Privacy Policy

This Privacy Policy explains how Ontario Bar Academy (“we,” “us,” or “our”) collects, uses, discloses, and protects personal information when you use Ontario Bar Academy (the “Service”). We handle personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable Ontario law.

We collect the following categories of information:

• Account information: your email address, your password (stored only as a salted cryptographic hash, never in plain text), and the date and time you accepted our Terms of Use and this Privacy Policy. We do not ask for your name, address, licensing year or examination date. Accounts created before September 6, 2026 may also hold a name, province, licensing year, intended examination date and examination track that were collected at the time.
• Exam activity: exam attempts, selected answers, flagged questions, timing, and scores, so that we can grade your attempts and show you your performance history.
• Payment information: when you make a purchase, payment is handled directly by Stripe, our payment processor. We receive confirmation that a payment was made and an order reference, but we do not receive or store your full card number, CVC, or other full payment card details.
• Technical information: IP address, user agent (browser/device information), and session identifiers, collected automatically to keep you signed in and to help secure the Service.

• To create and administer your account and authenticate you when you log in.
• To deliver the exam(s) you have purchased or been granted access to, grade your attempts, and show you your results and performance history.
• To process payments and maintain records of purchases.
• To maintain the security and integrity of the Service, including detecting misuse of exam content.
• To communicate with you about your account, purchases, or material changes to our Terms of Use or this Privacy Policy.
• To comply with legal obligations.

We do not sell your personal information. We do not use your information to target advertising at you. We do measure whether our own Google advertisements led to a sign-up or a purchase, as described in section 4.

We use one essential session cookie to keep you signed in. It is required for the Service to function (for example, to know which account is taking an exam) and is not used for advertising.

We advertise on Google Search, and we use the Google tag on this site to tell whether someone who clicked one of our advertisements went on to create an account or buy a practice examination. Google sets its own cookies for this and receives the page address, the fact that a sign-up or purchase happened, and for a purchase the amount paid and an order reference. It does not receive your name or your email address, and we have not enabled Google’s enhanced conversions feature, which would have shared customer contact details. Google processes this information under its own privacy policy. You can opt out at adssettings.google.com, or by blocking third-party cookies in your browser, and the Service will work normally either way.

To understand how the Service is used, we count page views ourselves rather than sending your browsing to an outside analytics company. For each page view we record the page address, the website that linked you to us (if any), and the date and time. We do not store your IP address. To count a visitor once rather than many times, we combine your IP address and browser type with the current date and a secret value to create a one-way code; that code cannot be turned back into your IP address, changes every day, and cannot be used to recognise you on another day or on another website. These records are kept for 90 days and then deleted automatically.

We share personal information only with service providers who help us operate the Service, specifically:

• Stripe (payment processing) receives the information necessary to process your payment. See Stripe’s own privacy policy for details on how it handles payment data.
• Google (advertising measurement) receives the conversion information described in section 4 when you arrive from one of our advertisements. It does not receive your name or email address.
• Brevo (email delivery) receives your email address in order to send account emails such as password resets and purchase confirmations.
• Our hosting and database providers store account and exam data on our behalf, under contractual confidentiality obligations, and may process data on servers located outside Canada.

We do not otherwise disclose your personal information to third parties, except where required by law or to protect our legal rights.

Passwords are hashed using bcrypt and are never stored or transmitted in plain text. All traffic to the Service is encrypted in transit (HTTPS). Session cookies are marked HTTP-only and, in production, secure. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

We retain account and exam activity information for as long as your account is active and for a reasonable period afterward to comply with legal, accounting, or dispute- resolution obligations. You may request deletion of your account and associated personal information as described below.

Subject to applicable law, you may request access to, correction of, or deletion of your personal information by contacting us at support@ontariobaracademy.com. We will respond within a reasonable time. Note that we may retain certain records (such as purchase history) where we have a legal or legitimate business reason to do so.

The Service is intended for adults preparing for professional licensing examinations and is not directed at, or knowingly used to collect information from, individuals under the age of 18.

Our hosting and payment providers may process and store information on servers located outside of Canada, including in the United States. By using the Service, you acknowledge that your information may be transferred to and processed in jurisdictions with data protection laws that may differ from those of your own jurisdiction.

We may update this Privacy Policy from time to time. If we make material changes, we will update the “Last updated” date above and, where appropriate, notify you.

Questions about this Privacy Policy, or requests relating to your personal information, can be sent to support@ontariobaracademy.com.