Privacy Policy

1. Scope and roles #

This Privacy Policy explains how Instant Record Check collects, uses, discloses, and retains personal information in connection with its website, identity-verification service, criminal record check platform, support, and related communications. It applies to applicants, people whose information is included in a check, organizations using the platform, and website visitors.

Instant Record Check is the business name of 1244527 B.C. Ltd. Partner municipal police services access CPIC through their own official systems and make criminal record determinations. Instant Record Check does not independently search police databases or change substantive police findings; its platform generates and delivers a report based on the police result.

2. Operator and privacy officer #

The operator is 1244527 B.C. Ltd., doing business as Instant Record Check. The privacy officer is the Chief Executive Officer. For privacy questions, access or correction requests, or complaints, contact privacy@instantrecordcheck.ca. Quebec-related requests may also be sent to confidentialite@instantrecordcheck.ca.

Postal contact: 1244527 B.C. Ltd. doing business as Instant Record Check, 2031 Store St., Unit 11, Victoria, British Columbia V8T 5L9.

3. Information we collect and sources #

Depending on the service and your relationship with us, we may collect:

• identity and contact details, including name, other names, sex, date of birth, place of birth, current and prior addresses, telephone number, email address, and mailing address;
• account, order, consent, authorization, organization-link, communication, support, and transaction information;
• criminal record check information, including a voluntary declaration and the police result;
• the result and relevant details supplied through the police process, which may include name, other names, sex, date of birth, place of birth, date, address, a result of no record, declared record confirmed, or incomplete or inaccurate data, confirmed offence/date/court information, enhanced check cleared, not cleared, or incomplete status, and a serial authentication number;
• identity-verification information and outcomes; and
• device, browser, IP address, cookie, usage, attribution, analytics, advertising, communications, and support information.

We collect information directly from applicants and other individuals, from organizations that request or sponsor a check, from partner police services, from identity-verification and other service providers, from browsers and devices. We do not receive a credit report or credit score from TransUnion for Quebec knowledge-based verification.

4. Purposes for collection, use, and disclosure #

We use personal information to create and administer accounts; verify identity; obtain and deliver a police-based criminal record check; match the report to the correct applicant; process payments through our payment provider; communicate about a transaction or support request; attribute an account to a named organization link; share a completed result with that named organization only after separate applicant opt-in; maintain records and respond to access, correction, privacy, and legal requests; prevent fraud and misuse; operate, secure, monitor, troubleshoot, and improve the platform; measure advertising; and send marketing or service communications where authorized or otherwise permitted by law.

These purposes are distinct. A privacy notice is not blanket consent from browsing. Authorization for the check, identity verification, optional result sharing, and marketing communications is requested separately where required. Payment details are not shared with a requesting organization.

5. Police results and accuracy limits #

A partner municipal police service accesses CPIC and makes the determination. The IRC platform generates and delivers the report based on that result, without independently searching the police databases or changing the substantive police findings. Reports reflect the issuance date and not necessarily a person’s present status. We do not run a new check without authorization and do not reuse a previous result as a new check.

Police-issued results include caveats about positive identification by fingerprint comparison, delays in updating records, and the recipient’s responsibility to match the name and date of birth against government photo identification. Disputes about substantive police content go to the issuing police service. Instant Record Check still provides a legally timely written response to the person’s request and does not treat a referral as the response itself.

6. Recipients and optional result sharing #

Service providers receive information needed to provide hosting, identity verification, payment, transactional email, customer support, analytics, advertising, monitoring, or related services. Partner police services receive information needed to perform the check under their own legal mandates. Regulators, law-enforcement bodies, courts, professional advisers, or other persons may receive information when required or permitted by law, including for fraud, emergencies, legal obligations, or a business transfer.

A completed result is shared with the named partner organization only when the applicant expressly opts in at the result-sharing step. Withdrawal prospectively stops authorized future sharing; it does not retrieve copies already disclosed or undo lawful processing and may prevent completion. It does not promise an immediate stop to police processing already underway. We do not share payment details with that organization.

7. Identity verification #

In Quebec, the current method is knowledge-based verification through TransUnion. TransUnion exchanges questions, choices, and answers with the verification flow and supplies a pass/fail result. Instant Record Check may retain the raw response for diagnostics. No biometric data is currently collected in Quebec.

Outside Quebec, Stripe Identity is the primary method and TransUnion may be used as a fallback. Stripe hosts the identity-document and selfie capture and comparison flow. Instant Record Check receives outcomes and reason codes as part of the routine platform flow. If you cannot complete the available verification process, contact support@instantrecordcheck.ca to discuss available options; the service may be unable to be completed.

8. Service providers and foreign processing #

We use providers for hosting, identity verification, payment, transactional email, customer support, analytics, advertising, and monitoring, including Stripe, TransUnion, OVH, Netlify, SendGrid, Klaviyo, Intercom, PostHog, Sentry, Google, and Microsoft. The information handled by each provider depends on the service it provides.

Primary application and database hosting is in Quebec and operations are in British Columbia. These providers may process personal information outside Quebec and Canada, including in the United States and the European Union; we use PostHog’s European Union hosting region. Information processed elsewhere may be subject to foreign laws and lawful access by authorities in those jurisdictions.

9. Cookies, analytics, advertising, and communications #

Our marketing site and application currently load Google Tag Manager, Google advertising and analytics services, Microsoft advertising, and PostHog before a user makes a choice. The marketing site also loads Intercom; the application loads Klaviyo and includes the PostHog recorder. A site consent banner is not currently available. These services may use persistent identifiers and may support attribution, analytics, marketing, communications, and session replay.

Advertising processing may include click identifiers, event and purchase measurements, and hashed-email matching where used. A hash is not automatically anonymous. Advertising click identifiers in checkout and conversion records are automatically deleted after 90 days. This period does not apply to every advertising cookie or provider copy. Browser settings can restrict cookies, but some services may then be affected and browser controls are not equivalent to a site consent control.

10. Retention and deletion #

We retain information only as long as reasonably necessary for the purposes for which it was collected, legal and accounting obligations, evidence and authentication, dispute handling, security, and other lawful needs. A completed report may be retained as evidence or for authentication; it is not used as a new criminal record check. The Data Retention & Safeguards Policy describes current configuration and known limits.

The current configuration uses a seven-year configured period for checks and linked identity and TransUnion records. The period is measured from completion for records linked to a completed check and from creation for unlinked records; accounts remain while linked data exists. Long-horizon cleanup for screening files is currently handled in review mode, and automatic deletion is not yet enforced by that mechanism. Requests concerning screening-file deletion are handled under applicable legal duties, including statutory response deadlines. Scheduled external encrypted backups are configured to expire after approximately 30–35 days, but that period does not apply to every operational copy or snapshot.

For Quebec personal-information-agent activity, the applicable statutory seven-year period from collection is a maximum, not a minimum. It is distinct from the seven-year configured period measured from check completion or record creation. Some shorter-lived records are deleted automatically: session tokens after 30 days, failed-login records after 90 days, certain entity-less audit context after 90 days, and advertising click identifiers in checkout and conversion records after 90 days. Provider retention periods, API-log periods, analytics-retention maxima, and other operational-copy periods may differ.

11. Safeguards and incidents #

We use safeguards proportionate to the sensitivity of the information, including TLS for information in transit, encrypted scheduled external backup archives, access controls, separation of duties where appropriate, monitoring, and measures intended to reduce unauthorized access, disclosure, use, copying, or alteration. The production database and PDF filesystem data are not encrypted at rest.

If a confidentiality or security incident occurs, we assess and work to mitigate the risk. Where the applicable serious-harm threshold or other law requires it, we notify the applicable regulator and affected persons and maintain the records required by law.

12. Access, correction, withdrawal, and complaints #

You may write to privacy@instantrecordcheck.ca, or to confidentialite@instantrecordcheck.ca for Quebec-related matters, to ask whether we hold personal information about you, request access or correction, withdraw consent prospectively, or complain about our handling. We respond in writing within 30 days where that period applies. Silence may be deemed a refusal under applicable law. Access and correction are free, subject to reasonable advance-notified charges for transcription, reproduction, or transmission where law permits.

Where applicable, you may request deletion of information collected unlawfully, cessation of dissemination, de-indexing or re-indexing when the law permits, and computerized information you supplied in a structured, commonly used technological format subject to legal limits. We use a least-intrusive identity check: an authenticated account or confirmed file email, existing-information questions, and only if needed one government photo ID with unnecessary fields redacted; the copy is destroyed after verification. Reasonable accommodation is available on request. A written refusal identifies the legal provision and available remedies. In Quebec, a disagreement may be submitted to the Commission d’accès à l’information within 30 days of refusal or expiry of the response period.

Regulators include the Office of the Privacy Commissioner of Canada at www.priv.gc.ca or 1-800-282-1376, the Office of the Information and Privacy Commissioner for British Columbia at www.oipc.bc.ca, the Office of the Information and Privacy Commissioner of Alberta at www.oipc.ab.ca, and the Commission d’accès à l’information du Québec at www.cai.gouv.qc.ca or 1-888-528-7741.

13. Automated processing and decisions #

Identity verification may use automated provider questions, comparisons, outcomes, or reason codes. Principal factors may include the match between information submitted by the applicant and information or documents handled in the verification flow. A pass/fail or other outcome may prevent completion of a check. Where a decision about you is based exclusively on automated processing, we inform you no later than when we communicate the decision. On request, we provide the information used, the principal factors and parameters that led to the decision, your right to correct the information, and an opportunity to present observations to a member of staff who can review the decision. Instant Record Check does not make the police determination.

14. Changes and contact #

We may update this Policy when our practices or legal obligations change. The revised version will be posted on the Site with its effective date when one is established. Questions may be sent to privacy@instantrecordcheck.ca; Quebec-related privacy matters may also be sent to confidentialite@instantrecordcheck.ca.