Personal guidance needs personal information. Here is how we handle it.
This Policy explains what BeaconEd collects, why it is needed, which providers help us, how long information is kept, and the choices available to students and customers.
PRIVACY QUESTIONSteam@beaconed.caTHE SHORT VERSION
Built around the service, not a profile.
BeaconEd collects the information needed to process an order, prepare the student's Beacon, deliver it, and operate the site.No account required
A Beacon purchase uses Stripe and a protected Tally form. It does not create a new BeaconEd account.
Used to build your Beacon
Questionnaire answers are used to research, prepare, review, and deliver the personalized document.
No sale of student data
BeaconEd does not sell, rent, or trade personal information or use Beacon questionnaire answers for behavioural advertising.
Questions are welcome
Students and customers can ask about access, corrections, deletion, consent, or a privacy concern.
BeaconEd is an Ontario educational-planning service. In this Policy, "BeaconEd," "we," "us," and "our" refer to BeaconEd. "Services" includes the public website, Your Beacon, the University Readiness assessment, and access maintained for existing BeaconEd accounts.
BeaconEd handles personal information in accordance with applicable Canadian privacy law, including the Personal Information Protection and Electronic Documents Act where it applies. This Policy does not replace the separate privacy notices of Stripe, Tally, universities, OUAC, or other third parties a person chooses to use.
Who we are and accountability
BeaconEd is responsible for personal information under its control, including information processed for us by service providers. The Privacy Officer is accountable for our privacy practices and receives questions, requests, and complaints.
We identify purposes before or when information is collected, limit collection to what is reasonably needed, use safeguards appropriate to sensitivity, manage providers, respond to incidents, and provide a process for access and correction.
Information we collect
The information collected depends on the service used. A student profile can become sensitive when grades, priorities, constraints, and family circumstances are combined, so we treat the full record accordingly.
Beacon checkout and order
Checkout email, amount, currency, payment status, transaction references, timestamps, delivery status, and limited billing details received from Stripe. BeaconEd does not receive or store the full card number entered in Stripe Checkout.
Confirm payment, securely unlock the questionnaire, connect the payment to the correct order, deliver the service, prevent fraud, resolve disputes, and maintain required financial records.
Beacon questionnaire
Name and contact details; school, grade, courses and marks; interests, program ideas, goals, priorities, location or cost considerations, constraints, and questions; and any other information the student chooses to provide through the Tally form.
Understand the student's situation and prepare a researched, personalized Beacon.
Beacon work and delivery
Research notes, program shortlist, source register, draft and completed Beacon, scholarship thank-you document, clarification messages, delivery records, and support communications about the order.
Research, review, deliver, document, and support the purchased service.
University Readiness
Student name and email, one parent or guardian name and email supplied by the student, assessment answers and result, completion time, and limited referral or campaign information.
Calculate and show the result, save the submission, send the requested confirmation and next-step emails, prevent duplicate submissions, and understand which outreach led to the assessment.
Existing accounts
For people who already have a BeaconEd account: email, authentication identifiers, profile details, saved planning data, and session or security records.
Maintain and protect existing account access. A new account is not required or created when someone purchases a Beacon.
Technical and analytics
IP address, browser and device information, requested pages, timestamps, request and security logs, essential cookies, limited device-local settings, and aggregate public-page analytics such as page, referrer, country, browser, operating system, and device type.
Operate and secure the website, preserve essential sessions, diagnose problems, prevent abuse, and understand aggregate use of public pages.
BeaconEd does not ask for a Social Insurance Number, government identification, banking password, full card details, medical record, diagnosis, or disability documentation. A student may describe the kind of learning environment or support they want without sharing a diagnosis.
How we collect and use information
BeaconEd collects information:
- directly from a student, customer, or existing user;
- through Stripe Checkout, Tally forms, email, and the website;
- from service providers, such as a payment confirmation, email delivery result, security event, or analytics record;
- from public and authoritative sources used for university, program, admission, scholarship, and application research; and
- when a person contacts BeaconEd or requests support.
We use personal information to:
- process and verify a purchase;
- securely connect the paid order to its questionnaire;
- research, prepare, review, and deliver the Beacon;
- send the complimentary scholarship document;
- request clarification and respond to service questions;
- operate University Readiness and existing accounts;
- maintain financial, security, delivery, and dispute records;
- prevent abuse and diagnose technical problems; and
- measure public-page use in aggregate and improve the service.
BeaconEd does not use Beacon questionnaire answers for an unrelated purpose without new consent or another lawful basis.
Your Beacon purchase and questionnaire
A Beacon is purchased without creating an account. Stripe collects the checkout information needed to process payment. BeaconEd receives limited payment and contact information, then sets a protected, browser-specific claim that helps prevent a copied Checkout Session link from opening the paid form.
After Stripe confirms payment through a signed webhook, the customer can open the Tally questionnaire. BeaconEd gives Tally a random, time-limited token for that order. BeaconEd stores a one-way hash of the token rather than the usable token itself. Tally sends the completed submission through a signed webhook, allowing BeaconEd to confirm that the correct paid form was submitted.
Questionnaire answers and related research are used to prepare and deliver the Beacon and the later scholarship document. They are not used to decide university admission, and BeaconEd does not send the answers to a university or OUAC.
Students, parents, and consent
Students and parents or guardians each have privacy rights in their own information. A parent or guardian is not required to participate in every Beacon, but a student under 18 must have a parent or legal guardian make or authorize the purchase and consent to the information needed for the service.
BeaconEd is not directed to children under 13. If we learn that personal information was submitted by a child who could not provide meaningful consent and no valid parent or guardian authorization exists, we will stop the related processing and take reasonable steps to delete the information unless law requires otherwise.
A capable student's information is not automatically available to a parent or another person. BeaconEd may ask for consent, authority, or identity confirmation before discussing a student-specific file. A request by one family member does not automatically grant access to another person's information.
When information is shared
BeaconEd does not sell, rent, or trade personal information. We disclose it only as reasonably needed:
- to providers that operate the service for BeaconEd;
- to the student or customer receiving the purchased work;
- to a parent, guardian, or adviser when the individual has authorized that sharing or another lawful basis applies;
- to professional advisers under appropriate confidentiality obligations;
- to investigate fraud, security threats, abuse, or a dispute;
- when required by law, court order, or lawful authority; or
- in a proposed business transfer, subject to confidentiality and lawful limits on use.
Clicking a university, OUAC, scholarship, or other external link takes the person to a third party. BeaconEd does not send the Beacon questionnaire to that site merely because a link was clicked.
Service providers and other countries
Providers process information for BeaconEd under their agreements, privacy notices, security controls, and applicable law. BeaconEd limits the information supplied to what is reasonably needed for the provider's role.
| Provider | Role | Information |
|---|---|---|
| Stripe | Secure checkout and payment processing | Card and billing details entered on Stripe, checkout email, amount, currency, payment status, and transaction references. |
| Tally | The paid Beacon questionnaire and other identified forms | Form answers, hidden security token, form and submission identifiers, submission time, and related technical information. |
| Supabase | Database, protected order records, and existing account infrastructure | Order state, payment email, hashed security tokens, submission references, University Readiness records, and existing account or profile data where applicable. |
| Vercel | Website hosting, security, request logs, and public-page analytics | Technical request data and privacy-focused aggregate analytics from the public pages BeaconEd has enabled for measurement. |
| Resend | Transactional and requested email delivery | Recipient name and email, message content, sender and reply-to details, and delivery or error metadata. |
| HubSpot | Customer relationship records and University Readiness follow-up | Contact details, role, source, journey stage, campaign information, shared family reference, and related communication or service records. Assessment answers and scores are not sent to HubSpot by the current University Readiness integration. |
| AI-assisted research providers | Assistance organizing research or drafting parts of a Beacon | Only the student context and research material reasonably needed for the task, subject to BeaconEd's review and the provider's applicable terms. |
BeaconEd's Supabase project is configured in Canada. Tally states that form data is stored in Europe. Resend states that its primary data storage and processing are in the United States. Other providers and their subprocessors may process information in Canada, the United States, Europe, or other jurisdictions. Information in another country may be available to courts, law enforcement, or national-security authorities under that country's laws.
AI-assisted work and human review
BeaconEd may use AI-assisted tools to help organize research, compare source material, or draft parts of a Beacon. Only the student context and research material reasonably needed for that task should be provided. BeaconEd does not intentionally submit a Beacon questionnaire for the purpose of training a public AI model.
AI output can be incomplete or wrong. It does not make an admission decision or replace official sources. BeaconEd remains responsible for the service and a person reviews the material before a completed Beacon is delivered.
AI providers may process information outside Canada under their own service and privacy terms. A person with a concern about AI-assisted processing can contact the Privacy Officer before submitting the questionnaire to discuss the service.
Cookies, analytics, and technical data
BeaconEd uses essential technology needed to operate and secure the service. This includes an HttpOnly cookie that binds a browser to the Beacon checkout it began and authentication cookies for existing account holders. The checkout claim is not used for advertising and is limited to the paid form path.
Vercel hosts the website and can create request and security logs. BeaconEd also uses Vercel Web Analytics on selected public pages. The reports available to BeaconEd are aggregate, are not tied to an identified visitor, and do not use third-party advertising cookies. BeaconEd does not send analytics from the protected Beacon questionnaire page.
University Readiness may use session storage for limited attribution information, and certain existing tools may store a device-local preference. Browser controls can clear or block cookies and local storage, although blocking essential storage can prevent checkout return, sign-in, or another requested feature from working.
BeaconEd does not currently use third-party advertising pixels or cross-site behavioural advertising. We will update this Policy and provide a choice where required before introducing non-essential tracking.
Retention and deletion
BeaconEd keeps personal information only as long as reasonably necessary for the stated purpose and for legal, accounting, security, access, complaint, and dispute obligations. The period depends on the record:
- Beacon questionnaires, research files, completed documents, and delivery communications are kept while the service is prepared and for a limited period afterward to support delivery, correction, access, and disputes.
- Unused or expired security tokens are revoked or expire and are removed according to operational and security schedules.
- Payment and accounting records are kept for the period required by tax, accounting, fraud-prevention, and payment- dispute obligations.
- University Readiness and existing account records are kept while needed for the requested feature and a limited period for security, access, or follow-up.
- Technical logs, backups, email records, and provider copies follow operational, security, legal, and provider deletion schedules.
When information is no longer needed, BeaconEd deletes, destroys, or anonymizes it using methods appropriate to its sensitivity. A deletion request may be limited where a record must be kept for law, security, payment, or an active dispute.
Safeguards and privacy breaches
BeaconEd uses administrative, technical, and physical safeguards appropriate to the sensitivity and scale of the information. These include provider access controls, encrypted connections, server-only credentials, signed Stripe and Tally webhooks, one-way token hashes, limited staff access, protected order records, backups, and monitoring intended to prevent unauthorized access or alteration.
No system can promise absolute security. BeaconEd investigates suspected incidents, takes reasonable containment and recovery steps, keeps required breach records, and notifies affected people and the appropriate regulator when the law requires it. Please report a suspected privacy or security issue promptly to team@beaconed.ca.
Access, correction, and complaints
Subject to lawful limits, a person may ask BeaconEd to explain whether we hold their personal information, provide access, describe how it has been used or disclosed, correct an error, or delete information that is no longer needed. A person may also withdraw consent to future processing, subject to legal or contractual limits and reasonable notice.
Send a request to team@beaconed.ca with enough detail to locate the record. BeaconEd may verify identity and authority before responding. We aim to respond within 30 days, unless law permits an extension, and will explain any lawful refusal or limit.
If a concern is not resolved, the individual may contact the Office of the Privacy Commissioner of Canada or another privacy regulator with jurisdiction.
Service and marketing emails
BeaconEd may send emails needed to provide a requested service, including payment or questionnaire follow-up, clarification requests, Beacon delivery, the scholarship thank-you document, security notices, and replies to a question. These messages are connected to the transaction or request and may still be needed even if the person does not want marketing.
Promotional email requires consent or another lawful basis. A promotional message will identify BeaconEd and include a usable unsubscribe method where required. BeaconEd will respect an unsubscribe request within the period required by Canada's anti-spam law. Withdrawing marketing consent does not stop service or legally required communications.
Changes and contact
BeaconEd may update this Policy as the service, providers, or law changes. The "Last updated" date identifies the current version. If a change is material, BeaconEd will provide notice and obtain new consent where required before using information for a materially different purpose.