Privacy Policy

Last updated: September 25, 2026

Introduction

VisaFlo Inc. (“VisaFlo”, “we”, “our”, or “us”) is committed to protecting the privacy of lawyers, regulated Canadian immigration consultants and their clients. This Privacy Policy explains how we collect, use, disclose and protect personal information when you use VisaFlo’s websites, client portal and related services. We comply with applicable privacy legislation including Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), provincial privacy laws and, where relevant, the EU General Data Protection Regulation (GDPR). By using our services, you agree to the practices described in this policy.

Information We Collect

 Information you provide

We collect personal information you choose to share with us, including when you:

  • Create an account or complete a profile – name, job title, firm name, professional‑licence details, contact information (e‑mail, phone, address) and documents you upload (e.g., immigration forms, retainers, supporting files).
  • Add contacts or invite clients – client or third‑party names, e‑mail addresses and any data or files uploaded for those contacts.
  • Communicate with us – messages, meeting notes, scheduled events, survey responses or other correspondence.
  • Make payments – billing address and limited payment details (processed securely by our third‑party payment processor, e.g., Stripe). VisaFlo never stores full credit‑card numbers or CVV codes.

 Information collected automatically

When you use the Services, we automatically collect certain technical data, such as:

  • Device and usage information – IP address, browser type, device type, operating system, referring pages, time spent on pages and other diagnostic data.
  • Cookies and similar technologies – cookies, pixels and web beacons that remember your login state, preferences and session security, and help us analyse site usage. You can manage non‑essential cookies via your browser settings, though disabling them may affect functionality.

Client data

Our platform allows you to store sensitive client information (e.g., personal identifiers, immigration documents). By uploading such data, you confirm that you have obtained all necessary consents and that you will comply with your professional and legal obligations.

How We Use Your Information

We use personal information to:

  1. Provide and maintain the Services – authenticate users, populate immigration forms, enable document sharing and facilitate collaboration.
  2. Process transactions – receive payments, issue invoices and provide receipts.
  3. Communicate with you – send transactional e‑mails, security alerts and notices of changes to our terms or policies.
  4. Deliver customer support – respond to enquiries, resolve issues and gather feedback.
  5. Improve and personalise the Services – analyse usage patterns, develop new features and tailor content.
  6. Send marketing communications (with your consent) – newsletters, product updates and promotional offers. You may opt out at any time.

We never use client data to make automated legal or eligibility decisions, nor do we provide legal advice.

Data Security

We employ industry‑standard administrative, technical and physical safeguards to protect your data, including:

  • Encryption – TLS for data in transit; AES‑256 or equivalent for data at rest on Canadian servers.
  • Password protection – passwords hashed with a strong algorithm; optional two‑factor authentication.
  • Access controls – role‑based permissions and audit logs.
  • Monitoring – 24 / 7 server monitoring, intrusion detection and regular vulnerability assessments.

Despite these measures, no system is completely secure. We will notify you without undue delay of any data breach that poses a real risk of significant harm.

Third-Party Disclosure

We do not sell, trade, or otherwise transfer your personal information to third parties without your consent, except as required by law or as necessary to provide our services.

Connected Third-Party Accounts

Some VisaFlo features let you connect accounts you hold with other providers, such as Zoom, Google Calendar, or Microsoft Outlook. Connecting an account is optional and is done through that provider's own authorization screen, where you can review the permissions requested.

When you connect an account we receive and store the account email address, an account identifier assigned by the provider, and access tokens that allow VisaFlo to act on your behalf for the features you enable. For example, we may create a Zoom meeting for a consultation booked through your VisaFlo booking page, read your calendar availability to avoid double-booking, or add a booking to your calendar. Access tokens are encrypted at rest and are used only for these purposes.

We do not sell or share data obtained from connected accounts, and we do not use it for advertising. Meeting join links are shared only with you and the client who booked the consultation. Your use of the connected provider remains subject to that provider's own terms and privacy policy.

You can disconnect an account at any time from Settings › Integrations in VisaFlo, or by removing VisaFlo from the provider (for example, from your Zoom account's installed apps). When an account is disconnected, we delete the stored access tokens and account identifiers for that account.

Cookies

Essential cookies enable core functionality such as authentication and session management. Analytical cookies help us understand how users interact with our Services so we can improve performance and user experience. You can adjust cookie settings in your browser; however, disabling essential cookies may limit functionality. For more detail, please see our Cookie Policy.

Your Rights and Choices

Subject to applicable law, you have the right to:

  • Access the personal information we hold about you and receive a copy of it in a portable format.
  • Ask us to correct personal information that is inaccurate or incomplete.
  • Ask us to delete your personal information, subject to any legal or professional obligations that require us to keep it.
  • Withdraw consent to optional processing at any time, including by disconnecting a connected third-party account.
  • Object to, or ask us to restrict, certain processing of your personal information.

To exercise any of these rights, email info@vflo.app from the email address associated with your account. We may ask you to verify your identity before acting on a request. We respond within 30 days, or tell you within that time if we need longer and why.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Privacy Commissioner of Canada or the data protection authority in your jurisdiction.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. Material changes will be communicated via e‑mail or in‑app notification. Your continued use of the Services after any update constitutes acceptance of the revised Policy.

Contact Us

If you have any questions or concerns about our Privacy Policy or the handling of your personal information, please contact us at info@vflo.app.

We take privacy seriously and will respond to all enquiries promptly and in accordance with applicable laws.