Privacy
What this site collects, and what it deliberately does not.
Last updated 2026-08-24. Written to be read, not to be survived.
The short version
- The enquiry form emails me your name, contact details and message. Nothing else.
- The guided intake and the calculators never send anything anywhere. They run in your browser.
- There is no field for a social insurance number anywhere on this website, by design.
- No advertising trackers, no third-party cookies, no data sold or shared for marketing.
Who is responsible
Ravi Soni, Financial Professional, Edmonton, Alberta, is the organisation responsible for personal information collected through this site and acts as its Privacy Officer. Contact: info@ravisoni.ca.
This policy is written to Alberta’s Personal Information Protection Act (PIPA) and, for clients outside Alberta, PIPEDA.
What is collected, and why
| Where | What | Why | Kept |
|---|---|---|---|
| Enquiry form | Name, email, phone, topic, preferred contact method and language, your message, preferred days or times, marketing consent, timestamp and IP address | To answer you, and to hold provable consent as CASL requires | In my email, for 24 months from last contact, then deleted |
| Guided intake | Everything you type, and any documents you attach | To build a package you download and keep | Never sent anywhere. Saved in your own browser, on your own device, so you can come back to a part-finished form. Deleted when you press Delete my answers, or automatically after 30 days |
| Calculators | The figures you enter | To show a result | Not stored. Not transmitted. They vanish on refresh |
| Analytics | Page URL, referrer, country, browser and device type — aggregated, no cookie | To know which pages are useful | Cloudflare Web Analytics. No individual is identified and no data is sold |
Why the guided intake keeps everything in your browser
A TFSA application asks for employment, income, assets, liabilities and beneficiaries, and usually comes with a photo of your driver’s licence and a void cheque. I need that information once, to key into an insurer’s system with you in the room.
Had I built the obvious version — you submit, a server assembles a PDF, it lands in my inbox — then the entire payload would pass through infrastructure I run and settle permanently in an email account. Storing it in a database would be worse still: it would make me the custodian of a pile of sensitive personal information under PIPA, with retention schedules, access requests, safeguards and mandatory breach notification attached.
So the intake makes no network request at all. Your browser assembles the PDF, bundles your documents into a ZIP, and saves it to your device. You then hand it to me in person, or upload it to the insurer’s own secure portal. My systems never hold it, which means there is nothing of yours here to breach, retain, disclose or lose.
Where it is saved while you fill it in
A guided intake takes fifteen to twenty-five minutes, so your answers and attachments are saved in your own browser as you go, using browser storage on your device. That is what lets you refresh, close the tab, and come back tomorrow without losing anything. It is not transmitted, and I cannot read it.
Being honest about what that means: it is a real file on your own computer, and the same is true of the ZIP you download at the end. Neither is encrypted by this website. On a shared, family or work computer, press Delete my answers when you are done and remove the ZIP from your Downloads folder. Anything left untouched in browser storage is deleted automatically after 30 days.
The point of this design is not that your data becomes invulnerable on your own machine. It is that it never becomes mine — so there is no custodianship, no retention schedule, and nothing for a breach at my end to expose.
Your social insurance number
The Office of the Privacy Commissioner of Canada is clear that a private-sector organisation should only require a SIN where it is needed for income reporting. The insurance company issuing your TFSA needs it for exactly that. My website does not.
So there is no SIN field on this site, and the intake PDF prints a blank line for you to complete by hand. At the appointment you read it off your card, or — more often — you type it into the insurer’s secure e-application yourself, where it goes directly to the regulated party obligated to protect it.
Please do not email, text or message me your SIN, or a document showing it. If a case genuinely requires it before an application, the least-bad channel is a phone call.
Marketing email and CASL
The consent box on the enquiry form is unchecked by default and separate from the enquiry itself. Leaving it unticked means you hear back about your message and nothing else. Ticking it records express consent, along with the date and the exact wording you were shown.
Every marketing message identifies me, gives a physical mailing address, and carries a working unsubscribe link that stays live for at least 60 days and is honoured within 10 business days — usually the same day.
Who else sees your information
- Insurance companies, when you decide to apply — only what the application requires, and only with your authorisation.
- World Financial Group Insurance Agency of Canada Inc. (WFGIA), my agency, which supervises the advice I give and reviews client files as its compliance obligations require.
- Service providers that operate parts of this site: Cloudflare (hosting and analytics) and Oracle Cloud (email delivery for form notifications).
- Regulators — the Alberta Insurance Council or FSRA — where law requires it.
I do not sell, rent or trade personal information. There is no advertising pixel on this site.
Your rights
- Access. Ask what I hold about you. I respond within 30 days, as PIPA requires.
- Correction. Tell me what is wrong and I will fix it.
- Withdrawal of consent. Withdraw at any time, subject to legal and contractual record-keeping obligations that apply once a policy exists.
- Complaint. To me first, at info@ravisoni.ca. If unresolved, to the Office of the Information and Privacy Commissioner of Alberta, or to the Office of the Privacy Commissioner of Canada.
Safeguards, and a breach
Information I do hold — enquiry emails, and client files once you become a client — is kept in access-controlled systems with multi-factor authentication, and shared only as described above. If a breach creates a real risk of significant harm, I will notify the Alberta Commissioner and every affected individual without unreasonable delay.
The honest summary: the most effective safeguard on this website is that almost nothing sensitive ever reaches it.
Changes
If this policy changes materially, the date at the top changes and the change is described here. Current version: 2026-08-24.