share your personal information with your consent for the purposes identified or as otherwise permitted or required by law. In some situations, the law allows us to collect, use or disclose personal information without your consent.

You can withdraw your consent at any time. However, withdrawing consent will normally mean that we can no longer provide the Platform to you and that your consultant cannot continue to act for you through it.

You may withdraw your consent to the collection, use or disclosure of your or your child’s personal information at any time by contacting our Privacy Officer (see ‘Contact Information’ below) and, subject to any legal constraints and to your consultant's own retention obligations, we will comply with your request.

Data Subject Rights

You may request access to any personal information we hold about you at any time by contacting us. Where we hold information that you are entitled to access, we will try to provide you with suitable means of accessing it.

If you believe that Personal Information we hold about you is incorrect, incomplete, or inaccurate, you may request us to amend it. We will consider whether the information requires amendment. If we do not agree that there are grounds for amendment then we will add a note stating that you disagree with it, together with your requested amendment. If we correct your Personal Information, we will, so far as is reasonably practicable, inform every other person to whom we have disclosed that information of the correction.

We may request specific information from you to help us confirm your identity and your right to access. In certain situations we may not be able to fulfil your request, and we will explain the reasons when responding. For example, the information may contain details about other individuals, or your consultant may be required by law or by their regulator to retain a case file for a set period.

Data Retention

Except as otherwise permitted or required by applicable law or regulation, we will only retain your Personal Information for as long as necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. Immigration case files are often subject to professional retention requirements that bind your consultant, and where that is the case the file is retained for as long as those requirements demand. Under some circumstances we may anonymize your personal information so that it can no longer be associated with you, and we reserve the right to use such anonymous and de-identified data for any legitimate business purpose.

Choices about how we use and disclose your information

Tracking Technologies and Advertising. You can set your browser settings to refuse all or some browser cookies, or to alert you when cookies are being sent. If you disable or refuse cookies, some parts of the Platform may not be accessible or may not function properly.

Promotional Offers. If you no longer wish to receive marketing email from us, you can opt out by clicking “Unsubscribe” at the bottom of the email or by contacting us.

We do not share your personal information with unaffiliated third parties for their promotional purposes, and we do not use your immigration information to target advertising.

Automatic data collection technologies

The information we collect automatically is statistical information and may include personal information. It helps us to improve the Platform and deliver a better and more personalized service, including by enabling us to estimate our

audience size and usage patterns, store information about your preferences, speed up your searches, and recognize you when you return.

Cookies (or browser cookies). A cookie is a small file placed on the hard drive of your computer or your smartphone. You may refuse to accept browser cookies by activating the appropriate setting on your browser. However, if you select this setting, you may be unable to access certain parts of the Platform, including the parts that require you to be signed in.

Web Beacons. Pages of the Platform and our e-mails may contain small electronic files known as web beacons that permit Shirah, for example, to count users who have visited those pages or opened an email and for other related statistics.

Third Party Use of Cookies and Other Tracking Technologies

Some content or applications on the Platform may be served by third parties. These third parties may use cookies alone or in conjunction with web beacons or other tracking technologies to collect information about you when you use the Platform. We do not control these third parties’ tracking technologies or how they are used. If you have any questions about an advertisement or other targeted content, you should contact the responsible provider directly.

Third Party Websites and Services

The Platform may include links to third-party websites, plug-ins, services or applications. Clicking on those links or enabling those connections may allow the third party to collect or share data about you. These third parties have their own privacy policies, we do not assume responsibility for their privacy practices, and we encourage you to review them before using them.

Use of the Platform by minors

Portify accounts are for individuals who are of the age of majority in their jurisdiction of residence. The Platform is not directed to children, and we do not knowingly allow a child to create an account or knowingly collect personal information directly from a child.

An immigration application often includes dependent children. Where that is the case, the information about the child is provided to us by the parent or legal guardian, who is responsible for having the authority to provide it. We handle that information under this Privacy Policy, and the parent or guardian may exercise the rights in this Privacy Policy on the child's behalf.

Contact Information

We welcome your questions, comments, complaints and requests regarding this Privacy Policy and our privacy practices. Shirah has designated a Privacy Officer who is accountable for our compliance with this policy and with applicable privacy laws. You may contact our Privacy Officer at:

Privacy OfficerShirah Technologies Inc., operator of Portify[email protected]

We have procedures in place to receive and respond to complaints or inquiries about our handling of personal information, our compliance with this policy, and with applicable privacy laws. Please note that we may need to confirm your identity or request additional details in order to process your request.

If your question concerns the professional handling of your immigration file rather than the Platform, your consultant is the right person to ask first, and their regulator can be contacted if you are not satisfied.