Privacy Framework

What We Record During Your Journey

When someone registers for webinars on portfolio diversification or requests downloadable guides about risk assessment methodologies, certain identifying elements naturally surface. Names and contact coordinates emerge at registration checkpoints. You type them into forms designed to facilitate communication about upcoming educational sessions or follow-up materials related to investment literacy.

Geographic signals tied to Canadian regions help contextualize content—tax-advantaged account discussions reference TFSA and RRSP structures familiar to Calgary residents rather than foreign equivalents. Yet no granular street-level tracking occurs beyond the postal information you voluntarily provide during correspondence.

Occasionally, enrichment happens when you link external accounts—importing transaction histories from brokerage platforms for portfolio analysis exercises, for instance. That intake remains strictly optional and occurs only after explicit permission.

Why These Details Matter to Core Functions

Every piece of captured information serves a functional necessity within the educational infrastructure. Nothing gets stored arbitrarily.

• Course enrollment systems require names and email addresses to generate access credentials for the April 2026 "Building Balanced Portfolios" series, ensuring the right participants receive login links and session reminders.
• Personalized learning pathways adapt based on prior module completions—someone who finished beginner bond basics sees intermediate fixed-income strategies suggested next, creating logical progression without manual curation.
• Communication infrastructure depends on accurate contact coordinates to deliver monthly investment awareness bulletins, announce new calculator tools, or alert subscribers when archived webinar recordings become available.
• Platform stability monitoring relies on device and browser metadata to diagnose interface glitches affecting mobile users attempting to access interactive budget planners on smaller screens.
• Quality improvement initiatives analyze aggregate engagement metrics—discovering that video tutorials about dividend reinvestment plans consistently get rewatched suggests those concepts deserve expanded treatment in future materials.

When inquiries arrive requesting clarification on fee structures for robo-advisory services—a common question among Canadians exploring automated investing—that correspondence creates a record linking your email to the support ticket. Response quality improves because context persists; repeated exchanges don't require re-explaining your initial question.

Financial literacy assessments occasionally incorporate demographic slices (age brackets, investment experience levels) to benchmark knowledge gaps across different learner populations. Aggregated insights reveal which topics need stronger foundational coverage, but individual quiz scores remain tied only to anonymized user IDs unless you explicitly request personalized feedback.

When Information Leaves Internal Systems

Limited circumstances trigger outbound data movement beyond Eaulorix infrastructure. These scenarios follow defined protocols rather than occurring haphazardly.

Email delivery services handle newsletter dispatch—your address travels to a third-party messaging platform that physically transmits educational content to your inbox. Those vendors operate under strict processor agreements prohibiting them from leveraging subscriber lists for unrelated marketing or selling contact databases to brokers.

Video hosting infrastructure stores recorded workshop sessions. When you stream a presentation about RESP contribution strategies for children's education savings, playback occurs through embedded players fetching content from specialized media servers. Viewing analytics flow back to help gauge which segments resonate most, but identifiable viewer details don't persist in those external systems beyond temporary session logs.

Payment processors enter the picture when premium educational materials require purchase—a comprehensive guide to tax-loss harvesting techniques, perhaps. Transaction completion involves sharing billing details with financial intermediaries that facilitate secure credit card charges. Eaulorix never sees full card numbers; only tokenized confirmations and billing addresses sufficient for receipt generation.

Legal compulsion represents another disclosure trigger. Canadian regulatory authorities investigating financial fraud schemes might subpoena user records if illicit actors misused educational resources while conducting pump-and-dump stock promotions. Compliance with lawful demands doesn't require prior notification, though such incidents remain exceedingly rare given the purely educational nature of platform activities.

Corporate restructuring scenarios—acquisitions, mergers, asset sales—could transfer user databases to successor entities. Any such transition would occur only if acquiring parties committed to maintaining equivalent privacy protections and honoring existing user preferences regarding communication and data handling.

Last external audit of processor agreements completed December 2025

Security Posture and Inherent Vulnerabilities

Multiple defensive layers shield stored information from unauthorized exposure, though no system achieves absolute invulnerability.

Regular penetration testing by external security firms occurs quarterly, simulating attack scenarios to identify weaknesses before malicious actors discover them. Vulnerability disclosures prompt rapid remediation, typically patching critical flaws within 48 hours of identification.

Control Mechanisms and Data Lifecycle

Several pathways exist for exercising influence over how your information gets handled and how long it persists within organizational systems.

Retention durations vary by data category. Active user profiles remain intact indefinitely during ongoing engagement. After 24 months of complete inactivity—no logins, no email opens, no resource downloads—accounts enter dormant status prompting a reactivation email. Continued silence beyond 36 months triggers automatic archival, moving records to cold storage where they await eventual deletion unless legal holds apply.

Support correspondence gets retained for seven years per Canadian business record-keeping standards, even after account deletion. Transaction histories related to purchased materials persist similarly due to tax audit requirements. Aggregate performance metrics contributing to research studies may survive longer still, though always stripped of personally identifying markers.

Security incident logs capturing failed login attempts or suspicious access patterns stick around for five years to support forensic investigations and pattern analysis identifying emerging threat vectors.