Privacy policy

Updated October 17, 2026

This policy explains how IFRTraining.ca handles personal information through this website, its reader accounts and course enquiries. We aim to collect only what is needed for clear, practical purposes and to respect applicable Canadian privacy requirements, including the Personal Information Protection and Electronic Documents Act (PIPEDA) where it applies.

Who to contact

Our site owner is the privacy contact for IFRTraining.ca. Send privacy questions, access or correction requests, deletion requests and concerns to info@ifrtraining.ca and use “Privacy request” in the subject line.

Information we collect and why

Course waitlist: your first name, email, optional training goal, submitted questions and the course-update request. We use these to administer the requested course list and respond to enquiries.
Contact enquiries: your name, email, optional phone number, subject and message, to respond to your request.
Reader access: your first name, email, verification status and date, session records and any optional marketing-consent evidence. These allow us to verify your email and provide access to full articles and reader downloads.
Request and referral information: submitted page, referral and campaign information, and technical request information used to operate the site, understand the source of enquiries and limit abuse.
Optional analytics: only when you accept optional tracking, information about visits and interactions as explained below.

Please do not send payment-card details, passwords, licence documents or sensitive medical information through our enquiry forms. This website is currently collecting course interest, not processing course payments.

Your choices and consent

Requesting reader access authorizes the verification and sign-in messages needed to provide that service. Joining the course waitlist requests information about that course cohort. Neither action automatically subscribes you to general educational or promotional emails.

General marketing uses a separate, optional, unchecked consent box when available. We record the wording/version, time, source and consent choice with the account or enquiry. You can withdraw by replying “unsubscribe” or emailing info@ifrtraining.ca. Marketing withdrawals are processed without delay and no later than 10 business days, at no cost. Withdrawing marketing consent does not remove your reader access.

Optional-cookie consent is independent of reader access and email-marketing consent. Rejecting optional cookies does not stop you from creating a reader account, unlocking articles, contacting us or joining the waitlist.

Cookies and optional tracking

Necessary reader access: after you verify your email, the first-party ifr_reader cookie keeps you signed in for up to 180 days. It is HttpOnly and SameSite=Lax, and Secure on HTTPS. It contains an opaque session token rather than your email address. Signing out revokes the session. Blocking or deleting this cookie prevents persistent access to full articles and downloads.

Optional analytics and session replay stay off unless you choose “Accept optional cookies”. Rejecting them does not affect reader registration, article access, contact forms or the course waitlist. The same choice applies to configured Google Analytics 4, Google Tag Manager and Microsoft Clarity. An unconfigured service does not run, even if you accept.

If enabled with your permission, Google Analytics may collect page visits, referral information, device/browser information and approximate location. Microsoft Clarity may collect clicks, scrolling and session-replay information. Google Tag Manager can load the tags configured by the site owner; those tags must stay within the optional purposes described here. These providers may process information outside Canada. We do not send names, email addresses or access-link tokens as analytics event parameters.

We remember your accepted or rejected choice in your browser’s local storage under ifr_cookie_preferences_v1, with a version and an expiry of 180 days. An expired browser record is ignored until you make a new choice or clear browser storage. This preference is independent of your reader session and marketing-email consent. Expired or invalid preferences leave optional tracking off and ask you again. If browser storage is unavailable, we keep your explicit choice for the current page only.

Use “Cookie settings” in the footer to change your choice. Withdrawing an earlier acceptance clears known first-party analytics cookies where accessible and reloads the page so optional scripts are not loaded again. This stops future optional tracking on the refreshed page; it does not undo data already sent. Third-party cookies and information already held by providers may require their controls or your browser’s privacy settings.

Search Console verification is a site-ownership token, not audience tracking. Hosting, security and email services may also process technical logs to operate the service; the optional-cookie controls do not disable these necessary functions. Contact info@ifrtraining.ca for questions or requests concerning your information.

Service providers and information outside Canada

We use Vercel to host the website, Resend to deliver service and enquiry emails, a hosted Upstash Redis database for private reader records, and the configured email mailbox to handle enquiries. If accepted and configured, optional analytics providers are Google and Microsoft. Providers may process information outside Canada, where it may be subject to local laws and lawful access by authorities.

We do not sell enquiry or reader-account information. We use service providers for the purposes described here and may disclose information when legally required or when necessary to address fraud, misuse or a security issue.

Retention and safeguards

Verification links expire after 15 minutes and can be redeemed once. Reader sessions last up to 180 days unless revoked earlier. Account information is retained until the account is deleted or closed, subject to information we need to retain for legitimate recordkeeping or legal obligations. Enquiry correspondence and consent evidence are kept as needed to handle the request, administer the course list and document consent. A minimal suppression record may be retained to respect an unsubscribe request.

Reader records are stored server-side, session and verification tokens are stored as hashes, and private storage credentials are not included in browser code. We use access controls and transport security where configured. No internet service can guarantee absolute security. If a privacy incident occurs, we will assess it and take the notification and other steps required by applicable law.

Access, correction, deletion and complaints

You may ask what personal information we hold about you, request access or correction, request account deletion or withdraw consent, subject to applicable legal limits. We may need reasonable verification of your identity before releasing or changing account information. We will explain any restriction or permitted extension that applies.

We respond to access requests within the time required by applicable law; under PIPEDA this is generally 30 days, subject to permitted extensions. The 10-business-day marketing-unsubscribe deadline is a separate process. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada or the applicable provincial privacy regulator.

External links and policy changes

Links to Transport Canada, Reddit, social platforms and other websites take you to services with their own privacy practices. Ordinary social links on this site do not embed their tracking widgets. We may update this policy as the service changes. The updated date above identifies the current version; materially new purposes requiring consent will be explained before that use.