Privacy Policy

NCA Edge — operated by 1600339 B.C. Ltd. ("NCA Edge", "we", "us", "our")

Last updated / Effective date: 2 August 2026 · Version 1.0

We take your privacy seriously. This Policy explains what personal information we collect, why, how we use and protect it, who we share it with, and the rights you have over it. It is written to meet Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and British Columbia's Personal Information Protection Act (PIPA), and — for users in those regions — the EU/UK General Data Protection Regulation (GDPR/UK GDPR), the Australian Privacy Act 1988 (and the Australian Privacy Principles), and applicable U.S. state privacy laws (including the California Consumer Privacy Act as amended by the CPRA). Where a specific law gives you stronger rights, that law governs for you.

By using NCA Edge you acknowledge the practices described here. If you do not agree, please do not use the service.

1. Who we are and how to contact us

NCA Edge is a study tool for people preparing for the accreditation examinations of the National Committee on Accreditation (NCA). NCA Edge is independent and is not affiliated with, endorsed by, or connected to the NCA or the Federation of Law Societies of Canada.

The data controller / organization responsible for your personal information is:

1600339 B.C. Ltd. (operating as NCA Edge) 302-540 Lawrence Avenue, Kelowna, BC V1Y 6L7, Canada Privacy contact: hello@ncaedge.com

For the purposes of the GDPR we are a "controller"; for the purposes of PIPEDA/PIPA our Privacy Officer can be reached at the address above. If you are in the EU/UK and we are required to have a representative, contact us and we will provide those details.

2. The information we collect

We collect only what we need to run the service. Specifically:

a. Account and identity

• Your email address (used to sign you in via a one-time link and to contact you).

b. Purchase information

• We use Stripe to process payments. Stripe collects your name, email, and payment card details directly. We do not receive or store your full card number. We receive confirmation of purchase, your email, and which course(s) you bought.

c. Your study activity

• Written answers you submit for marking. Your answers are stored locally in your own browser (so you can review your drafts and results on that device) and are sent to our AI marking provider to be graded (see §4 and §6). On our servers we retain only a cryptographic hash of each answer (not the text), your scores and result bands, and short quoted excerpts contained in the marker's margin notes.
• Multiple-choice answers, progress, and your NCA readiness score.
• Feedback you give on marking (ratings and comments).

d. Exam and outcome information

• The exam sitting date(s) you choose to tell us (used to schedule access and, with your existing-customer relationship, to ask how your exam went).
• Whether you passed or did not pass an exam, if you tell us. This is sensitive to you, and we treat it accordingly.

e. Communications

• Emails and messages you exchange with us, and your email preferences (including any unsubscribe).

f. Technical and usage data

• Standard log and device data such as IP address, browser/device type, and pages requested, collected by our hosting and security providers to deliver and protect the service and prevent abuse.

g. Cookies and local storage

• We use browser local storage to keep you signed in and to store your drafts, answers, and progress on your device. We keep cookies to the minimum needed to run the service and to secure it. See §12.

We do not intentionally collect special-category/sensitive data beyond exam outcomes, and we do not knowingly collect information from children (see §11).

3. Where the information comes from

Almost all of it comes directly from you (what you type, submit, and choose). Some technical data is generated automatically when you use the site. Purchase data comes from Stripe when you buy a course.

4. How and why we use your information (purposes)

Where we rely on consent (for example, optional marketing email), you can withdraw it at any time. Where we rely on legitimate interests, you may object (see §9).

We do not sell your personal information, and we do not use it for third-party advertising or "share" it for cross-context behavioural advertising as those terms are defined under U.S. state privacy laws.

5. Automated processing and AI (Lexi)

Your written answers are marked by "Lexi", an artificial-intelligence examiner built on a large language model provided by Anthropic. This involves automated processing. Lexi's marks and feedback are a study aid, can contain mistakes, are not official NCA results, and do not determine any legal right or obligation. They do not produce a decision with legal or similarly significant effect within the meaning of GDPR Article 22. You can always ask a human (us) to review any concern about your marking by emailing hello@ncaedge.com.

6. Who we share it with (service providers / processors)

We share personal information only with vendors that help us run the service, under contracts that require them to protect it and use it only on our instructions:

• Anthropic PBC — AI marking of your answers. Your answer and the question are sent to Anthropic's API to be graded. Anthropic does not use data submitted through its API to train its models, and applies limited retention. *(United States.)*
• Stripe, Inc. — payment processing. *(United States / global.)*
• Resend — sending our emails. *(United States.)*
• Cloudflare, Inc. — website hosting, content delivery, and security. *(Global.)*
• Analytics/search tools (e.g., Google Analytics / Search Console) on our public marketing pages, where used, to understand traffic in aggregate. *(United States.)*

We may also disclose information when required by law, to enforce our Terms, to protect our or others' rights and safety, or in connection with a business transfer (e.g., a sale or reorganization), in which case we will require the recipient to honour this Policy. We do not otherwise sell, rent, or trade your personal information.

7. International transfers

We operate from Canada, and some of our providers process data in the United States and other countries. This means your information may be transferred outside your home country, including outside the EEA/UK/Australia, where privacy laws may differ. Where required, we rely on recognized transfer mechanisms (such as the European Commission's Standard Contractual Clauses and equivalent UK provisions) and take steps to ensure your information remains protected to the standard described in this Policy. You may contact us for more detail about a specific transfer.

8. How long we keep it (retention)

We keep personal information only as long as needed for the purposes above:

• Account and purchase records — for as long as your account is active and thereafter as needed to meet legal, tax, and accounting obligations.
• Study activity, scores, and outcomes — while your account is active; you can delete them sooner (see §9). Answer text is not stored on our servers (only a hash, your scores, and short excerpts).
• Sign-in and survey tokens — short-lived; expired tokens are purged.
• Backups — held for a limited period on a rolling basis and then overwritten.

When information is no longer needed, we delete or de-identify it.

9. Your rights and choices

Depending on where you live, you have some or all of the following rights. We honour these for all users wherever practicable:

• Access — get a copy of the personal information we hold about you.
• Correction — fix inaccurate or incomplete information.
• Deletion / erasure — ask us to delete your account and personal information.
• Portability — receive your information in a portable format.
• Withdraw consent — including unsubscribing from optional emails at any time.
• Object / restrict — object to processing based on legitimate interests, or ask us to restrict it.
• Non-discrimination (U.S. state laws) — we will not deny you service or charge you more for exercising your rights.
• No sale/appeal — because we do not sell or "share" your information for advertising, there is nothing to opt out of; U.S. residents may still contact us and, where applicable, appeal a decision.

To exercise any right, email hello@ncaedge.com. We will verify your identity (usually by confirming control of your account email) and respond within the time required by your local law (generally 30 days under PIPEDA; one month under GDPR; and as required by other applicable laws). You may use an authorized agent where the law allows.

You also have the right to complain to a regulator:

• Canada — the Office of the Privacy Commissioner of Canada (and, in B.C., the Office of the Information and Privacy Commissioner for British Columbia).
• EU/UK — your local Data Protection Authority, or the UK Information Commissioner's Office (ICO).
• Australia — the Office of the Australian Information Commissioner (OAIC).
• United States — your state Attorney General, where applicable.

We would appreciate the chance to resolve your concern first — please contact us.

10. How we protect your information (security)

We use technical and organizational safeguards appropriate to the sensitivity of the data, including: encryption in transit (HTTPS/TLS) across the site and our API; storing answer hashes rather than answer text on our servers; hashed, single-use sign-in tokens (there is no password to steal); least-privilege file permissions and access controls on our servers; and payment handling delegated to Stripe so we never hold card numbers. No system is perfectly secure, but we work to protect your information and to detect and respond to problems. See §13 on breaches.

11. Children

NCA Edge is intended for adults preparing for professional accreditation and is not directed to children. We do not knowingly collect personal information from anyone under the age of 16 (or the age of majority where you live). If you believe a child has provided us information, contact us and we will delete it.

12. Cookies and local storage

We use browser local storage to keep you signed in and to hold your drafts, answers, and progress on your own device. We use only the cookies necessary to operate and secure the service. On our public marketing pages we may use privacy-respecting analytics to understand traffic in aggregate. You can clear local storage and cookies through your browser at any time; doing so will sign you out and remove locally-stored drafts on that device.

13. Data breaches

If a breach of security involving your personal information creates a real risk of significant harm (PIPEDA) — or otherwise meets the notification threshold under a law that applies to you (e.g., GDPR/UK GDPR, the Australian Notifiable Data Breaches scheme, or U.S. state law) — we will notify the relevant regulator and affected individuals as and when required, and keep records of breaches as the law requires.

14. Changes to this Policy

We may update this Policy from time to time. We will post the new version here with an updated date and, for material changes, take reasonable steps to let you know (for example, by email or an in-app notice). Your continued use after an update means you accept the revised Policy.

15. Contact

Questions, requests, or complaints: hello@ncaedge.com, or write to 1600339 B.C. Ltd. (o/a NCA Edge), 302-540 Lawrence Avenue, Kelowna, BC V1Y 6L7, Canada.