Privacy Policy

Clientaly is an insurance client-management platform operated by Cybercana Consulting Inc. (“Cybercana”, “we”, “us”). This policy explains how personal information is collected, used, disclosed, and protected in connection with the Clientaly platform, in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation.

Our two roles

For subscribers (agents, brokers, MGAs): we collect account information such as your name, business name, email, phone, province, and billing details to provide and bill for the service.

For our subscribers’ clients: insurance professionals using Clientaly store information about their own clients — including contact details, dates of birth, family relationships, policy information, and, where relevant to insurance needs, health-related information. For that information, the insurance professional or their firm is the organization accountable for the data; Cybercana acts as a service provider that processes it on their instructions and does not use it for any other purpose.

Where the platform is offered

Clientaly is offered to insurance professionals operating in Ontario, British Columbia, Alberta, Manitoba, Saskatchewan, Nova Scotia, New Brunswick, Prince Edward Island, Newfoundland and Labrador, Yukon, the Northwest Territories and Nunavut.

Personal information handled through the platform is subject to the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and, where the subscriber operates in British Columbia or Alberta, to those provinces' Personal Information Protection Acts. Where a province has health-information legislation applying to information a subscriber collects, the subscriber remains responsible for meeting it.

Clientaly is not offered in Quebec. It is not designed to meet the requirements applicable to the personal information of Quebec residents under the Act respecting the protection of personal information in the private sector, as amended by Law 25, and must not be used to manage clients resident in Quebec.

What we collect

Account and profile information; client records entered by subscribers (contact, demographic, policy, financial, and health-related details as needed for insurance advice); communications sent through the platform; technical logs (IP addresses, login history, access records); and payment information, which is processed by Stripe — Cybercana never sees or stores complete card numbers.

Why we collect it

To provide, secure, and improve the platform; to authenticate users and prevent unauthorized access; to send service communications; to process subscription payments; to maintain audit trails required for regulatory compliance; and to meet our legal obligations. We do not sell personal information, and we do not use client records stored by subscribers for advertising.

Consent

Subscribers accept this policy, the Terms of Service and the Data Processing Terms before using the platform, and are asked to accept again when a material change is published. Subscribers are responsible for obtaining meaningful consent from their own clients for the collection and use of client information, including any sensitive health information collected for insurance purposes. Clientaly records consent history to support this obligation.

Where data is stored

Data is stored in Canada (AWS ca-central-1 region) through our infrastructure providers Supabase and Vercel. Data is encrypted in transit (TLS) and at rest (AES-256). Access within Cybercana is limited to personnel who need it to operate and support the service, and access to health-related records through the platform’s compliance and export tools is logged.

Disclosure

We disclose personal information only: to service providers that host and operate the platform (Supabase, Vercel, Stripe, PurelyMail, and Google — for users who connect Gmail/Calendar); when required by law or lawful authority; or with consent. Our service providers are bound to comparable levels of protection.

Retention

Client records are retained for as long as the subscriber’s account is active and thereafter according to insurance record-keeping norms (generally seven years) unless earlier deletion is requested and legally permissible. Breach records are kept for a minimum of 24 months as required by PIPEDA.

Your rights

You may request access to, or correction of, personal information we hold about you. Clients of our subscribers should direct access and correction requests to their insurance advisor, who can fulfil them through the platform; we will assist as needed. Contact our Privacy Officer, Iqbal Mann, at privacy@clientaly.com. You may also contact the Office of the Privacy Commissioner of Canada.

Commercial email

Quote, marketing and review messages are sent by the subscribing insurance professional or their firm, not by Cybercana. They identify that sender, include the sender’s mailing address, and carry an unsubscribe link, in accordance with Canada’s Anti-Spam Legislation (CASL). Unsubscribing stops commercial messages; transactional messages about existing business (such as document-signing requests) may still be sent.

Breach notification

We maintain a breach-response process. Where a breach of security safeguards creates a real risk of significant harm, we will notify affected organizations and individuals and report to the Privacy Commissioner as required by law.

Changes and contact

We may update this policy from time to time; material changes will be communicated to subscribers and require renewed acceptance. Questions: privacy@clientaly.com — Privacy Officer: Iqbal Mann, Cybercana Consulting Inc., Ontario, Canada.