Privacy

Who is responsible for your information

Amalan Mahendran, a licensed life insurance advisor in Ontario (licence 11120499), is responsible for the personal information this site collects, and is the person to contact about it. Insurance products are sold by BCA Insurance Brokers Ltd.

This policy is written to meet Canada's federal private-sector privacy law, the Personal Information Protection and Electronic Documents Act (PIPEDA), which is the law that applies to an insurance business in Ontario.

What this site collects, and why

When you ask for a price. The quote form asks for six things about you and three ways to reach you:

What	Why it is asked
Date of birth	Insurers price on age nearest your birthday. A year alone is the wrong question.
Sex at birth	Insurers publish separate rate tables. Without it the price would be a guess.
Tobacco use in the last twelve months	The single largest factor in a life insurance price after age.
Province	Rates, availability and the rules that govern them differ by province.
Coverage amount and term	What you want covered, and for how long.
First and last name, email address, phone number	So the prices can be sent to you and an advisor can answer questions about them.

We also record which page you arrived from, the date and time, and that you agreed to be contacted, with the date of that agreement.

We do not ask for health details to produce a price. A full health questionnaire is part of an application to an insurer, which is a separate step you would start knowingly, and which is not yet part of this site.

We never ask for, and you should never send us, a Social Insurance Number, a bank account number or a credit card number by email or through this site.

When you sign in. Your email address, your name, and, if you give one, your phone number, so your account and your advisor have somewhere to reach you.

Automatically. Ordinary web server records — the request, the time, and a one-way hash of your IP address used only to stop one machine submitting the form hundreds of times. The hash cannot be turned back into your address.

What we do with it

• Produce your estimate, by sending the six pricing facts (and nothing that identifies you) to WinQuote, the Canadian quoting service this site uses.
• Send your prices to you, and let a licensed advisor follow up about them.
• Prepare an application to an insurer, if you decide to make one.
• Meet the record-keeping obligations a licensed advisor has.

We do not sell your information, we do not rent it, and we do not share it with anyone for their own marketing.

The cookies this site sets

This site sets no advertising cookies and shares none of its cookies with anyone. It sets three first-party cookies of its own, each for one job, and none of them follows you to other sites.

mp_visitor, which remembers your answers. If you complete the quote form, this cookie holds the answers you gave about the coverage you want — the amount, the term, your date of birth, your sex at birth, whether you use tobacco, and your province — so that you are not asked to type them again. It does not hold your name, your email address or your phone number; those are asked for only when you create an account, and they are kept in that account. It is encrypted and marked HttpOnly, which means no script running in your browser can read it; only this site's server can open it. It lasts 180 days, or until you clear it.

mp_phone, which proves your mobile number. When you create an account we text a six-digit code to the mobile number you give us. While that is happening, this cookie holds the number and a scrambled form of the code so the server can check what you type. It is encrypted and HttpOnly in the same way. A code lasts 10 minutes; once the number is confirmed, the cookie lasts 30 minutes more, long enough to finish creating the account, and then expires on its own. The number itself is then kept in your account, not on the device.

mp_role, which tells the page which button to show. Once you are signed in, this cookie holds one word — whether you are a client, an advisor or an administrator — so that the top of every page can show "My dashboard" instead of "Sign in" without slowing the page down. It holds nothing else, it is not encrypted because there is nothing in it to protect, and it grants no access: what you are allowed to see is decided by your sign-in session, never by this cookie. It is cleared when you sign out.

To clear them: clear site data for this site in your browser. That deletes all three immediately, and the next visit starts with a blank form and signed out.

Signing in also sets the cookies your session needs. Those are required for the site to work and cannot be turned off while you are signed in; signing out removes them.

We do not use advertising cookies, and there is no consent banner on this site because there is nothing on it to consent to.

Email and text messages, and how to stop them

Canada's Anti-Spam Legislation (CASL) requires your express consent before we send you anything promotional by email or text. You give it when you create your account to see your prices: the sentence under the button names the advisor who follows up and the firm he offers insurance through, and we store the version of that wording you agreed to, the date, and the address it came from.

• Messages about your own quote, application or policy are transactional. You will keep receiving those while a request of yours is open, because they are how you are told what is happening.
• Anything promotional stops the moment you ask. Every such message carries an unsubscribe link, and you can also reply to any message, or email or phone the address and number below, and say so.

Withdrawing consent does not affect a quote you have already asked for.

Where it is kept, and who can see it

Your information is stored in a database hosted in Canada (Supabase, ca-central-1), and it is protected by row-level security rules that make each record readable only by you, the advisor assigned to you, and the administrator of this business.

Three services outside that database handle some of it:

• Vercel, which hosts this site. Everything you type into a page here reaches the database by passing through Vercel's servers first, and its ordinary server records log the request. Vercel operates outside Canada, which means that traffic, and the records of it, may be processed in another country and could be accessible to that country's courts and law enforcement. This is the case for essentially every website host.
• WinQuote, the Canadian quoting service, receives the six pricing facts. It is not given your name, email address or phone number.
• Resend, our email provider, handles the messages we send you and therefore sees your email address and the contents of those messages. Resend operates outside Canada, which means that information may be processed in another country and could be accessible to that country's courts and law enforcement. This is the case for essentially every email provider.

Everyone who sees your record — your advisor, an administrator — does so under a written obligation to keep it confidential. Nobody else can open it at all: the restriction is enforced by the database itself, which will only return your record to you, to the advisor assigned to you, and to the administrator of this business.

How long it is kept

• Quotes and enquiries that go no further: kept while there is a reasonable prospect of following up, and no longer than seven years.
• Applications and policies: seven years after the policy ends, which is what an advisor's record-keeping obligations require.
• Replacement paperwork (where a new policy replaces an existing one): at least three years, because an insurer will not settle a replacement claim without it.
• Consent records: for as long as we hold the information the consent relates to, because the consent is the reason we hold it.

Your rights

You can ask, at any time, to:

• See what we hold about you, and be told what it has been used for and who it has been given to.
• Correct anything that is wrong.
• Withdraw your consent to be contacted.
• Have it deleted. Where the information is attached to a policy an insurer has issued, the law requires us to keep the record; in that case we anonymise it rather than destroy it, and we will tell you plainly that this is what we have done.

Ask by email or by phone, using the contact details below. We will answer within 30 days, which is the period PIPEDA sets. There is no charge. We may have to confirm who you are before we hand anything over, which protects you rather than us.

If you are not satisfied

Tell us first — email or phone, below — and we will try to put it right. If you are still not satisfied, you can complain to the Office of the Privacy Commissioner of Canada, which is free and independent:

• Toll-free 1-800-282-1376
• priv.gc.ca

Complaints about the conduct of a licensed insurance agent in Ontario go to the Financial Services Regulatory Authority of Ontario (FSRA). Our complaints page explains the whole path, in order.

If something goes wrong

If personal information is lost or accessed by someone who should not have it, and there is a real risk of significant harm to you, we will tell you and the Office of the Privacy Commissioner of Canada as soon as we reasonably can, as PIPEDA requires — and we will tell you what happened, what it means for you, and what to do about it.

Changes to this policy

If this policy changes in a way that affects how your information is used, we will say so on this page and date the change. The date at the top is when it was last updated.

How to reach us

Amalan Mahendran, Privacy Officer Licensed life insurance advisor, Ontario, licence 11120499 Insurance products sold by BCA Insurance Brokers Ltd. Phone 416-721-0709 · Email insurewithamal@gmail.com

If you would rather write, ask by phone or email for a postal address and we will give you one.