Effective date: June 8, 2026
NPPE Vault ("we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), Canada's Anti-Spam Legislation (CASL), and applicable provincial privacy legislation.
By using the NPPE Vault website and services (the "Service"), you consent to the collection, use, and disclosure of your personal information as described in this Privacy Policy.
| Data type | When collected | Purpose |
|---|---|---|
| Name | Account creation | Personalize your experience, display in your account |
| Email address | Account creation | Passwordless authentication (magic links), account identification, essential service communications |
| Data type | Purpose |
|---|---|
| Exam results and answers | Display your score history and category performance on your dashboard |
| Bookmarks and progress | Allow you to resume and track your study progress |
| Server logs (IP address, browser type, pages visited, timestamps) | Security monitoring, abuse prevention, service reliability |
Payment processing is handled entirely by Stripe, Inc. When you purchase Pro access, your payment card details are collected and processed directly by Stripe. We do not receive, store, or have access to your full card number. We receive only:
Stripe's handling of your data is governed by Stripe's Privacy Policy.
We do not collect:
We use your personal information only for the following purposes:
We do not use your information for:
Under PIPEDA, we collect and use your personal information based on the following forms of consent:
You may withdraw your consent at any time by deleting your account (see Section 7). Withdrawal of consent may result in our inability to provide some or all of the Service to you.
We do not sell, trade, or rent your personal information. We disclose your information only in the following limited circumstances:
We share personal information with the following third-party service providers who process data on our behalf:
| Provider | Purpose | Data shared | Location |
|---|---|---|---|
| Stripe | Payment processing | Payment details (collected directly by Stripe) | United States |
| Resend | Transactional email delivery | Email address, name | United States |
| Railway / Render | Application hosting | All Service data (encrypted at rest and in transit) | United States / Canada |
Each provider is contractually obligated to protect your information and use it only for the specified purpose.
We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., a court order, subpoena, or government regulatory request).
If NPPE Vault is involved in a merger, acquisition, or sale of assets, your personal information may be transferred as part of that transaction. We will notify you via email or a prominent notice on our Service before your information becomes subject to a different privacy policy.
Some of our service providers (Stripe, Resend) are located in the United States. When your personal information is transferred outside of Canada, it may be subject to the laws of the jurisdiction in which it is stored, including the laws of the United States, which may permit government or law enforcement access in certain circumstances.
We take reasonable steps to ensure that our service providers maintain appropriate safeguards for the protection of personal information transferred outside Canada, including contractual protections.
We retain your personal information for as long as your account is active or as needed to provide the Service. Specifically:
| Data type | Retention period |
|---|---|
| Account information (name, email) | Until account deletion |
| Exam results and answers | Until account deletion |
| Payment records | 7 years after transaction (as required by Canadian tax law) |
| Magic link tokens | Deleted after use or expiry (15 minutes) |
| Server logs | 90 days |
When data is no longer needed, we delete or de-identify it using industry-standard methods.
Under PIPEDA and applicable provincial privacy legislation, you have the following rights:
To exercise any of these rights, contact us at support@nppevault.com. We will respond to your request within 30 days, as required by PIPEDA.
We implement appropriate technical and organizational measures to protect your personal information, including:
While we take reasonable measures to protect your information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.
NPPE Vault uses minimal client-side storage:
We do not use:
In compliance with CASL, we only send you electronic messages that are:
We do not send marketing or promotional emails. If we introduce optional marketing communications in the future, we will obtain your express consent (opt-in) before sending them, and every such message will include a clear unsubscribe mechanism.
All our electronic messages include:
The Service is not directed to individuals under the age of 18 (or the age of majority in their jurisdiction). We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected personal information from a child, we will take steps to delete it promptly.
We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or by posting a prominent notice on the Service at least 30 days before the changes take effect.
We encourage you to review this Privacy Policy periodically. The "Effective date" at the top indicates when it was last updated.
If you have questions, concerns, or requests regarding this Privacy Policy or our handling of your personal information, please contact us:
Email: support@nppevault.com
If you are not satisfied with our response, you have the right to file a complaint with the Office of the Privacy Commissioner of Canada.