Security
This page says what we hold about you and what we do not. It is short because there is very little of either.
What we hold, and for how long
Almost nothing, deliberately. To order any of the Ontario records we sell, the ministry needs one thing: a driver's licence number. So that is what we ask for, plus an email address to reach you and the province you live in. For the certified record, a name and a mailing address for the envelope.
We do not ask for your date of birth, a photograph, a scan of anything, or a document of any kind.
| What | Why we have it | How long |
|---|---|---|
| Driver's licence number | The ministry needs it to find the record | Deleted 30 days after the order closes |
| Name and mailing address (certified record only) | Where the ministry posts it | Deleted 30 days after the order closes |
| Email address | To send your receipt and reach you about the order | Retained with the order record |
| Province of residence | To refuse orders we cannot lawfully serve | Retained with the order record |
| Order reference, amounts, status history | Accounting, and evidence if a payment is disputed | Retained; card dispute windows reach 540 days |
| The CVOR driver abstract PDF | The ministry shows it on screen to whoever orders it, so we email it to you | Seconds, until it is sent. Never stored. |
We never hold anything physical
There is no envelope in this service in either direction. You post nothing to us, we post nothing to anybody. The ministry emails the 3-year record to you directly and posts the 5-year and certified records to you directly. There is no document to lose, no courier to trust and nothing for us to be responsible for the safekeeping of.
The CVOR driver abstract is the one record that passes through our systems at all, because the ministry shows it only to whoever orders it. We email it to you in the same run and keep nothing: there is no copy to recover afterwards, which is why the email says to keep it.
Card details
Your card number never reaches us. Payment is taken on our payment processor's own page. We receive a confirmation that a payment succeeded and an identifier for it, and nothing else. No person at this company ever sees or re-types your card.
Where your data is
In the United States. Information stored and processed there may be accessed by US courts, law enforcement and national security authorities under US law, and no contract we sign changes that. Canada's federal privacy law requires you to be told this, not to consent to it, and you are told it at the point you type the number rather than afterwards.
Retention, and why it is short
The licence number is deleted 30 days after your order closes, automatically. The order record itself survives longer, because card dispute windows reach 540 days and we would otherwise be unable to answer a chargeback. What survives is the evidence of what happened, not the personal data it happened to.
Reporting a vulnerability
Email [email protected]. We will acknowledge within two business days and tell you what we are doing about it.
If you follow the ordinary rules — stop as soon as you have demonstrated a problem, do not access or modify anyone else's data, do not degrade the service, and give us reasonable time before publishing — we will not pursue you and we will say publicly that your work was invited.
If something goes wrong
If personal information is exposed, we will tell the people affected and the relevant regulator, with what happened, what was involved and what we are doing. We would rather tell you about a small incident than be found not to have told you about one.