Master Privacy Policy

Welcome to Lexova. Lexova is a product and trade name of TEXOVA INC. ("we," "us," or "our"), a corporation with its business address at Suite 1063, 3909 University Ave NW, Calgary, AB T3B 6K3, Canada. References to "Lexova" in this policy mean TEXOVA INC. or, where the context requires, the Lexova platform it operates. We provide a secure, multi-tenant software platform designed to assist Agencies (law firms and immigration consultancies), Employers, and Individual Clients in preparing, managing, and organizing applications for Immigration, Refugees and Citizenship Canada (IRCC), Employment and Social Development Canada (ESDC), and provincial immigration authorities.

We are headquartered in Alberta, Canada, and our data practices are strictly governed by the Personal Information Protection and Electronic Documents Act (PIPEDA), Alberta's Personal Information Protection Act (PIPA), and Quebec's Law 25.

This policy applies to the Lexova platform, the lexova.ca website, the emails Lexova sends, the Lexova for IRCC browser extension, and Lexova's business outreach to immigration professionals.

To comply with Canadian privacy laws, it is important to understand our role in handling your data:

• Data Controller: The Authorized Representative (Agency/Agent) or Employer who invited you to the platform determines the purpose of the data collection (i.e., preparing an immigration application).
• Data Processor: For case information, Lexova acts solely as the Data Processor. We provide the secure technology infrastructure to store and organize this data on behalf of the Data Controller. We do not own, review, or use your data for our own purposes. Lexova's platform administration tools give no access to case content, and the automated processing described in section 9 is carried out only to provide the features the Data Controller uses.
• Lexova's Own Information: Lexova itself decides why and how a limited set of information is used, and is responsible for it as an organization: account and sign-in information, firms' billing information, the support requests and technical reports users send us, security and audit logs, website cookies (section 8), the counts the browser extension reports (section 10), and the business contact information of the immigration professionals we contact (section 12).

Because our platform facilitates government immigration applications, the Personal Information (PI) we handle, including the sensitive documents uploaded, may include:

• Identity & Biometrics: Names, dates of birth, marital status, passports, and national ID cards.
• Immigration & Travel History: Visa records, entry/exit logs, and current immigration status documents.
• Sensitive Personal Data: Police clearance certificates, medical examination declarations, and financial statements.
• Corporate Data (Employers): CRA Notices of Assessment, payroll records, and corporate registries.
• System Data: IP addresses, browser types, and timestamped audit logs of platform activity.
• Express Entry & Language Information: Express Entry application answers and profile details, language test results, and educational credential assessments.
• Information Read from Documents: Facts Lexova AI reads from uploaded documents — such as the type of document, its holder and issuer, dates, document, passport, account and certificate numbers, and test and assessment results — stored with the case (section 9).
• Support & Technical Information: The content and attachments of support requests and email replies, and technical problem reports (section 11).
• Email Delivery Information: Whether each notification email was delivered, opened, or bounced.
• Business Contact Information: The published business contact information of the immigration professionals Lexova contacts (section 12).

We collect only the information necessary to provide our software services. We do not use "bundled" consent.

• No Secondary Use: We will never sell, rent, or process your Personal Information or uploaded documents for secondary purposes, such as marketing, without your explicit, opt-in consent.
• Third-Party Input: If an Agent or Employer inputs data on behalf of a foreign national or family member, they represent and warrant that they have obtained legally valid, explicit consent from that individual to do so.

Your data is protected by strict cryptographic and architectural boundaries. Access is governed by your role:

• Individual Clients (Applicants): Can only view and edit their own profiles, family members, and the specific documents they have uploaded. Clients cannot see the data of any other individual, nor can they view confidential Employer corporate documents.
• Employers (Sponsors): Can only view their own corporate records and the specific application drafts associated with their business. They cannot view an Individual Client's sensitive personal documents (e.g., medical records) unless explicitly authorized for a joint application.
• Agents (Representatives): Can only view the data, documents, and application drafts of the specific Employers and Clients explicitly assigned to their caseload.
• Agencies (Tenant Admins): Have administrative oversight over their own law firm/consultancy, but are mathematically isolated from all other Agencies on the platform.
• Lexova Support: Sees only what a user chooses to send in a support request or technical report. Lexova's platform administration tools give no access to any firm's case content.

All Personal Information and uploaded documents are encrypted in transit (TLS 1.2+) and at rest (AES-256).

Firms' data is kept apart by isolation enforced in the platform and in the database. Sign-up, payment, support and other sensitive requests are checked automatically to tell real browsers from bots, request rates are limited (using IP addresses for a short time), and activity on cases and platform administration actions are recorded in audit logs. If a confidentiality incident involving Personal Information presents a risk of serious harm, we will notify the firm concerned and, where the law requires, the competent privacy regulators and the affected individuals.

• Storage in Canada: Your case files, uploaded documents and database records are stored on servers located in Canada, in a data centre in Montréal.
• Processing Outside Canada: To run the platform, some of our service providers process Personal Information outside Canada, mainly in the United States. Each receives only the information its service needs, uses it only to provide that service to us, is bound by written confidentiality and security obligations, and does not keep your case files or documents. Before relying on such a provider we assess the protection it offers, as Quebec's Law 25 requires. Information processed in another country may be subject to that country's laws, including lawful access by its authorities. These providers are listed below.
• Application Hosting (United States): The servers that run the Lexova web application are located in the United States. Every page you open and every piece of information you enter or upload passes through them on its way to storage in Canada. They are not used to store your files or records. The same provider runs the automatic checks that tell real browsers from bots.
• Form Generation and PDF Conversion (United States): When a filled IRCC form is generated, a document package or exhibit is assembled, a protected PDF is opened, or a firm staff member converts a Word, Excel or PowerPoint file in PDF Studio, the form data or the file is sent to Lexova's PDF service, which runs in the United States, processed, and returned. The service does not keep it. (PDFs and images edited in PDF Studio are handled in your own browser and are not sent anywhere.)
• Lexova AI (United States): When you or your representative use a Lexova AI feature — such as the automatic reading of uploaded documents, document sorting, the coherence check, cover-letter drafting, the client and employer assistants, automatic translation, importing a filled form, migrating a firm's past files, or troubleshooting suggestions for a technical problem — the relevant document content, form answers or message are sent to our artificial-intelligence service provider in the United States to produce the result (see section 9). Under that provider's commercial terms, this content is not used to train its models and is retained only for a limited period.
• Email Delivery (United States): Notification emails sent by the platform — invitations, document requests, reminders, status updates and support-ticket messages — are delivered by our email service provider, which processes the recipient's name and email address and the content of the message. The platform records whether each notification email was delivered, opened, or bounced, as reported by this provider, and shows it to the firm in the case's activity log. When you answer a support email by replying to it, the same provider receives your reply, with any files attached, and passes it to Lexova, which adds it to your support ticket.
• Business Outreach Email: The emails Lexova sends to immigration professionals (section 12) are sent and received through a Lexova mailbox hosted by our business email provider, which processes the recipients' business contact information, the messages and any replies, and may do so outside Canada, including in the United States.
• Payments: Subscription payments by firms are processed by our payment service provider, which may process billing information in the United States. Lexova never receives or stores full card numbers. Applicants' information is never sent to the payment provider.
• Error Monitoring: We use a third-party error-monitoring service to detect and diagnose technical problems. Only technical data (error messages, stack traces, and the page address) is sent — never client Personal Information or form data. Lexova does not attach IP addresses to error reports; the service, like any website a browser contacts, receives the connection's IP address in order to accept the report. This technical data is processed in the European Union.
• Address Lookup: When you type a Canadian address on a form, the address characters you type are sent to Canada Post's AddressComplete service (Canada Post Corporation, Canada) to suggest and complete the address. Only the address text is sent — never your name, file, or any other detail.
• Browser Extension for Representatives: When a firm's representative uses Lexova's browser extension to fill an application in the IRCC portal, the case's answers go from Lexova directly to that representative's own browser, are held only in its memory for at most 60 minutes, and Lexova receives back nothing from the portal except which portal pages were filled, counts of the fields filled, which of Lexova's own question codes a page showed or lacked and, for pages the extension does not recognize, the page's address with its numbers removed — never an answer, and Lexova's servers never connect to IRCC (see section 10).
• Authentication Provider: We use a third-party authentication provider to manage secure sign-in and user accounts. It processes only basic account identifiers — your name and email address — and may store them on servers in the United States. Your case files, uploaded documents, and all other Personal Information remain stored in Canada.

Subject to statutory retention requirements, you hold the following rights regarding your data:

• Right to Access: You may view the information held about you at any time via your portal.
• Right to Portability (Data Export): You may export your data in a portable, commonly-used format (PDF and/or spreadsheet) at any time, and for 90 days after a subscription ends, before it is deleted.
• Right to Rectification: You may correct inaccurate or incomplete data.
• Right to Erasure (To Be Forgotten): You may request the permanent deletion of your account and associated documents.
• Right to Withdraw Consent: You may withdraw your consent at any time, subject to legal and contractual restrictions. Withdrawing it may prevent your Representative from continuing to prepare your application through the platform.
• Automated Processing: You may ask which information an automated feature used and how it reached its result, ask for a correction, and have a person review the result (see section 9).

Because your Representative or Employer is the Data Controller for your case information, requests about that information are usually best sent to them; we will help them answer. You may also contact our Privacy Officer (section 15).

The Lexova marketing website (lexova.ca) uses two kinds of cookies:

• Essential cookies: Required for the site and portal to function — sign-in session, language preference, and your cookie-consent choice. These are always active and are not used for advertising.
• Optional analytics & advertising cookies (Google): Only with your explicit consent via the cookie banner, we load Google tags (Google Analytics / Google Ads) to measure how the site is used and to build advertising audiences of website visitors. If you decline — or simply ignore the banner — no Google script loads at all.

Inside the Lexova application (dashboards, workspaces, and portals), only essential cookies and similar browser storage are used — for example to keep you signed in or to remember a panel you opened — and no analytics or advertising tags are loaded.

You may withdraw consent at any time by clearing this site's cookies in your browser; the banner will ask again on your next visit. Consent choices are stored for 12 months.

Lexova may use the business contact information of ACCOUNT holders (e.g., a firm's administrator name and email) to promote Lexova's own services, with an unsubscribe option in every message (CASL). Case content and applicants' personal information are NEVER used for Lexova's advertising, are never sold, and are never shared with advertising platforms.

Lexova's own social media channels: Lexova publishes its own marketing videos and posts to Lexova's own accounts on YouTube, Instagram, Facebook, TikTok and X through those platforms' official interfaces (including YouTube API Services, Google LLC). This automation touches only Lexova's own channels and Lexova's own content: it never reads, collects or stores any user's data from those platforms, and no Lexova user data is sent to them. Use of YouTube API Services is subject to the YouTube Terms of Service (https://www.youtube.com/t/terms) and the Google Privacy Policy (https://www.google.com/policies/privacy).

On plans that include Lexova AI, Lexova processes case information automatically, on the Data Controller's behalf, as follows:

• Reading Uploaded Documents: Documents uploaded to a case are read once, in the background, by our artificial-intelligence service provider, to identify what each one is (for example a passport, a bank statement or a language test result) and to extract facts such as dates, holders and issuers, document, passport, account and certificate numbers, and language-test, credential-assessment and Express Entry profile details. These facts are stored with the case and used to sort documents into exhibits and packages, to check the coherence of the file and to suggest answers. A firm's own working files, the packages Lexova generates and portal review copies are not read this way.
• Suggestions, Not Decisions: Everything Lexova AI produces — readings, sorted exhibits, coherence findings, suggested or imported answers, draft letters, translations and assistant replies — is a suggestion that the Representative reviews. The Representative decides what is used, corrected and filed. For the Express Entry details read from documents, a value corrected by the firm's staff is kept over any later automatic reading. Lexova AI makes no decision on anyone's application.
• Explanations Checked Automatically: When an applicant explains a conflict Lexova flagged in their history, Lexova AI checks that the explanation addresses the question and, if it does not, asks for more detail before it is saved. This is never a decision on an application. The Representative sees every explanation, and the applicant may ask the Representative or our Privacy Officer to have a person review it.
• Form Import and Practice Migration: When a firm imports a filled IRCC form or migrates its past files, the files are read to find the forms and answers they contain, and nothing is created in Lexova until the firm has reviewed and confirmed the result. Filled form files are read, not stored; other documents are added to a case only when the firm confirms.
• No Training, No Marketing Profiles: Case content is not used to train artificial-intelligence models and is never used to build marketing or advertising profiles.

Lexova for IRCC is a browser extension that a firm's representative may install in their own browser to work in IRCC's online portals. It works only on Government of Canada websites and on lexova.ca, and only in the session the representative has signed in to themselves. Lexova never asks for, receives or stores portal or GCKey credentials, and Lexova's servers never connect to IRCC.

• Fill from Lexova: To fill an application from a case, the representative requests a pass from the case's page. The pass covers that one case, lasts at most 60 minutes and only allows the case's answers to be read; it ends when the representative presses Done or ends it from Lexova, or when it expires. The answers are kept only in the browser's temporary memory and are erased when the pass ends. The extension shows what it filled with an option to undo; that report stays in the browser and is not sent to Lexova. The extension reports back to Lexova only Lexova's own page and question codes, counts and, for a page it does not recognize, that page's address with its numbers removed — never an answer. Page fills are recorded in the case's activity log, and these reports are used to keep the extension working.
• Capture for Review: The extension can take screenshots of the pages of an application in the representative's session and assemble them into a review PDF on the representative's computer. Nothing is sent to Lexova unless the representative chooses to send it; the copy the extension keeps for that purpose is erased once sent or after two hours. A copy sent into Lexova is stored with the case as a document that the client can open to confirm the information or ask for corrections.
• Reports You Choose to Copy: The extension's panel can copy a page-structure report or a support report to your clipboard. These reports are designed to leave out the answers in the application, and they reach Lexova only if you paste them into a message to us.
• Permissions: The extension asks the browser only for what it needs: its side panel, temporary storage for the pass and for a capture awaiting sending, a timer for the pass's expiry and — for Capture for Review — control of the tab being captured, so that it can move through the pages and take full-page screenshots.

When you contact Lexova support, we collect what you send — your message, any files you attach and any replies you send by email, with their attachments — together with your name, email address, role and firm, and we use it only to answer you and to keep a record of our correspondence.

A technical problem report contains your description and, so that we can reproduce the problem, information about your device and browser (browser, operating system, screen size, language and time zone), the page you were on with its identifiers removed, and recent error messages from that page with personal information removed. You see the report before you send it and may choose to add a screenshot. Lexova AI may first suggest troubleshooting steps based on your description, which is then processed by our artificial-intelligence service provider.

Please include only the information needed to explain the problem: a screenshot shows whatever is on your screen. Support requests and reports are stored in Canada with the rest of the platform's data.

Lexova may send a small number of emails introducing its services to regulated immigration consultants, immigration lawyers and notaries, at the business email address they publish on their own website.

• Information Used: The firm's name, type of practice, city and province, website, business email address and the page where that address is published; the main language of the firm's public homepage, read automatically so that we write in the right language; and a record of the messages sent, replies and opt-outs.
• Purpose and Basis: To introduce Lexova to professionals whose business it concerns. Under Canada's Anti-Spam Legislation, a business email address that is conspicuously published, without a statement that the person does not wish to receive unsolicited messages, may receive messages relevant to the person's business or professional role. We do not write to addresses published with such a statement.
• Frequency: One introduction and at most one follow-up. Nothing more is sent once a person replies, asks us to stop, or the address bounces.
• Opting Out: Every message identifies TEXOVA INC. and its mailing address and includes an unsubscribe link that works in one click; you may also simply reply "unsubscribe". We act on it without delay and keep the address on a do-not-contact list permanently, only so that it is never written to again.
• No Tracking: Our outreach emails contain no tracking images. We check our outreach mailbox for replies automatically, only so that we stop writing to anyone who answered or asked us to stop.

We keep Personal Information only as long as needed for the purposes described in this policy, and then delete it:

• Case Information: While the firm's subscription is active and for 90 days after it ends, then deleted, unless the law or a Representative's professional obligations require longer retention (section 7).
• Browser Extension: A pass's answers: at most 60 minutes. A capture awaiting sending: at most two hours.
• Support Requests: Kept as our record of correspondence. Files uploaded for a message that is never sent are deleted after about a day, and files attached to a firm's support requests are deleted when that firm's account is permanently deleted.
• Outreach: You may ask us at any time to delete the information we hold about you as a business contact; we will keep only your email address on our do-not-contact list, so that we never write to you again.
• Account, Billing and Security Records: As long as the account exists, and afterwards as long as needed for security, legal, tax and accounting purposes.

We may update this policy. When we make a material change, we publish the new version on this page with its effective date and ask account holders to accept it the next time they sign in.

If you have questions regarding this policy, wish to withdraw consent, or want to exercise your privacy rights, please contact our designated Privacy Officer:

• Organization: TEXOVA INC. (operating as Lexova)
• Title: Chief Privacy Officer
• Email: privacy@lexova.ca
• Mailing Address: Suite 1063, 3909 University Ave NW, Calgary, AB T3B 6K3, Canada

You may also file a complaint with the Office of the Privacy Commissioner of Canada, the Office of the Information and Privacy Commissioner of Alberta or, in Quebec, the Commission d'accès à l'information.