Privacy Policy

This Privacy Policy explains how Ontario Bar Academy (“we,” “us,” or “our”) collects, uses, discloses, and protects personal information when you use Ontario Bar Academy (the “Service”). We handle personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable Ontario law.

We collect the following categories of information:

• Account information: your email address, your password (stored only as a salted cryptographic hash, never in plain text), and the date and time you accepted our Terms of Use and this Privacy Policy. We do not ask for your name, address, licensing year or examination date. Accounts created before September 6, 2026 may also hold a name, province, licensing year, intended examination date and examination track that were collected at the time.
• Exam activity: exam attempts, selected answers, flagged questions, timing, and scores, so that we can grade your attempts and show you your performance history.
• Payment information: when you make a purchase, payment is handled directly by Stripe, our payment processor. We receive confirmation that a payment was made and an order reference, but we do not receive or store your full card number, CVC, or other full payment card details.
• Technical information: IP address, user agent (browser/device information), and session identifiers, collected automatically to keep you signed in and to help secure the Service.

• To create and administer your account and authenticate you when you log in.
• To deliver the exam(s) you have purchased or been granted access to, grade your attempts, and show you your results and performance history.
• To process payments and maintain records of purchases.
• To maintain the security and integrity of the Service, including detecting misuse of exam content.
• To communicate with you about your account, purchases, or material changes to our Terms of Use or this Privacy Policy.
• To comply with legal obligations.

We do not sell your personal information, and we do not use your information for third-party advertising.

We use a single essential session cookie to keep you signed in. This cookie is required for the Service to function (for example, to know which account is taking an exam) and is not used for advertising or cross-site tracking. We do not currently use analytics or marketing cookies.

We share personal information only with service providers who help us operate the Service, specifically:

• Stripe (payment processing) — receives the information necessary to process your payment. See Stripe’s own privacy policy for details on how it handles payment data.
• Our hosting and database providers — store account and exam data on our behalf, under contractual confidentiality obligations, and may process data on servers located outside Canada.

We do not otherwise disclose your personal information to third parties, except where required by law or to protect our legal rights.

Passwords are hashed using bcrypt and are never stored or transmitted in plain text. All traffic to the Service is encrypted in transit (HTTPS). Session cookies are marked HTTP-only and, in production, secure. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

We retain account and exam activity information for as long as your account is active and for a reasonable period afterward to comply with legal, accounting, or dispute- resolution obligations. You may request deletion of your account and associated personal information as described below.

Subject to applicable law, you may request access to, correction of, or deletion of your personal information by contacting us at support@ontariobaracademy.com. We will respond within a reasonable time. Note that we may retain certain records (such as purchase history) where we have a legal or legitimate business reason to do so.

The Service is intended for adults preparing for professional licensing examinations and is not directed at, or knowingly used to collect information from, individuals under the age of 18.

Our hosting and payment providers may process and store information on servers located outside of Canada, including in the United States. By using the Service, you acknowledge that your information may be transferred to and processed in jurisdictions with data protection laws that may differ from those of your own jurisdiction.

We may update this Privacy Policy from time to time. If we make material changes, we will update the “Last updated” date above and, where appropriate, notify you.

Questions about this Privacy Policy, or requests relating to your personal information, can be sent to support@ontariobaracademy.com.