What personal information we collect, why we collect it, who else can see it, how long we keep it, and how to reach us about it.
Bracket Planning is an independent, advice-only financial planning practice. Financial planning does not work without personal information, so this policy sets out exactly what we hold and what we do with it, in plain terms rather than general ones.
This policy covers this website, the client portal, and the checkout and payment process. It applies to information about prospective clients, clients, and general visitors. We follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation.
Kenneth Doll is the individual accountable for personal information at Bracket Planning. Questions, access requests, corrections and complaints all go to:
[email protected]
+1 (403) 999-9450
Browsing the public pages does not require you to identify yourself. Our hosting provider processes technical information such as your IP address and browser type in order to serve pages and protect the site from abuse.
We use two Google measurement tools on our pages, both of which use cookies and similar technologies:
We use these to understand how the site is used, not to identify you personally, and we do not upload names, email addresses or any other identifying information to them. You can opt out of Google Analytics entirely with Google's browser add-on, and out of personalized Google advertising through Google's ad settings. Most browsers also let you block or delete cookies, which will not affect the public pages of this site.
Our contact form collects your name, email address, phone number and message. This is emailed to us and is not stored in our website database. It then lives in our email system for as long as we keep the correspondence.
When we set up your portal account we store your name and email address, a hashed version of your password (we never store the password itself and cannot read it), and session records that keep you signed in.
Signing in sets a cookie named bp_session. It is strictly necessary to operate the portal, is not used for advertising or analytics, and expires after seven days.
The portal questionnaire is where the most sensitive information is gathered, because it is what a financial plan is built from. Depending on what applies to you and your spouse or partner, it can include:
Answers are saved as you go, including before you submit, so you can complete the questionnaire across several sittings.
You can upload supporting documents to the portal, and we can share documents with you there. Files are held in private storage that is not publicly reachable and not indexed by search engines. Spreadsheets we use to build your plan stay internal; only the resulting dashboard figures and documents we deliberately assign to you appear in your portal.
Starting an engagement records your name, email address, province, the plan you selected, and the price and tax calculated for it.
When you sign the Letter of Engagement, and for pre-authorized debit the PAD agreement, we keep an audit record of exactly what you agreed to. It stores the version and a fingerprint of the wording you saw, your name and email address, the date and time, and your IP address and browser identification. Where a pre-authorized debit agreement applies, it may also include the last four digits of the account. We keep this so that both of us can later establish precisely what was agreed.
We never see or store your full card or bank account number. Payment details are entered on Helcim's own secure payment page, not on ours. What we receive back and store are Helcim's reference tokens and a log of payment events for our records.
We do not sell personal information, and we do not share it for anyone else's marketing.
We use a small number of service providers to run the practice. They may process your information only to provide their service to us:
| Provider | What they handle |
|---|---|
| Cloudflare | Website hosting, the portal database, private document storage, and sending our email notifications |
| Helcim | Payment processing, card and bank details, and subscription billing |
| Advertising conversion measurement |
We may also disclose personal information where the law requires it, or where it is necessary to establish or defend a legal claim.
If we suggest another professional, an accountant or lawyer from our network for example, we introduce you and let you decide. We do not hand over your information without your agreement.
Our providers operate international infrastructure, so your information may be stored or processed outside Canada, including in the United States. While it is in another country it may be accessible to that country's courts and law enforcement under that country's laws. We choose providers that commit to appropriate protection.
| Information | Retention |
|---|---|
| Questionnaire answers, uploaded documents, plan data, portal account and our client notes | Deleted when the engagement ends. Removing your account erases these records and permanently deletes your files from storage. |
| Signed Letter of Engagement and PAD agreements, payment and subscription records | Retained after the engagement ends, for tax, accounting and legal-defence purposes. These records are unlinked from your portal account but still contain your name and email address. |
| Email correspondence | Kept in our email system while it remains relevant to our records. |
| Sign-in sessions | Expire after seven days, and immediately when you sign out. |
Deletion at the end of an engagement is something we do as a matter of practice; it is not on an automatic timer. If you want your information removed at a particular time, tell us and we will act on it.
You can ask us to:
Write to [email protected] and we will respond within 30 days. We may need to confirm your identity first. Access requests are handled by hand rather than through a self-serve export, so allow us a little time to assemble a complete answer.
If you are not satisfied with how we have handled a privacy concern, you may contact the Office of the Privacy Commissioner of Canada.
No system is perfectly secure, and we will not claim otherwise. If a breach occurred that created a real risk of significant harm, we would notify you and the Privacy Commissioner as the law requires.
Our services are for adults. We do collect information about clients' children, such as dates of birth and education savings, as part of family financial planning. That information is provided by the parent or guardian and is used only for that planning.
If we change how we handle personal information, we will update this page and change the date at the top. Material changes affecting current clients will be communicated directly.