Privacy Notice
Effective date: July 17, 2026
This notice explains what personal information Meravor collects, how we use and protect it, and the choices you have. "Meravor", "we", "us", and "our" mean the company identified in section 14, Who we are, which operates the Service. We handle your information in line with Canada's federal privacy law (PIPEDA), Quebec's Law 25, and the privacy laws of your province.
The short version
- Your record is kept and processed in Canada, in Montréal, and encrypted.
- We don't sell your information, and we never use your family record for advertising.
- You choose who sees what. Professionals see nothing sensitive unless you share it.
- You can access, correct, export, or delete your information whenever you want.
- We're honest about the one limit: our host is a U.S. company, so Canadian residency isn't the same as being beyond the reach of U.S. law. Section 5 explains.
This summary is here to help. The full notice below is the complete picture.
1. Being accountable for your information
We're responsible for the personal information in our care, and we've designated a person to oversee how we handle it — our Privacy Officer. You can reach them anytime at privacy@meravor.ca. Who "we" are, in legal terms, is set out in section 14.
2. What we collect
- Your account — your name, email, and a securely hashed password. Professionals also give us their firm or practice name, professional type, and province.
- Your family record — whatever you choose to enter: people, assets and accounts, documents, final wishes, health notes, references to digital accounts. Some of this is sensitive, and we treat it that way.
- Payment details — handled by Stripe. We never see your full card number; we get limited billing information and your subscription status.
- Technical information — things like your IP address, device and browser, and activity logs, which we need to run and secure the Service.
- Messages — what you send us, and the email we send you (invitations, password resets, notices).
- The Estate Readiness Check — the check itself runs entirely in your browser and your answers are never sent to us. If, and only if, you ask us to email you the result, we receive the email address you type, your province, your score, and the categories you flagged as gaps — never the individual answers. You can ask us to delete that at any time, and every email we send you carries a one-click unsubscribe.
3. How we use it
We use your information to run the Service: to create and secure your account, process your subscription, enable the access you grant to family members and professionals, send you the transactional emails that keep everything working, power the Advisor's gap analysis and reports, prevent fraud, meet our legal obligations, and make the Service better. We do not sell your personal information, and we never use your family record for advertising.
4. Your consent
We rely on your consent, which you give when you create an account and use the Service, and otherwise as the law allows or requires. Because some of your record is sensitive, we rely on your express consent to store it — that's what the box at sign-up is for. You can withdraw consent at any time by deleting the information or your account, though doing so may mean we can no longer provide part or all of the Service.
5. Where your information lives — and an honest word on reach
Your family record is stored and processed in Canada, on Google Cloud in the Montréal region. A few of the providers we rely on are U.S.-based and may handle limited information there (see section 8).
Here's the part most services don't say plainly: our host, Google, is a U.S. company, and companies like it can be subject to U.S. legal demands — the CLOUD Act, for example — even for data held in Canada. So while your data resides in Canada, residency isn't an absolute shield against foreign legal process. We'd rather you know that going in. As Law 25 requires, we'll complete a privacy impact assessment for information that moves outside Quebec.
6. How we protect it
- Encrypted at rest — sensitive free-text fields are encrypted with AES-256-GCM before they're stored.
- Encrypted in transit — all traffic is protected with TLS.
- Passwords — kept only as salted hashes, never in the clear. Two-step verification is available to everyone and required for professionals.
- Separation — every family's record is isolated, and a professional sees only what a family grants, nothing by default.
No system is perfectly secure, and we won't pretend otherwise. We're also not a "zero-knowledge" service: to show and export your records, we hold the encryption key, which means our systems can technically reach your data in order to run the Service.
7. When we share
- People you choose — family members you invite, and professionals you grant scoped access. You control this, and you can revoke it.
- Our service providers — who handle information on our behalf under contract, listed in section 8.
- Law and safety — where the law requires it, or to protect rights, safety, or the Service.
- A business change — if the business is merged, acquired, or sold, always subject to this notice.
8. The providers we rely on
| Provider | What they do | Where |
|---|
| Google Cloud | Hosting and database | Canada (Montréal) |
| Stripe | Payment processing | United States (billing information only) |
| Resend | Sending our email | United States (recipient address + message only) |
9. How long we keep it
We keep your information while your account is active and while we need it to run the Service, and after that only as long as the law requires — for tax, accounting, or resolving a dispute. Once it's no longer needed, we delete or anonymize it.
10. Your rights
Subject to the law, you can:
- See the information we hold about you, and how it's used and shared;
- Correct anything inaccurate or incomplete;
- Export your record in a readable, portable format, anytime, from inside the Service;
- Delete your information and your account;
- Withdraw consent, within legal and contractual limits.
To do any of these, write to privacy@meravor.ca. We'll respond within the time the law allows.
11. Cookies
We use a small number of strictly necessary cookies — mainly to keep you signed in. We don't use advertising or cross-site tracking cookies. For basic, aggregate website statistics (such as page views and referring sites) we use Cloudflare Web Analytics, which is privacy-first: it sets no cookies, does not fingerprint visitors, and does not collect personal information — so it cannot identify you or track you across other sites.
12. Children
The Service is meant for adults managing family information, not for children. You may record information about minors within your own family record; whether that's appropriate is your call.
13. Changes to this notice
We may update this notice from time to time. If a change is material, we'll post it here with a new effective date and, where it makes sense, tell you directly.
14. Who we are, and how to reach us
Meravor is a brand of Purefox Holdings Ltd., a corporation incorporated in Alberta, Canada. Purefox Holdings Ltd. is the organization accountable for the personal information handled through the Service, and references to "Meravor", "we", "us", and "our" in this notice mean Purefox Holdings Ltd. For any privacy question or concern, contact our Privacy Officer at privacy@meravor.ca. If our answer doesn't satisfy you, you can contact the Commission d'accès à l'information du Québec (if you're in Quebec) or the Office of the Privacy Commissioner of Canada.