Privacy Policy

Last updated: July 24, 2026

PaceTracker (“PaceTracker”, “we”, “us”) is a self-documentation tool that helps APEGA-registered professionals record their Continuing Professional Development (CPD) under the PACE framework. This policy explains what personal information we collect, why, where it is stored, and the choices you have. We handle personal information in accordance with the Canadian Personal Information Protection and Electronic Documents Act (PIPEDA).

PaceTracker is operated by Pace Tracker, 903 8 Ave SW, Calgary, Alberta T2P 0P7, Canada (Business Number 753473438 · GST 753473438RT0001). For any privacy question or request, contact privacy@pacetracker.ca.

1. Information we collect

• Account information: your sign-in email address (kept in our authentication system) and the profile you provide — full name, professional designation, APEGA ID, and renewal date.
• CPD records you create: PACE plans and their contents, CPD activities, written explanations, peer review notes, sign-off names and dates, and myAPEGA module completion dates.
• Evidence files: documents you choose to upload and attach to your activities or module records (for example certificates or notes), stored in a private storage bucket accessible only to you.
• Billing information: if you subscribe to a paid plan, the status of your subscription and a record of each transaction (subscription reference, amount, date). Payments are processed by PayPal: your card or funding details are handled by PayPal and never reach our systems.
• Referral data: if you use the invite feature, your personal referral code and the fact that an account signed up through it. If you open an invite link, the inviter’s code (see the Cookies section below).
• Consent and preference records: the Terms of Service version you accepted and when, your marketing email choice and when it last changed, and your reminder email preference.
• Technical data: limited logs generated by operating the service (such as request and error logs) and essential authentication cookies.

2. How we use your information

• To provide the service: storing and displaying your CPD records to you.
• To generate documents you request, such as the audit pack PDF or the export of your data.
• To send service emails, such as sign-in links and CPD deadline reminders.
• To operate the referral programme: attributing an invitation to the inviting account and, when paid plans launch, applying the corresponding credits.
• To manage subscriptions and billing: recording your subscription status and the transactions needed for accounting and tax purposes.
• To send you occasional product updates and offers by email, only if you have expressly opted in. You can withdraw that consent at any time from the Account page or via the unsubscribe link included in every such email; deadline reminder emails can likewise be turned off from the Account page or their own unsubscribe link.
• To secure, maintain, and improve the service.

We do not sell personal information, we do not show advertising, and we do not use your records for profiling. Your CPD records are yours.

3. Where your data is stored

Your account data, CPD records, and evidence files are stored in Canada (Montréal), in the Canadian region of our database and storage provider. Access is restricted by row-level security so that each account can only read and write its own records.

4. Service providers

We use a small number of service providers to run PaceTracker:

Because some providers operate from the United States, limited information (for example request metadata processed by our hosting provider, or the email address and content of messages we send you) may be processed outside Canada and may be subject to the laws of those jurisdictions. We rely on contractual safeguards with these providers to protect your information to a comparable standard.

Emails are minimal by design. The messages we send carry only your email address and the message itself: sign-in links, and deadline reminders that state an approaching CPD date. They never include your plans, activities, evidence, progress, or any other CPD content, so that content does not transit our email provider.

Payments are minimal by design too. What we exchange with PayPal is limited to the subscription itself: plan, status, amounts, and an internal account reference. Your CPD records never transit PayPal, and your payment credentials never transit PaceTracker.

5. Retention and deletion

We keep your information for as long as your account exists. You can delete your account at any time from the Account page: deletion is immediate and permanent, and erases your profile, PACE plans (including signed versions), activities, uploaded evidence files, module records, reminder schedules, referral records, subscription records, and your sign-in identity. Any active subscription is cancelled with PayPal as part of deletion. Residual copies in encrypted database backups are removed as those backups expire on a rolling basis.

One exception is required by law: records of financial transactions (such as the date, amount, and payment reference of a subscription charge) must be kept for the period required by Canadian tax and accounting legislation. When you delete your account, these records are retained in unlinked form — they no longer reference your account or profile. PayPal retains its own transaction records under its privacy policy.

6. Your rights

• Access and portability: your records are visible in the app at all times. From the Account page you can download a complete, machine-readable export (JSON) of your data, and an audit pack (PDF) for each CPD period. Exports never include identifying details of other users — for example, referral entries appear without the other party’s identity.
• Correction: you can edit your profile and unsigned records directly in the app. Signed plan versions are immutable by design; corrections are made through a new revision.
• Deletion: self-serve from the Account page, as described above.
• Complaints: you may contact us at privacy@pacetracker.ca, and you have the right to complain to the Office of the Privacy Commissioner of Canada.

7. Security

Data is encrypted in transit (HTTPS) and at rest by our providers. Evidence files live in a private bucket with per-user access rules, and database row-level security is enforced for every table. Signed plans are protected against modification at the database level, and billing records are append-only.

8. Cookies

We use essential cookies required to keep you signed in. If you open an invite link, we also set a first-party referral cookie (pt_ref) containing the inviter’s code, kept for up to 30 days and used solely to attribute the invitation if you sign up. PayPal may set its own cookies within its checkout components, as described in PayPal’s privacy policy. The sign-in page uses Cloudflare Turnstile to distinguish people from automated traffic: it processes technical signals from your browser and may set its own functional cookies, as described in Cloudflare’s privacy policy. We do not use advertising or third-party tracking cookies.

9. Children

PaceTracker is intended for practising professionals and is not directed to individuals under 18.

10. Changes to this policy

If we change this policy, we will update the date above and, for material changes, notify you in the app or by email before they take effect.