Privacy Policy

What we collect

Account information. Your email address and a password (we store only a cryptographic hash of your password, never the password itself), your account role, and email-verification status.

Issuer representatives and reviewers. If your account is an issuer-representative or reviewer account, we collect the account information above plus your business contact details — your name, title, and the company or dealer you act for.

Identity and profile information. Your full legal name, contact details (address, telephone, email), residency jurisdiction, and an image of your government-issued photo ID, which we use to verify your identity before you can sign a subscription agreement. If you subscribe through a corporation, trust, or other entity, we collect the entity's legal name, addresses, and its authorized signatory's name and position.

Tax identifiers. Your Social Insurance Number (SIN) if you subscribe personally, or the entity's Business Number — and, for Québec-resident entities, a Québec tax number — if you subscribe through one. These are collected only once a subscription exists, because the issuer's tax filings for a flow-through financing require them. They are used for no other purpose and are never used as a general account identifier.

Suitability and subscription information. To prepare your subscription agreement and support the EMD's mandatory review, we collect the information the agreement and the suitability questionnaire ask for: date of birth, citizenship and tax status (including US-person status), employment and occupation details, financial circumstances (income, assets, liabilities), investment experience, marital status and dependents, banking details for subscription payment, your accredited-investor category, and the regulatory declarations the agreement requires (such as insider, pro-group, and registrant status). We also record the details of each subscription itself — the financing, units, and amounts — and the review and acceptance decisions recorded as it progresses.

Documents. The subscription agreements we generate for you, the signed copies returned from e-signing, and any supplementary documents (such as tax documents) attached to your subscription.

Information about other people. The questionnaire asks for limited information about your spouse (name, occupation, employer) where applicable, and entity subscriptions identify an authorized signatory. If you provide information about another person, you confirm you are entitled to do so.

Information collected automatically. When you sign in we record the session's IP address and browser identity, and our servers keep standard technical logs. Access to your most sensitive records is itself logged: every time a reviewer views your government ID, and every read of a stored tax identifier, is recorded with the viewer and time. Changes to key records are kept in an audit trail. We use a single, essential session cookie to keep you signed in — no analytics, advertising, or third-party cookies.

We collect personal information directly from you, with one exception: our e-signing provider sends us status updates about your signing envelope (sent, delivered, completed, declined).

Why we collect it

• To create and secure your account and verify your email address.
• To verify your identity before you sign — a baseline know-your-client safeguard for everyone transacting on the platform.
• To prepare, deliver, and keep the record of your subscription agreement and its signing.
• To support the EMD's compliance review of your subscription, which is mandatory for every flow-through subscription on CFX.
• To enable the issuer to consider, accept, and complete your subscription, including confirming receipt of funds.
• To prepare the tax documents a flow-through financing requires (such as the T100A, T100B, and renunciation slips — and, for Québec-resident entities, the corresponding Québec filings), which is the sole purpose of collecting tax identifiers.
• To send you service emails about your account and subscriptions and, only if you separately opt in, occasional emails about new financings.
• To keep the platform secure: rate limiting, session management, access logging, and audit trails.
• To meet legal and regulatory obligations that apply to us or to the distribution chain your subscription is part of.

We make no automated decisions about you: identity verification is reviewed by a person, and every subscription is reviewed by the EMD's reviewers — people, not algorithms.

Consent

You accept this policy and our Terms of Use when you create an account, and we record that acceptance (the time and the document version). Providing the information above is a condition of using CFX, because a subscription cannot be prepared, reviewed, or filed without it — if you prefer not to provide it, we cannot provide the service. Marketing email is different: it is optional, off by default, and controlled by a separate consent you can withdraw at any time using the unsubscribe link in any such email.

You may withdraw consent to our handling of your information by closing your account, subject to the retention obligations described below.

Who we share it with

The exempt market dealer. The EMD's reviewers see your subscription, profile, suitability information, and identity-verification record in order to perform their mandatory compliance review.

The issuer you subscribe to. The issuer and its authorized representatives see your subscription — your name, the units and amounts, your signed agreement — in order to accept and complete it, and receive the tax documents described above for filing with the Canada Revenue Agency (and Revenu Québec where applicable).

Service providers. We use a small number of providers to run the platform, each receiving only what its function requires:

Our service providers are bound by contractual terms consistent with this policy and may not use your information for their own purposes.

Legal requirements. We may disclose personal information where required by law, regulation, or a valid legal demand.

We share personal information with no one else. Tax identifiers never appear in the documents you sign and are never sent to the e-signing provider.

Links to other sites. The platform links to third-party websites — issuer websites, and a charitable-donation platform if you choose to donate shares. Following those links shares nothing about you, and what you do there is governed by those sites' own privacy practices, not this policy.

Where your information is stored

Your information is stored in two places. Files — including your government-ID image and your signed documents — are stored in Canada (AWS, Montréal region), encrypted at rest. The platform's database, which holds your profile, subscription, and tax-identifier records, is hosted in the United States, as is our email delivery and e-signing.

This means personal information leaves Canada. While outside Canada, it is subject to the laws of the jurisdiction it is stored in and may be accessible to that jurisdiction's courts, law enforcement, and national-security authorities. We protect it the same way wherever it is processed, using the safeguards described below.

How long we keep it

We keep personal information as long as it is needed for the purposes above and as long as the law requires — and for a platform that supports securities subscriptions and tax filings, several retention obligations are long:

• Records supporting identity verification are kept at least five years, consistent with Canadian record-keeping obligations that apply to the exempt-market distribution chain.
• Tax identifiers and subscription records are kept for as long as the tax documents they feed can be required, audited, or corrected.
• Completed subscriptions and signed agreements are retained as records of the transaction rather than deleted.

When you close your account, we deactivate it and stop using your information for anything except meeting these retention obligations, after which it is deleted or irreversibly anonymized. If you ask us to delete information sooner, we will delete whatever these obligations do not require us to keep.

How we protect it

• All traffic to CFX is encrypted in transit (HTTPS/TLS).
• Files are encrypted at rest; the most sensitive database fields — tax identifiers and banking details — carry an additional layer of application-level encryption on top of database and disk safeguards.
• Access is role-based: reviewers, issuer representatives, and staff each see only what their role requires, enforced on every request.
• Your government ID is viewable only by authorized reviewers through expiring, signed links, and every view is logged. Stored tax identifiers are never displayed back in forms, and every read is logged.
• Sign-in and password-reset endpoints are rate-limited, and sessions can be revoked by deactivating an account.
• Our codebase runs automated security scanning on every change.

No system is perfectly secure. If a breach of our safeguards creates a real risk of significant harm to you, we will notify you and the Office of the Privacy Commissioner of Canada as PIPEDA requires.

Your rights

You may ask us for access to the personal information we hold about you, ask us to correct it, or challenge our handling of it. Your profile and subscription records are visible in your account; for anything else, contact our Privacy Officer below. We respond to access requests within the timelines PIPEDA sets, and if you are unsatisfied with our response you may complain to the Office of the Privacy Commissioner of Canada.

Marketing email

Service emails — about your account, your subscriptions, and their progress — are part of operating the platform and are sent to all account holders. Marketing email about new financings is sent only to people who separately opted in at signup, and every such email carries an unsubscribe link that takes effect immediately.

Changes to this policy

If we change this policy, we will post the new version here with a new version number and effective date, and notify account holders of material changes. Each version of your acceptance is recorded.