Privacy Policy

NCA Edge — operated by 1600339 B.C. Ltd. ("NCA Edge", "we", "us", "our")

Last updated / Effective date: 11 August 2026 · Version 1.4

We take your privacy seriously. This Policy explains what personal information we collect, why, how we use and protect it, who we share it with, and the rights you have over it. Where a specific law gives you stronger rights, that law governs for you.

By using NCA Edge you acknowledge the practices described here. If you do not agree, please do not use the service.

1. Who we are and how to contact us

NCA Edge is a study tool for people preparing for the accreditation examinations of the National Committee on Accreditation (NCA). NCA Edge is independent and is not affiliated with, endorsed by, or connected to the NCA or the Federation of Law Societies of Canada.

The organization responsible for your personal information is 1600339 B.C. Ltd. (operating as NCA Edge). Our Privacy Officer — the individual accountable for our privacy compliance — can be reached at hello@ncaedge.com.

2. The information we collect

We collect only what we need to run the service. Specifically:

a. Account and identity

• Your email address (used to sign you in via a one-time link and to contact you).
• Your name and country of residence, which we collect to operate your account and to meet our billing, tax, and legal-compliance obligations.
• Your country of qualification (the jurisdiction where you are already qualified to practise law), which we collect to understand our users and tailor the study experience.

b. Purchase information

• We use a third-party payment processor to take payments. It collects your name, email, and payment card details directly. We do not receive or store your full card number. We receive confirmation of purchase, your email, and which course(s) you bought.

c. Your study activity

• Written answers you submit for marking. We store your answers on our servers and submit them to Lexi, our AI examiner, for marking (see §4 and §6). We keep each answer in a content-addressed store keyed by a hash of the answer — the store itself holds no identifying details — and link it back to your account only where needed (through that hash) to run the Service, look into a marking query, or improve and train our models (see §4). A copy is also kept locally in your browser so you can review your drafts and results on that device.
• Multiple-choice answers, progress, and your NCA readiness score.
• Feedback you give on marking (ratings and comments).

d. Exam and outcome information

• The exam sitting date(s) you choose to tell us (used to schedule access and, with your existing-customer relationship, to ask how your exam went).
• Whether you passed or did not pass an exam, if you tell us. This is sensitive to you, and we treat it accordingly.

e. Communications

• Emails and messages you exchange with us, and your email preferences (including any unsubscribe).

f. Technical and usage data

• Standard log and device data such as IP address, browser/device type, and pages requested, collected by our hosting and security providers to deliver and protect the service and prevent abuse.

g. Cookies and local storage

• We use browser local storage to keep you signed in and to store your drafts, answers, and progress on your device. Beyond cookies needed to run and secure the service, we use analytics cookies (Google Analytics) to measure and improve our public website. See §12.

We do not intentionally collect special-category/sensitive data beyond exam outcomes, and we do not knowingly collect information from children (see §11).

3. Where the information comes from

Almost all of it comes directly from you (what you type, submit, and choose). Some technical data is generated automatically when you use the site. Purchase data comes from our payment processor when you buy a course.

4. How and why we use your information (purposes)

Where we rely on consent (for example, optional marketing email), you can withdraw it at any time. Where we rely on legitimate interests, you may object (see §9).

We do not sell your personal information, and we do not use it for third-party advertising or "share" it for cross-context behavioural advertising as those terms are defined under U.S. state privacy laws.

5. Automated processing and AI (Lexi)

Your written answers are marked by "Lexi", an artificial-intelligence examiner built on a large language model provided by a specialist third-party AI provider. This involves automated processing. Lexi's marks and feedback are a study aid, can contain mistakes, are not official NCA results, and do not determine any legal right or obligation. They do not produce a decision with legal or similarly significant effect within the meaning of GDPR Article 22. You can always ask a human (us) to review any concern about your marking by emailing hello@ncaedge.com. Separately, we also use AI-assisted tools to help us build, operate, administer, and support the Service (see §6). Those tools do not make automated decisions about you that produce legal or similarly significant effects.

6. Who we share it with (service providers / processors)

We share personal information only with vendors that help us run the Service. We rely on these providers' standard terms, which include data-protection and, where they act as our processor, data-processing commitments. The categories are:

• An AI/LLM provider — to mark your answers. Your answer and the question are sent to its API to be graded. Under its commercial API terms in effect, the provider states that it does not use data submitted through its API to train its models and applies limited retention; those terms, not this Policy, govern its practices. *(United States.)*
• A payment processor — to take payment and act as merchant of record. *(United States and other countries where it operates.)*
• An email delivery provider — to send our transactional and (if you opt in) update emails. *(United States.)*
• A hosting, content-delivery, and security provider — to run and protect the site. *(United States and other countries where it operates.)*
• A business email provider — to send and receive our correspondence with you (for example, emails to and from our support address, hello@ncaedge.com, and any personal information you include in them). *(Canada.)*
• A web-analytics provider (Google Analytics) — to measure how visitors find and use our public website so we can improve it. It sets cookies/identifiers in your browser and receives usage data such as the pages you view, your approximate location (derived from a truncated IP address), and your device and browser type. We do not use it to build advertising profiles or to sell your information. *(United States and other countries where it operates.)*
• AI-assisted development and operations tools — we use third-party AI assistant and developer tools to help us build, operate, administer, support, secure, and analyze the Service. On our instructions, these tools may process personal information held in our systems — for example, account details such as your name, email, and country of residence — to carry out those tasks. We use providers whose API terms state they do not train their models on data submitted through the API and apply limited retention; those terms govern their practices. *(United States.)*

We do not run third-party advertising cookies, and we do not sell your information or use it for cross-context behavioural advertising. We do use Google Analytics (above) to measure and improve our public website. Where your local law requires consent before analytics cookies are set, we will obtain it.

We may also disclose information when required by law, to enforce our Terms, to protect our or others' rights and safety, or in connection with a business transfer (e.g., a sale or reorganization), in which case we will require the recipient to honour this Policy. We do not otherwise sell, rent, or trade your personal information.

7. International transfers

We are a Canadian business, but your account data and answers are stored primarily on our servers in the European Union (Finland). Some of our service providers process data in the United States and other countries (for example, AI marking, payment processing, email delivery, and the hosting of our public website), while our support email is hosted in Canada. This means your information may be transferred across borders, including outside your home country and outside the EEA/UK/Australia, where privacy laws may differ. For these transfers we rely on our service providers' own data-protection terms and safeguards — including any recognized transfer mechanisms they operate, such as Standard Contractual Clauses in their data-processing terms. You may contact us for more detail about a specific transfer.

8. How long we keep it (retention)

We keep personal information only as long as needed for the purposes above, then delete or de-identify it:

• Account, study activity, answers, scores, and outcomes — kept while your account is active. After your account is closed (or you ask us to delete it — see §9), we remove your data from our live systems and retain a limited archived record — your account, purchase/transaction history, your acceptance record, and the answers and results tied to it — for up to 7 years in restricted-access storage, so we can meet tax and accounting obligations and establish, exercise, or defend legal claims within the applicable limitation period. We then purge it.
• De-identified answers — our answer store is keyed by a hash and holds no identifying details; we may keep these answers indefinitely to improve, evaluate, and train the Service and our models.
• Purchase and tax records — in any event kept for at least 6 years to meet Canadian tax and accounting obligations.
• Sign-in and survey tokens — short-lived; expired tokens are purged automatically.
• Backups — we take nightly snapshots of our database for disaster recovery and delete them on a rolling basis after about 30 days.

9. Your rights and choices

Depending on where you live, you may have some or all of the following rights. We honour these for all users wherever practicable:

• Access — get a copy of the personal information we hold about you.
• Correction — fix inaccurate or incomplete information.
• Deletion / erasure — ask us to delete your account and personal information. We will do so, subject to the limited records we are permitted to keep for tax and legal-defence purposes (see the retention carve-out in §8).
• Portability — receive your information in a portable format.
• Withdraw consent — including unsubscribing from optional emails at any time.
• Object / restrict — object to processing based on legitimate interests, or ask us to restrict it.
• Non-discrimination (U.S. state laws) — we will not deny you service or charge you more for exercising your rights.
• No sale / no "share" — we do not sell your information or share it for cross-context behavioural advertising, so there is nothing to opt out of.
• Appeal (U.S. state laws) — if we decline a request, residents of U.S. states that provide an appeal right may appeal by emailing hello@ncaedge.com with "Privacy Appeal" in the subject line.

To exercise any right, email hello@ncaedge.com.

10. How we protect your information (security)

We use technical and organizational safeguards appropriate to the sensitivity of the data, including: encryption in transit (HTTPS/TLS) across the site and our API; storing on our servers a hash of each answer (rather than its full text), together with your scores and short quoted excerpts from the marking; hashed, single-use sign-in tokens (there is no password to steal); least-privilege file permissions and access controls on our servers; and payment handling delegated to our payment processor so we never hold card numbers. No system is perfectly secure, but we work to protect your information and to detect and respond to problems.

11. Children

NCA Edge is intended solely for adults at or above the age of majority where they live and is not directed to minors. We do not knowingly collect personal information from anyone under the age of majority. If you believe a minor has provided us information, contact us and we will delete it.

12. Cookies and local storage

We use browser local storage to keep you signed in and to hold your drafts, answers, and progress on your own device. Beyond cookies that are strictly necessary to operate and secure the Service, we use analytics cookies (Google Analytics) on our public website to measure and improve it (see §6). We do not use advertising cookies. Where your local law requires consent before analytics cookies are set, we will ask for it. You can clear local storage and cookies through your browser at any time; doing so will sign you out and remove locally-stored drafts on that device.

13. Changes to this Policy

We may update this Policy from time to time. We will post the new version here with an updated date and, for material changes, take reasonable steps to let you know (for example, by email or an in-app notice). Your continued use after an update means you accept the revised Policy.

14. Contact

Questions, requests, or complaints: hello@ncaedge.com.