Privacy Policy

1. Introduction

The Student Advocacy Survey ("we," "our," or "us") is committed to protecting the privacy of Canadian post-secondary students who participate in our research platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website and participate in our surveys.

This policy complies with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation. We are committed to conducting our research in accordance with the highest ethical standards and privacy regulations.

2. Organization Information

3. Information We Collect

3.1 Survey Response Data (Anonymous)

When you participate in our survey, we collect the following categories of information:

3.2 Optional Contact Information (Separate Collection)

If you choose to opt-in for follow-up research opportunities, we collect your email address in a separate database that is not linked to your survey responses, maintaining the anonymity of your survey data.

3.3 Technical Information

We automatically collect certain technical information:

• Survey completion timestamp
• Language preference (English/French)
• Referral source (if accessing via campus-specific subdomain)

4. How We Use Your Information

4.1 Primary Purposes

• Research and Analysis: To understand student experiences, barriers, and advocacy needs across Canadian campuses
• Advocacy Support: To generate evidence-based insights that support student advocacy efforts
• Institutional Change: To provide anonymized, aggregated data to support policy recommendations
• Trend Analysis: To identify patterns and trends in student experiences over time

4.2 Data Processing Activities

• Political Score Computation: We calculate aggregate scores (economic, social, environmental, governance) from your political values responses to enable cross-tabulation analysis
• Semantic Analysis: Qualitative responses are processed using AI embeddings to identify themes and patterns across responses
• Statistical Analysis: Demographics and responses are analyzed to identify correlations and trends
• Report Generation: Campus-specific and system-wide reports using aggregated, anonymized data

4.3 AI and Machine Learning

We use Google AI's text-embedding-004 model to create semantic representations of qualitative responses. These embeddings are 768-dimensional numerical vectors that capture meaning without storing raw text, enabling us to:

• Identify common themes across responses
• Group similar experiences and concerns
• Generate insights while preserving anonymity

5. Data Storage and Security

5.1 Data Residency

Personal data storage is located in Canada. Some processing services operate from the United States but do not store personal information:

• Primary Database: Google Firestore (Montreal region: northamerica-northeast1) - all survey responses and personal data stored here
• Application Hosting: Firebase App Hosting (us-central1) - compute only, no data storage
• Vector Storage: Pinecone (US region) - anonymized numerical embeddings only, no raw text or personal data
• AI Processing: Google AI - text processed transiently for embedding generation, not stored

5.2 Security Measures

• End-to-end encryption for data in transit (TLS 1.3)
• Encryption at rest for all stored data
• Role-based access controls with principle of least privilege
• Regular security audits and vulnerability assessments
• Automated backup and disaster recovery procedures
• Separation of survey responses from optional contact information
• No collection of directly identifying information in survey responses

5.3 Anonymization Safeguards

• No IP addresses or device identifiers collected
• Demographic combinations designed to prevent re-identification
• Minimum thresholds for aggregated reporting (n≥5)
• Suppression of small cell counts in cross-tabulations

6. Third-Party Services

We use the following third-party services to operate our platform. All services have been selected for their compliance with Canadian privacy regulations:

7. Data Retention

8. Your Rights Under PIPEDA

Under the Personal Information Protection and Electronic Documents Act (PIPEDA), you have the following rights:

9. Data Sharing and Disclosure

9.1 Research and Advocacy Partners

We may share aggregated, anonymized data with:

• Student unions and associations for advocacy purposes
• Academic researchers studying student experiences
• Policy makers working on post-secondary education reforms
• Media organizations reporting on student issues (aggregate statistics only)

9.2 Legal Requirements

We may disclose information if required by law, court order, or governmental regulation, or if we believe disclosure is necessary to:

• Comply with legal obligations
• Protect the rights, property, or safety of our organization or others
• Prevent fraud or abuse of our services

9.3 No Sale of Data

We do not and will never sell, rent, or lease your personal information or survey data to third parties for commercial purposes.

10. Consent

10.1 Survey Participation

By checking the consent checkbox and submitting the survey, you provide informed consent for:

• Collection of the demographic and response data outlined in this policy
• Processing of your responses for research and advocacy purposes
• Inclusion in aggregated reports and analyses
• AI processing for semantic analysis of qualitative responses

10.2 Email Communications

Providing your email address for follow-up opportunities is entirely optional and requires separate, explicit consent through the opt-in checkbox.

10.3 Withdrawal of Consent

You may withdraw consent for email communications at any time by contacting [email protected]. Note that anonymous survey responses cannot be withdrawn once submitted as they cannot be identified.

11. Children's Privacy

Our service is intended for post-secondary students who are 18 years of age or older. We do not knowingly collect personal information from individuals under 18 years of age. If you are under 18, please do not use our service or provide any information through our platform.

12. International Data Transfers

All personal data is stored in Canada (Google Firestore, Montreal region). Some processing occurs in the United States through our service providers:

• Application compute: Firebase App Hosting processes requests in US but does not store personal data
• AI embeddings: Google AI processes text transiently to generate numerical vectors; raw text is not retained
• Vector search: Pinecone stores only anonymized numerical embeddings that cannot be reversed to identify individuals

These transfers comply with PIPEDA as: (1) no identifiable personal information is transferred, and (2) all service providers maintain appropriate security safeguards under their respective privacy policies.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify users of any material changes by:

• Updating the "Last updated" date at the top of this policy
• Posting a prominent notice on our website
• Emailing users who have opted in for communications (for significant changes)

Continued use of our service after changes indicates acceptance of the updated policy.

14. Contact Information

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:

For privacy complaints that cannot be resolved directly with us, you may contact:

15. Accessibility

We are committed to making our privacy policy accessible to all users. If you require this policy in an alternative format or have accessibility concerns, please contact us at [email protected].