Privacy Policy

How we collect, use, disclose and safeguard your personal information when you use Ralspin in Canada.

§ 01Who we are

Ralspin is a curated subscription service that helps families, young adults, schools and school boards discover summer camps, fellowships, research placements, certifications, apprenticeships, Red Seal trades and youth conferences, with deadline alerts and 1:1 consultation sessions.

The service is operated by Fezzo Consulting LLC, a Michigan limited liability company doing business as Ralspin. We are an organization subject to the federal Personal Information Protection and Electronic Documents Act ("PIPEDA") when we collect, use or disclose personal information of Canadians in the course of commercial activities, and to provincial privacy legislation that applies in the province where you reside (including Quebec's Act respecting the protection of personal information in the private sector as amended by Law 25, British Columbia's Personal Information Protection Act and Alberta's Personal Information Protection Act).

§ 02Scope and updates

This policy applies to personal information about Canadian residents that we collect through our website, mobile interfaces, SMS messages, email communications and consultations. For users located outside Canada, refer to the United States or United Kingdom version of this policy as appropriate.

§ 03Our privacy principles

We follow the ten fair information principles set out in Schedule 1 of PIPEDA:

§ 04What we collect

Account information

Name, email address, mobile phone number, hashed password, subscription plan (Self-Starter, Household or Institution), and for institutional accounts, your role and the name of your school or board.

Match profile information

Postal code, audience type (yourself, a child or teen, or your students), and the opportunity categories you select. Optionally, age or grade level, academic interests, financial-aid preferences and accessibility needs.

Student profile information (Household and Institution accounts)

Up to four student profiles on a Household plan and up to 500 on an Institution plan. Profiles may include first name or initials, grade level, age range, interests and saved opportunities. We treat student profile information as sensitive personal information and apply enhanced safeguards.

Payment information

Processed by our payment partner (such as Stripe). We do not store full payment card numbers; we receive a tokenized reference, the last four digits, the card brand, billing postal code and transaction history.

Communications

Records of your contact with us by email, phone, in-product chat and during consultation sessions, including content and metadata.

Usage and technical data

Pages viewed, opportunities saved or skipped, searches run, IP address, browser type, device identifiers, operating system, language preference, time zone, referring URL, and approximate location derived from IP. We use first-party cookies and similar technologies; see our Cookie Policy.

§ 05Purposes of collection and use

We collect, use and disclose personal information for the following purposes:

• To provide the curated matching service and generate opportunity recommendations.
• To send deadline alerts and account communications by SMS and email.
• To deliver and schedule consultation sessions.
• To process subscription payments and prevent fraud.
• To operate, maintain, secure and improve the service.
• To send marketing communications, with your express consent under CASL (Section 9 below).
• To comply with legal and regulatory obligations.

We will not use your personal information for any new purpose without first obtaining your consent.

§ 06Consent (express and implied)

By creating an account or providing personal information, you give us your express consent to the collection, use and disclosure of that information for the purposes set out in this policy. For sensitive personal information (including student profiles) and for marketing communications under CASL, we will obtain your express opt-in consent.

For non-sensitive operational purposes (such as recording analytics on service usage), we may rely on implied consent where the purpose is obvious from the context and would be reasonably expected by an individual using a service of this nature.

You may withdraw your consent at any time by contacting our Privacy Officer, subject to legal or contractual restrictions and reasonable notice. Withdrawing consent may mean we can no longer provide some or all of the service to you.

§ 07How we share information

We disclose personal information only as described below:

• Service providers. Hosting and infrastructure providers, payment processors, SMS gateway providers, email providers, customer-support tools, analytics tools and consultation scheduling platforms — under written contracts that limit their use of the data.
• Schools and institutional administrators. Where your account is part of an Institution subscription, authorized administrators at that institution may see relevant student profiles, saved opportunities and aggregate engagement reports.
• Legal and safety. Where disclosure is required or permitted by law, including in response to a subpoena, warrant, court order or other lawful process, or where necessary to protect the safety of any person.
• Business transfers. In connection with a merger, acquisition, financing, reorganization or sale of assets, in which case the recipient will be bound by this policy until any replacement is adopted.
• With your direction. Where you choose to share information with a third party, for example by applying to an opportunity through an external link.

We do not sell personal information.

§ 08Cross-border transfers

Personal information collected from Canadian residents is processed and stored primarily on servers located in the United States, and may be accessed by our service providers in other jurisdictions. While in another jurisdiction, personal information is subject to the laws of that country, which may permit lawful access by foreign courts, law enforcement and national-security authorities. We use contractual safeguards (data-processing agreements, standard contractual clauses where applicable) and technical safeguards (encryption in transit and at rest) to protect personal information in transit and at rest.

By using the service, you acknowledge this cross-border transfer. If you do not consent to cross-border processing, please do not use the service. You may direct any questions about cross-border transfers to our Privacy Officer.

§ 09SMS and email under CASL

Canada's Anti-Spam Legislation ("CASL") regulates commercial electronic messages sent to Canadian recipients. We will send you commercial electronic messages — including our weekly opportunity dispatch — only after you have given your express consent through a clearly identified opt-in box during sign-up or at another point in the service. Transactional and service messages (deadline alerts, account notices, billing notices) are sent under your account agreement and on the basis of your express consent at sign-up.

Every commercial message we send includes our identifying information and a clear unsubscribe mechanism that operates within 10 business days. You may also reply STOP to any SMS to opt out of further messages, or contact [email protected].

Message and data rates may apply. Message frequency varies depending on the opportunities you follow.

§ 10Data retention

We retain personal information only as long as necessary for the purposes for which it was collected, or as required by law:

• Active account data — for the duration of your subscription.
• Closed account data — up to 24 months from cancellation, then deleted or anonymized.
• Billing records — 7 years (to comply with tax obligations).
• Support and consultation records — up to 3 years from the date of last contact.
• CASL consent and unsubscribe records — for the period required by CASL plus any reasonable additional period to demonstrate compliance.

§ 11Security and safeguards

We protect personal information with safeguards appropriate to its sensitivity, including encryption in transit (TLS) and at rest for sensitive fields, role-based access controls, logging and monitoring, regular vulnerability assessments and a documented incident-response plan. We notify the Office of the Privacy Commissioner of Canada and affected individuals of any breach of security safeguards involving real risk of significant harm, as required by PIPEDA's breach-of-security-safeguards reporting rules. Quebec residents will additionally receive notice as required by Law 25.

§ 12Children and minors

Ralspin is not directed to children under 13. We do not knowingly collect personal information directly from a child under 13. Parents or guardians using a Household plan may create profiles for their children that include limited information (first name or initials, grade level, age range, interests). For Quebec residents, the consent of the parent or guardian is required for the collection of personal information of a child under 14.

§ 13Your rights under PIPEDA

Subject to certain limited exceptions, you have the right to:

• Access the personal information we hold about you and to be informed of how it is being used and to whom it has been disclosed.
• Correct personal information that is inaccurate, incomplete or out of date.
• Withdraw consent for further collection, use or disclosure (subject to legal or contractual restrictions).
• Challenge our compliance with PIPEDA and this policy by contacting our Privacy Officer or, if you are unsatisfied with our response, by filing a complaint with the Office of the Privacy Commissioner of Canada (see Section 16).

§ 14Additional rights for Quebec residents

If you reside in Quebec, you have additional rights under Quebec's Act respecting the protection of personal information in the private sector as modernized by Law 25:

• Right to data portability. You may obtain personal information you provided to us in a structured, commonly used technological format.
• Right to de-indexation and cessation. You may request that we cease disseminating your personal information or that we de-index any hyperlink attached to your name where the dissemination contravenes the law or a court order, or causes you serious injury.
• Right to know about automated decisions. If we make a decision based exclusively on automated processing that has a legal or similarly significant effect on you, you have the right to be informed of the personal information used, the factors that led to the decision and the right to request that the decision be reviewed by a person.
• Information about cross-border transfers. You may obtain detailed information about transfers of your personal information outside Quebec, including the assessment of factors we performed before the transfer.
• Right to receive information in clear terms. Where requested, we will explain our practices in simple and clear language adapted to a minor's understanding if the request relates to a person under 14.

Our Privacy Officer (see Section 18) handles Quebec residents' requests and acts as our person in charge of the protection of personal information for the purposes of Quebec law.

§ 15How to access, correct or withdraw

To exercise any of the rights described above, contact our Privacy Officer at [email protected]. We will:

1. Verify your identity by matching information in your request against information we hold.
2. Respond within 30 days. Where additional time is reasonably necessary, we will tell you in writing within the 30-day period and provide our response as soon as possible after that.
3. Respond free of charge in most cases. If a minimal cost applies (for example, for extensive transcription), we will tell you in advance.

§ 16Complaints and oversight

If you are not satisfied with how we have handled your personal information or your privacy request, you may file a complaint with:

• Office of the Privacy Commissioner of Canada — priv.gc.ca, 1-800-282-1376.
• Quebec residents: Commission d'accès à l'information du Québec — cai.gouv.qc.ca.
• British Columbia residents: Office of the Information and Privacy Commissioner for BC — oipc.bc.ca.
• Alberta residents: Office of the Information and Privacy Commissioner of Alberta — oipc.ab.ca.

§ 17Changes to this policy

We may update this policy from time to time. Material changes will be communicated by updating the "Last updated" date and, where required by law, through the service or by email. Your continued use of the service after the effective date constitutes acceptance of the updated policy.

§ 18Contact our privacy officer