Privacy Policy
Last updated: October 11, 2026
Who we are
New Roots Canada is operated by New Roots Canada, an independent newcomer settlement companion. This policy explains what personal information we collect, why, the outside services that handle your data, where it is stored, how long it is kept, and how you can access, export, or delete it.
Operator and address. The operator of this platform is New Roots Canada. Our mailing address is 40 Billancourt Crescent, Brampton, Ontario, L6P 1V5, Canada. You can reach us at the privacy contact below.
Privacy contact. Questions about privacy can be sent to support@newrootscanada.com or through our contact page. If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner of Canada.
What we collect and why
- Account email and name — to create and sign in to your account, and to send the reminders and notifications you ask for.
- Settlement profile — journey stage, province, family situation, goals and needs. This personalizes your roadmap, recommendations, and AI answers.
- Tasks, appointments and documents — to track your progress and remind you of deadlines and renewals. Documents are stored privately; we advise you not to store full ID or SIN numbers.
- Saved resources — the listings you bookmark, so they stay available to you.
- Assistant messages — your conversation history with the settlement assistant, so you can return to it.
- Aggregate, non-identifying analytics — counts of how features are used (for example, how often a category is searched). We never store message text, names, or emails in analytics.
We do not collect more than is needed to run the service, and we never sell your personal data. You can browse resources and ask the assistant a few questions without an account; we only create a profile when you choose to sign up and save your progress.
Outside services that handle your data
- Sign-in and hosting — account sign-in, sessions, and app hosting are provided by the Base44 platform, which stores your data on encrypted infrastructure.
- Email — transactional and reminder emails are sent through the platform’s email service.
- AI provider — your questions to the settlement assistant are sent to an AI model to generate an answer. See “How the AI uses what you type” below.
- Payments — paid plans and boosts are processed by Stripe. We never see or store your full card number.
Each service only receives what it needs to perform its task, and your data stays protected by the controls in the Security overview below.
How the AI uses what you type
When you ask the settlement assistant a question, your message (and a short summary of recent messages in the conversation) is sent to an AI model to generate an answer. The model also receives the rules that keep answers accurate and a summary of your settlement profile if you are signed in, so answers can be personalized.
The AI never submits applications, payments, or forms on your behalf and never tells you that you qualify for a program. Answers cite official sources, and you are always pointed to the official page to confirm details. Your assistant conversations are stored with your account so you can return to them; you can delete them at any time by deleting your account.
Where data is stored and how long it is kept
Your data is stored on the platform’s encrypted infrastructure. The country where your data is stored is Canada. We keep your information for as long as your account is active, or as long as needed to provide the service (for example, to send a scheduled reminder). Aggregate analytics are kept without a link to you. When you delete your account, your personal data is removed as described below.
Accessing, exporting and deleting your data
From your profile you can export a copy of everything linked to your account (profile, tasks, appointments, document metadata, saved resources, and assistant messages) as a JSON file.
You can delete your account at any time. The Delete my account button in your profile permanently removes your profile, tasks, documents, appointments, saved resources, conversations, and other records linked to you, and signs you out. Some account record details are managed by the platform and may be removed separately, but your personal data is wiped from the app.
Filing a complaint
You have the right to complain about how we handle your personal information. First, contact us at support@newrootscanada.com. If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner of Canada.
Security overview
Strong security is the baseline, not a premium feature. These practices apply to every newcomer, partner, and listing on the platform.
Secure authentication
Sign-in is handled by the platform’s authenticated backend — tokens, sessions, email verification, and password reset are managed for you. We never store plain-text passwords.
Encryption
All traffic uses TLS in transit, and stored data is protected at rest by the platform’s encrypted storage.
Access controls & role-based permissions
Every data type is protected by row-level security. Newcomers see only their own records; admins are the only accounts that can manage shared content. There are no exceptions.
Secure document handling
Documents you upload are stored privately — no public URL. Only you (and an admin, if needed) can reach them. We explicitly advise you not to store full ID or SIN numbers.
Audit logs
Administrative and automated actions — publishing, verifying, role changes, partnership and report handling — are recorded so the platform stays accountable.
Data minimization
We only collect information necessary for the service. We do not collect personal information simply because it is technically possible.
User privacy controls
You can export a copy of your data, delete your account, manage your reminders, redo onboarding, and sign out at any time — all from your profile.
Secure APIs
Every backend function checks your role and validates its inputs. Privileged operations run as a service role on the server, never from the browser with raw credentials.
Protection against unauthorized access
Row-level security, admin-only writes for shared content, and connector/secret isolation together prevent users from reaching data that is not theirs.