Skip to content
INSTANT.CREDIT

Privacy Policy

Privacy Policy

Last updated: November 6, 2026

Effective date: September 6, 2026

The changes made to this Policy on November 6, 2026, including what section 16 says about cookies and analytics on the Site, that nothing about you or your visit is sent to Google, and about advertising click identifiers and campaign tags, apply from that date. Those made on November 5, 2026, including what sections 5 and 12 say about the term we may lend for and the review of a decision to lend a different term or amount, apply from that date. Those made on November 1, 2026, including what sections 6 and 7 say about consumer reports and what section 15 says about replying STOP to our text messages, apply from that date. Those made on October 17, 2026, including what sections 4.2 and 12 say about how your regular income is found in the transaction history, apply from that date. Everything this Policy says about the chat assistant on the Site and the security check that protects it applies from October 16, 2026, and from that date what it says about how chat conversations are kept, protected, deleted, and made available to you also applies to the conversations recorded since the chat assistant started on October 14, 2026.

This Privacy Policy describes how Instant Credit S.E.C — a limited partnership (société en commandite) constituted under the law of Quebec and registered in Ontario as an extra-provincial limited partnership under the name INSTANT.CREDIT S.E.C and Business Identification Number 1001496851, acting through its general partner, Credit Inc., and carrying on business from 2233 Argentia Road, Unit 302, Mississauga, Ontario L5N 2X7 (“we”, “us”, “our”) — collects, uses, discloses, retains, and protects personal information in the course of operating the website at payday.instant.credit (the “Site”) and of lending money to consumers in Ontario (the “Services”). Instant Credit S.E.C is the name shown on our Ontario payday lender licence, and Instant.Crédit S.E.C. is the partnership’s name in Quebec. Each of these names refers to the same partnership.

“INSTANT.CREDIT” is a brand and the domain name instant.credit. It is used by Instant Credit S.E.C and by other legal entities related to it. Used on its own, the name covers Instant Credit S.E.C and every legal entity related to it, except where the next paragraph says it means the partnership only. “We”, “us”, and “our” mean Instant Credit S.E.C only: the licensed lender, the party to our Terms and Conditions and to your loan agreement, and the organization responsible for the personal information this Policy describes.

A limited partnership is not a corporation. It has no articles of incorporation and no board of directors. Under article 2236 of the Civil Code of Québec, the general partner is the only partner authorized to administer and bind a limited partnership; where the Site, or a consent you give on the Site or when you apply, says that INSTANT.CREDIT is a lender or is licensed, does something, agrees to something, is given something, such as a consent, or is bound by something, it means the partnership only, acting through its general partner, unless the text says otherwise. That includes the consents you give when you apply, whose substance Part C of our Terms and Conditions sets out.

We are licensed as a payday lender in Ontario under the Payday Loans Act, 2008, S.O. 2008, c. 9 (the “PLA”), licence number 4741682, issued 3 September 2026 and expiring 3 September 2027. We lend as principal — we are the lender, not a broker and not a lead generator — and we lend only to residents of Ontario. Our only product is a single-payment payday loan of up to $1,500 for a term of 30 days or less, or of 61 days, for personal, family, or household purposes.

1. Scope of this Policy

“Personal information” means information about an identifiable individual. This Policy applies to the personal information of everyone who visits the Site, starts or submits an application, or holds a loan with us. It does not apply to business information that identifies no individual — we do not make business-purpose loans.

This Policy applies in addition to our Terms and Conditions, to the notice shown in the chat assistant on the Site, to the consents you give when you leave your contact details with us or apply, and to your loan agreement. Where you have given a specific written consent, that consent governs the matter it addresses, within the limits on use set out in section 5.

2. The Law That Applies

Ontario has not enacted a general private-sector privacy statute. Our handling of personal information is therefore governed by the federal Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5 (“PIPEDA”), which applies to personal information that an organization collects, uses, or discloses in the course of commercial activity. The fair information principles in Schedule 1 to PIPEDA — accountability, identifying purposes, consent, limiting collection, limiting use, disclosure and retention, accuracy, safeguards, openness, individual access, and challenging compliance — are the framework this Policy follows.

Other laws shape what we may do with your information, in particular the PLA and Ontario Regulation 98/09 made under it, the Consumer Protection Act, 2002, S.O. 2002, c. 30, Sched. A, the Consumer Reporting Act, R.S.O. 1990, c. C.33, and Canada’s Anti-Spam Legislation, S.C. 2010, c. 23 (“CASL”).

Quebec’s private-sector privacy legislation does not govern this Site or this product. A payday loan of the kind described here cannot lawfully be offered to a resident of Quebec, and we do not offer it there.

3. Privacy Officer

We are accountable for the personal information under our control, including information we transfer to a service provider for processing. We have designated a Privacy Officer who is responsible for our compliance with this Policy and with PIPEDA, and who is the contact point for every question, access request, and complaint about personal information.

4. Personal Information We Collect

We collect only what we need for the purposes set out in section 5. Assessing a payday loan application requires a close look at your income and your recent banking activity, because Ontario law fixes how much we may advance by reference to your net pay, and fixes your due date by reference to your next regular income date. That is why the list below is specific. In the chat assistant you write in your own words, so section 4.6 says what it records and what we ask you to leave out.

4.1 Information you give us

  • Identity and contact details — full legal name, date of birth, residential address in Ontario, email address, mobile and other telephone numbers.

  • Income and employment details — your source of income (employment, pension, or government benefits), your employer or payer, how often you are paid, the date of your next regular income, and your net pay for the period.

  • Banking details — the financial institution, transit, and account number used to send you the advance and to take repayment.

  • Application content — everything you enter in the application form or tell us by telephone, email, or text message, and any document you upload, such as a pay stub, a bank statement, or proof of address. What you type in the chat assistant is not part of your application; section 4.6 describes it.

  • Identity documents — a government-issued identity document, and any image of it captured to verify your identity.

We do not require your Social Insurance Number in order to consider your application, and you are not obliged to give it to us. If you choose to provide it in your application, we use it only to identify you accurately to a consumer reporting agency. Do not type it into the chat assistant.

We do not ask for — and you should not send us — information about your health, race, religion, ethnic origin, sexual orientation, or political beliefs. None of it is relevant to a lending decision.

4.2 Information from the secure bank connection

Rather than asking you to gather and send statements, we offer a secure bank connection operated on our behalf by Flinks Technology Inc.. If you use it:

  • You enter your online banking credentials on the provider’s own secure interface. Through that connection we never see, receive, or store your online banking password. Do not give it to us in any other way, including in the chat assistant.

  • The connection returns a read-only view of the accounts you select: account and holder details, current and available balances, and a history of transactions, typically covering the preceding 90 days.

  • From that history we look at your deposits and their regularity, your net pay and pay dates, rent, loan and other committed payments, overdraft and non-sufficient-funds activity, and payments to other payday lenders.

  • To find your regular income in that history, we read the credits to the accounts you connect — each deposit’s date, amount and description — as our provider, Flinks, returns them, and we may use artificial intelligence to interpret that data. Our own software checks every deposit taken for income against the transaction history before anything is relied on, and no decision about your application is made by that interpretation alone (section 12).

  • The connection is a point-in-time retrieval. It does not allow us to move money, and we do not maintain ongoing access to your account after the check unless you separately agree to it.

  • If you would rather not connect your account, you may ask us to consider your application on the basis of bank statements you provide instead, and we will tell you whether we are able to do so.

4.3 Information we collect from others

  • Consumer reports — a credit report, a credit score, or both, obtained from a consumer reporting agency with the express consent described in section 7.

  • Identity verification and fraud prevention — the results of checks run by providers acting on our behalf, which may include confirming your identity document, matching your details against reference databases, and device and fraud-risk signals. Where a check requires you to photograph your identity document and yourself, those images are used only to verify your identity.

  • Payment information — confirmation from payment processors and financial institutions that a transfer was sent, received, returned, or dishonoured.

  • References and verifications — information from a person or organization you have expressly authorized us to contact, such as your employer, to verify what you have told us.

4.4 Records we create in the course of the Services

  • Application and decision records — the assessment we carried out, the decision, and the reasons for it.

  • Agreement records — your loan agreement, evidence that the agreement and the required statements were made available to you before you entered into it, your electronic signature, and the associated audit trail (timestamps, IP address, and a record of the document you accepted).

  • Account records — the amount advanced, the cost of borrowing, the due date, payments made, any cancellation, any extended payment plan, and any default charge.

  • Communications — emails and text messages exchanged with us, the record of every conversation in the chat assistant, as described in section 4.6, and recordings or notes of telephone calls where you have been told at the outset that the call may be recorded.

4.5 Information collected automatically on the Site

When you visit the Site, our hosting infrastructure records standard server-log information — IP address, browser and device type, the page requested, and the time of the request — which we use to operate and secure the Site. If you use the chat assistant, further technical details are collected when you send a message: section 4.6 lists what we record with a conversation, and section 16 describes the security check that starts with your first message. Section 16 describes the cookies and similar technologies the Site uses.

4.6 The chat assistant

The Site has a chat assistant. It introduces itself as John, its messages are labelled “John, AI assistant”, and it is automated: its replies are generated by a language model from a rulebook and a fact sheet that we wrote. Section 12 says what it can and cannot do. If you use it, we record:

The conversation — every message you send, every reply of the assistant, and every reply of a person on our team who joins the conversation, with the date and time of each. Recording starts with your first message, and your messages are kept as you typed them. A message you send while the assistant is switched off, or after a limit we place on its use has been reached, is recorded in the same way, even though the assistant does not answer it. The record also shows which of the chat’s fixed messages our server sent you, and keeps any reply the assistant wrote that our automatic checks stopped before you saw it. A message the chat does not accept, for example because it is too long or too many messages were sent, is not recorded, and the chat tells you so.

Technical details — a random identifier for the conversation, the short reference for the conversation that is shown in the chat window, your IP address, your browser and device type, and the result of the security check described in section 16. While your chat window checks for replies, the record also keeps the time it last did so, and a person on our team who answers you may be told that time. The record does not include the page of the Site you were on.

Contact details you leave — where no one on our team is available and you leave a message for us, the email address or mobile number you give so that we can reply, and a record of your consent to our using them: the wording you were shown, that you ticked the box, and when. That record of your consent also holds the contact detail you gave, the reference of the conversation, your IP address, and your browser and device type. It is kept apart from the conversation.

The chat is there to answer questions. It is not part of the application, and it does not need your banking or card details or the numbers on your identity documents. Please do not type them into it: no account or card number, no online banking password, no Social Insurance Number, and no identity-document number. Please also leave out anything about your health, race, religion, ethnic origin, sexual orientation, or political beliefs (section 4.1). The place for the details an application needs is the application itself.

If you type such details anyway, they are recorded with the rest of the conversation, as typed, and a person on our team who is passed the conversation sees them as typed. Before a message is passed to the language-model provider that generates the reply, an automatic step removes from the copy we send long numbers that look like card, account, or identity numbers. That step cannot catch everything, and it does not remove words, such as a password, so please leave these details out.

5. Why We Collect It

We collect, use, and disclose personal information for the following purposes, within the limits set out after this list:

  • (a) to confirm who you are, that you are at least 18 years old, and that you live in Ontario;

  • (b) to assess your application — your income, your banking history, and your creditworthiness — and to decide whether to lend, how much, and for which term. Every application is assessed. All credit is welcome, but approval is based on your income and banking history and is never guaranteed;

  • (c) to apply the limits Ontario law places on us, and our own: the amount and the term of your loan (a payday loan is $1,500 or less, for 62 days or less; we lend up to $1,500, for up to 30 days, or for 61 days); the rule that a single payday loan may not advance more than 50% of your net pay for the pay period (O. Reg. 98/09, s. 16.2(3)); the rule that the term may not end before your next regular income date (O. Reg. 98/09, s. 34(1)); the rule that we may not make you a new payday loan until seven days after the outstanding balance of your previous loan with us has been paid in full (PLA s. 35(1)); and our own rules that we do not make a third or subsequent payday loan to the same borrower within a 63-day period and that, after your second payday loan with us, we do not make you a new payday loan until 70 days after the day that loan has been repaid in full (the advance plus the cost of borrowing), after which the count starts again;

  • (d) to prepare your loan agreement, to give you the disclosures the law requires before you enter into it, and to record that you received them;

  • (e) to send you the advance and to take repayment;

  • (f) to administer your loan, including a cancellation within the two-business-day window, an extended payment plan, early repayment, and collection of amounts owing;

  • (g) to communicate with you about your application, your loan, and the Services, including by text message as described in section 15;

  • (h) to detect, investigate, and prevent fraud, identity theft, unauthorized account access, and other unlawful activity;

  • (i) to keep the records we are required to keep as a licensee, and to produce them to the Registrar of Payday Loan Services or the Ministry of Public and Business Service Delivery when required;

  • (j) with your separate consent, to send you commercial electronic messages about our products and services;

  • (k) to comply with our legal obligations and to respond to a court order, subpoena, warrant, or other lawful demand;

  • (l) to operate the chat assistant on the Site: to answer what you ask, through the automated assistant or through a person on our team; to pass your conversation to a person when you ask for one, when a message appears to be a notice to us, or in the other cases listed in section 12, so that a person can deal with it; to reply to a message you leave for us; to keep a record of what was said and when; and to correct the rulebook the assistant works from;

  • (m) to protect the Site and the chat assistant against automated abuse, including through the security check described in section 16.

Your application and your loan. Ontario’s payday loan regulation, O. Reg. 98/09, requires us to make sure that your application, and all documentation relating to it or to your loan agreement, are used only to provide a payday loan. They are never used in connection with any other good or service (s. 27(1)). That documentation includes everything you give us when you apply, as section 4.1 describes. It also includes what we obtain to assess your application, such as the information from the bank connection, the results of identity checks, and your consumer report. And it includes your loan agreement and the application, agreement, and account records described in section 4.4. No consent changes this rule, whether you give it by ticking a box, by accepting our Terms and Conditions, or in writing. We do not require you to buy, use, or otherwise transact in any good or service other than a payday loan as a condition of getting one (s. 27(2)). We do not offer or provide any other good or service in connection with your loan agreement, for ourselves or for anyone else, whether or not you would pay for it (s. 27(3)).

Information you give us about a loan. Information you give us in connection with a payday loan that you have applied for, hold, have held, or have asked us about is used for a purpose not connected with that loan only with your consent (O. Reg. 98/09, s. 29(2)). That includes your application, and what you tell us in a call, an email, a text message, or the chat assistant. For example, we do not use it to obtain payment on another payday loan unless you consent. This applies on top of the rule in the paragraph above: your application and the documentation of your application or your loan agreement are used only to provide a payday loan, and no consent widens that. No legal entity related to us uses your application, its documentation, or any other information about your loan for a purpose of its own.

If you write to us in the chat assistant, sending your message is your consent (section 6, and the notice shown in the chat assistant) to the chat purposes in (l) and (m). It is also your consent to what section 8 says the providers that run the chat do with what they receive. That consent does not extend to any other purpose unconnected with your loan.

Everyone, including visitors who never apply. We collect, use, and disclose personal information only for the purposes this Policy identifies. They include those in the list above, the reporting and disclosures described in sections 7 and 8, the purposes of a consent you give us, and, for what the Site collects automatically, those described in sections 4.5 and 16. Each must be a purpose that a reasonable person would consider appropriate in the circumstances (PIPEDA, s. 5(3)). We collect only what those purposes need (PIPEDA, Schedule 1, clause 4.4). Before we use personal information for a purpose this Policy does not identify, we will tell you that purpose and ask for your consent, unless the law requires that use (PIPEDA, Schedule 1, clauses 4.2.4 and 4.5). Where the paragraphs above do not limit the information, we may also use it for such a purpose without your consent where the law allows that (PIPEDA, s. 7). This paragraph does not widen those above. Whatever you consent to, your application and its documentation are used only to provide a payday loan. Information you give us about a loan is used for a purpose not connected with it only with your consent. We never make you consent to more than we need as a condition of providing what you ask for (clause 4.3.3).

These limits come first. They apply to everything else in this Policy, including what section 8 says about disclosure, and to every consent you give us. Where this Policy, our Terms and Conditions, your loan agreement, or a consent could be read as allowing more, these limits govern. They do not stop us from keeping the records the law requires us to keep as a licensed payday lender, or from producing information when a law or a court order requires us to (purposes (i) and (k)).

We do not sell personal information. We do not rent it, trade it, or otherwise make it available to anyone for that person’s own marketing purposes.

We do not use chat conversations to advertise to you, and we do not use them to assess an application. People on our team read them to answer you, to keep a record, and to correct the assistant’s rulebook.

We collect personal information directly from you wherever we can, and from a third party only with your consent or where the law permits. Consent may be express or implied depending on the sensitivity of the information and the circumstances. Financial information, banking transaction data, income details, and consumer reports are sensitive. When you apply, we collect and use them only with your express consent, given in the application before the collection happens. The chat assistant is not part of an application: it does not need that information, and we ask you not to type banking or card details or identity-document numbers into it (section 4.6). The next paragraph explains how consent works in the chat.

The chat assistant. You do not have to use the chat to deal with us. When you open it, the greeting is shown at once, with a short notice above the text box. Before your first message you tick a box to confirm that you understand that the assistant is an AI, that it gives information only, not legal or financial advice, and that it can make mistakes. Ticking it is not how you agree: sending a message is. By sending one, you agree that we record the conversation and that a person on our team may read and answer it. You also agree that the messages the assistant is asked to answer are passed, with your earlier messages and the assistant’s earlier replies in the same conversation, to the language-model provider that generates the replies, as section 16 explains. You agree that the conversation is stored with our cloud hosting provider and, when it is passed to a person, with Slack, our internal messaging provider. These providers store or process it in Canada or the United States, and the language-model provider’s staff may access messages from other countries for safety review and support (section 9). And you agree that the security check described in section 16 runs; it sends Vercel technical details of your requests, and our server never sends Vercel what you type. If you do not agree, do not send a message; you can write to us at support@instant.credit instead.

If you choose to mention your income or other financial details in a message, we use them for the chat purposes in section 5 and not to assess an application. Where no one on our team is available and the chat asks you for an email address or a mobile number so that we can reply, it shows you the consent wording that applies to those details, with a box to tick. The box is not ticked in advance, and we keep a record of your consent and of the wording you were shown. You can stop using the chat at any time, and section 13 explains how to have the record of a conversation deleted.

Consent to receive marketing is never a condition of getting a loan. You may apply, be assessed, and be funded without agreeing to receive a single marketing message.

You may withdraw your consent at any time, on reasonable notice, by contacting the Privacy Officer. We will tell you what withdrawing consent means in practice. If you withdraw before we make a decision, we will stop assessing your application and it will not proceed. Withdrawal does not extend to information we must keep in order to administer a loan already advanced, to enforce our rights, or to satisfy a legal or regulatory record-keeping obligation, and it does not undo anything lawfully done while the consent was in effect.

7. Consumer Reports and Credit Reporting

We may obtain a consumer report about you — a credit report, a credit score, or both — from a consumer reporting agency registered in Ontario. In Canada these are principally Equifax Canada Co. and TransUnion of Canada, Inc. We may do so when you apply and, where you have consented, while you have a loan outstanding, to administer it and to collect amounts owing. A registered collection agency acting for us may also obtain one to collect an amount you owe.

The Consumer Reporting Act (Ontario) requires that you be told in writing that a consumer report may be obtained about you. That notice is the paragraph in bold type in section 2 of Part C of our Terms and Conditions, which also sets out the express consent you give when you apply. You may ask us for the name and address of any consumer reporting agency from which we obtained a report about you. You have the right to see your own file at that agency and to have inaccurate information in it corrected.

A credit check is part of how we assess an application; we do not offer, and do not advertise, credit without an assessment. A low credit score does not rule you out on its own, because we weigh your income and your banking history alongside it.

We may report information about your loan, including your payment history, to a consumer reporting agency. A missed payment can affect your ability to obtain credit from us or from anyone else.

8. Who We Disclose Personal Information To

We disclose personal information only as described here:

  • Service providers acting on our behalf — our application and loan-servicing platform; our bank-connection provider (Flinks Technology Inc.); identity-verification and fraud-prevention providers; payment processors and the financial institutions that carry the advance and the repayment; our electronic-signature provider; our customer-relationship management provider, which holds the enquiries submitted through the forms on this Site; our telephone, text-message, and email providers; our cloud hosting and document-storage providers, which also hold our records of chat conversations and host the gateway through which chat messages reach the language-model provider; any legal entity related to us that runs a service for us, which may include that gateway, or that holds an account we use with one of the providers in this list, other than a payment processor, a financial institution or a collection agency, and that receives from us only the personal information that service handles or that we keep in that account; our website-analytics providers, as described in section 16; the language-model provider that generates the replies of the chat assistant, which receives the messages the assistant is asked to answer, with your earlier messages and its earlier replies in the same conversation, as section 16 describes; Slack (Slack Technologies, LLC, a Salesforce company), our internal messaging provider, through which a chat conversation is passed to a person on our team in our Slack workspace; Vercel Inc., our hosting provider, which runs the security check on the chat assistant described in section 16; a collection agency registered in Ontario, where an account goes to collections; and our auditors and professional advisers.

  • Consumer reporting agencies, as described in section 7.

  • Public authorities — the Registrar of Payday Loan Services, the Ministry of Public and Business Service Delivery, the Office of the Privacy Commissioner of Canada, a court, a law enforcement agency, or any other body, where we are required or permitted by law to do so.

  • A successor or assignee, in connection with a sale, financing, securitization, or other transfer of all or part of our business or of our loan portfolio, subject to confidentiality protections appropriate to the transaction. Your loan agreement and this Policy continue to apply to the information transferred.

  • Anyone you direct us to, on your written instruction.

When we transfer personal information to a service provider for processing, we remain accountable for it. We require each provider, by contract or other means, to keep the information confidential, to protect it with safeguards comparable to our own, and to use it for the service it provides to us.

Some providers also use what they receive for purposes of their own. Providers that protect the Site against automated abuse may use technical information about a request to operate, secure, and improve their own services. The language-model provider that generates the chat assistant’s replies keeps the text it receives for a limited period for its own safety and abuse monitoring; it does not use that text to train its models. It may keep a message flagged in that monitoring for longer, and its staff may access messages from other countries for safety review and support.

What we store with a provider, such as the working copy of a chat conversation with our internal messaging provider, stays there until it is deleted, by us or under the retention rules that apply to our account. When we no longer need a provider to hold information for us, we delete it or require the provider to return or destroy it. What a provider keeps for a purpose of its own is deleted on that provider’s schedule; section 10 says more.

9. Information Processed Outside Ontario

Some of our service providers store or process personal information outside Ontario, including elsewhere in Canada and in the United States. That includes what you type in the chat assistant. Our record of each conversation is stored in Canada. The Site’s server, which receives each message, runs in the United States. The messages sent to the language-model provider that generates the assistant’s replies pass through a gateway run by us or for us by a legal entity related to us (section 16), on a server in the United States, and the provider processes them in the United States; its staff may access them from other countries for safety review and support. The copy of a conversation passed to a person on our team through Slack, our internal messaging provider, is stored in the United States, and so is the record of your consent when you leave us a message. People on our team may read and answer a conversation from other countries. Information located in another jurisdiction is subject to the laws of that jurisdiction, and may be accessible to its courts, its law enforcement, and its national-security authorities.

Transferring information for processing does not transfer accountability for it. We remain responsible under PIPEDA for information in the hands of a processor acting for us, and we require contractual protection of a comparable standard before any transfer. You may ask the Privacy Officer where information about you is processed and what protections apply to it.

10. How Long We Keep It

We keep personal information only as long as we need it for the purposes in section 5, or as long as the law requires. As a general rule:

  • Applications that are declined or abandoned — twenty-four (24) months from the decision or from the last activity on the application, after which the file is destroyed or de-identified. We keep a limited record for that period so that we can explain a past decision to you and detect repeat fraudulent applications;

  • Loans — seven (7) years after the loan is repaid, cancelled, or otherwise comes to an end, covering our record-keeping obligations as a licensee, the periods during which a claim or a regulatory review may arise, and tax and audit requirements;

  • Bank-connection data — retained as part of the application or loan file, for the periods above. Access to your account is not maintained after the retrieval;

  • Call recordings — no longer than twenty-four (24) months, unless a recording is relevant to a dispute, a complaint, or a legal proceeding, in which case it is kept until the matter is resolved;

  • Chat conversations — twenty-four (24) months from the conversation, or longer where a conversation is relevant to a dispute, a complaint, a legal proceeding, or a loan record. Where a conversation is relevant to a dispute, a complaint, or a legal proceeding, it is kept until the matter is resolved; where it belongs to a loan record, it is kept for as long as that loan record is kept, which is the period stated for loans above. Each of these periods applies only if it ends after the twenty-four months. A conversation can be deleted sooner at your request, as section 13 explains. The record is the one described in section 4.6;

  • Chat information held by providers — the language-model provider keeps the text it receives for a limited period, under its own retention terms, for its own safety and abuse monitoring, and may keep a message flagged in that monitoring for longer. The copy of a conversation passed to a person through Slack, our internal messaging provider, is a working copy: it is deleted with our own record of the conversation, at the end of the period above or sooner under section 13, and it may be deleted earlier under the retention setting that applies to our Slack workspace. Our own record, kept for the period above, is the record of the conversation. What Vercel keeps of the technical details it receives for the security check is held under its own retention terms;

  • Records of a breach of security safeguards — for at least twenty-four (24) months, as PIPEDA requires;

  • Server logs — short-lived, as described in section 16;

  • Values stored in your browser — your theme choice and your choice on the notice described in section 16 stay on your device until you clear your site data or your browser discards them. They are never transmitted to us, so we hold nothing to delete. If you use the chat assistant, the conversation and its identifier are kept in your browser’s session storage until you close the tab, unless your browser restores the tab; the identifier is sent to us each time the chat contacts our server, and our own record of the conversation is kept for the period stated above;

  • Audience-measurement data — held by Vercel under its own retention terms. The short-lived identifier derived from your request is discarded within 24 hours; what remains is usage data we read in aggregate and cannot trace back to you.

When information is no longer needed for any purpose, we destroy it securely or de-identify it so that it can no longer be associated with you.

11. Safeguards and Breach Response

We protect personal information with physical, organizational, and technological safeguards proportionate to its sensitivity: encryption of information in transit, access restricted on a need-to-know basis, authentication controls on our systems, access logging, confidentiality undertakings and training for personnel, security review of vendors, and a documented incident-response procedure. No system is perfectly secure and we cannot guarantee absolute security, so please protect your own devices, email account, and credentials.

If a breach of our security safeguards creates a real risk of significant harm to you, PIPEDA requires us to report it to the Office of the Privacy Commissioner of Canada and to notify you as soon as feasible, and to notify any other organization that may be able to reduce the risk. We keep a record of every breach of security safeguards, whether or not it is reportable.

12. Automated Processing and Human Review

Parts of our assessment are automated. Software reads the transaction history from your bank connection to identify your income and its regularity — we may use artificial intelligence to interpret the transaction history, as section 4.2 says, and our own software checks every deposit taken for income against it — then calculates the maximum we may advance against your net pay, checks the statutory timing rules, and scores the application for fraud risk. An application may be declined automatically where a rule is not met — for example, where the amount requested exceeds half of your net pay for the period, or where the seven-day rule has not yet run.

PIPEDA does not give a general right to human review of an automated decision. We offer one anyway. If your application is declined, or if we lend you a different term or amount than you applied for, you may ask the Privacy Officer to have the decision reviewed by a person, to be told the main information the decision was based on, and to correct information you believe is wrong. There is no charge for that review.

The chat assistant on the Site is automated as well. Its replies are generated by a language model, from a rulebook and a fact sheet that we wrote; no person writes the assistant’s replies. The assistant cannot see any application or any loan, and it makes no decision about anyone: it does not approve, decline, or price anything, and what you type in the chat is not used to assess an application. Its answers are general information. Where an answer differs from your loan agreement or our Terms and Conditions, the agreement and the Terms govern.

The security check that starts when you send your first chat message, described in section 16, is automatic too. It gives a pass or a fail. If it fails, your message is not accepted and you are shown our email address instead.

You can ask for a person by saying so in the chat. The conversation is then passed to our team, and a person will read it. The same happens when a message appears to be a notice to us, such as a cancellation, a demand for a refund, a request for a copy of your agreement, a complaint, or a request about your personal information other than a request to delete the conversation. It also happens when a message appears to say that you cannot pay on your due date or that your money has not arrived, or to ask for an extended payment plan or about a decision on your own application. A person may be available to answer you in the same chat window, depending on location and time zones. If no one is available, the assistant tells you so, and you can leave a message with an email address or a mobile number; we reply by email or text. A person on our team may also bring a copy of a conversation into Slack when they need to read it, for example to deal with a request about it.

A message you send while the assistant is switched off, or after a limit we place on its use has been reached, is still recorded, and a message that appears to be a notice to us is still passed to a person on our team. Such a message is not sent to the language-model provider at that time; section 16 says when it may be. The chat works in English only: a message in another language is recorded, but it may not be recognized as a notice, so send a notice in another language to us by email. If you tell the assistant to delete the conversation, section 13 says what happens.

13. Access, Correction, and Your Other Rights

Subject to the limited exceptions PIPEDA allows, you have the right to:

  • Be told whether we hold personal information about you, how we have used it, and to whom we have disclosed it;

  • Access that information and be given it in a form that is generally understandable;

  • Correct information that is inaccurate or incomplete and, where we disagree, have your annotation recorded on the file and passed on to anyone who has access to it;

  • Withdraw your consent, as described in section 6;

  • Ask for a human review of an automated decision, or ask for a person in the chat assistant, who may be available depending on location and time zones, as described in section 12;

  • Complain about our handling of your personal information, as described in section 14.

Send requests in writing to the Privacy Officer using the details in section 3. We respond within thirty (30) days, as PIPEDA requires, and will tell you in advance if we need the limited extension the Act permits. We may ask you to verify your identity before we act, and we use the information given for that verification and for nothing else. Access is free; if a request would involve a genuine cost, we will tell you the amount before doing the work so that you can withdraw or narrow the request.

If you type a request in the chat assistant and the chat accepts your message, it is recorded with the time it was sent. A message that appears to be a request about your personal information, other than a request to delete the conversation, is passed to a person on our team, as section 12 describes. If the chat does not accept your message, write to the Privacy Officer (section 3) instead. We ask you not to type identity-document numbers into the chat, so if we need to verify who you are before we act, we will tell you how. Each conversation has a short reference, which is shown in the chat window. To ask for a copy of a chat conversation, or for its deletion, quote that reference. Keep a note of it, because it is erased from your browser with the conversation when you close the tab, unless your browser restores the tab.

You may ask us to delete our record of a chat conversation before the end of the period in section 10, in two ways. You can send an email to the Privacy Officer (section 3), quoting the reference. Or, while you are in the conversation, you can tell the assistant to delete it, or use the chat’s own control for deleting it; you are asked to confirm, and it is then removed. Removal covers our own record and, where the conversation was passed to a person, the working copy in our Slack workspace, including the replies a person on our team wrote there. If a removal you ask for in the chat cannot be completed at once, the chat tells you so, and we complete it. A conversation that is relevant to a dispute, a complaint, a legal proceeding, or a loan record, or that the law requires us to keep, is not removed; we tell you so, and why. If the conversation holds a message that section 12 says is passed to a person, other than a request for a person or a request about your personal information, a person on our team checks the conversation before anything is removed. If it does not have to be kept, we then remove it. After a removal we keep only an entry recording that a conversation with that reference was deleted, and when, and, where you left a message with your contact details, the record of the consent you gave. What the language-model provider keeps for its own limited period, and what Vercel holds from the security check, are deleted on those providers’ schedules, not on ours.

PIPEDA requires or permits us to refuse access in a few defined situations — for example where giving access would reveal personal information about another person that cannot be severed, where the information is protected by solicitor-client privilege, or where disclosure would compromise an investigation into a breach of an agreement or a contravention of the law. If we refuse, we will tell you in writing why, and tell you how to complain about the refusal.

14. Complaints

If you are unhappy with how we have handled your personal information, or with our response to a request, start with the Privacy Officer (section 3). We will acknowledge your complaint, investigate it, and give you a written answer. If we find the complaint justified, we will correct the practice, including amending this Policy where that is what is needed.

If you type a complaint in the chat assistant and the chat accepts your message, it is recorded with the time it was sent, and a message that appears to be a complaint is passed to a person on our team, as section 12 describes. The conversation in your browser is erased when you close the tab, unless your browser restores the tab, so a reply given in the chat window may not stay with you. For an answer you can keep, or if the chat does not accept your message, write to the Privacy Officer (section 3).

You may also complain, at any time, to the Office of the Privacy Commissioner of Canada — 1-800-282-1376, www.priv.gc.ca.

A complaint about our conduct as a licensed payday lender — the cost of borrowing, your agreement, cancellation, an extended payment plan, or collection practices — goes instead to the Ministry of Public and Business Service Delivery, Consumer Services Operations Division, at (416) 326-6203 or CPOLicensing@Ontario.ca.

15. Electronic and Telephone Communications

We send you messages about your application and your loan — status updates, document requests, confirmation of the advance, reminders of your due date, and notices about your account. These are transactional messages: they are part of the Services, and you receive them for as long as you have an application or a loan with us. Replying STOP to one of our text messages stops text messages to your number until you reply START, including sign-in codes and e-Transfer links and codes. It does not end the contact about your application or your loan: we continue to contact you about it by email and telephone.

Marketing messages are different. We send them only where you have given consent that meets CASL, and:

  • you may stop marketing text messages at any time by replying STOP, which also stops our other text messages, as the paragraph above explains; we send at most one confirmation;

  • you may unsubscribe from marketing email using the link in any message, or by writing to support@instant.credit;

  • you may ask to be added to our internal do-not-call list by contacting support@instant.credit or (514) 600-0924;

  • opting out of marketing does not end the contact about a live application or an outstanding loan.

If a payment is missed, the hours during which we may contact you about it are limited by Ontario Regulation 98/09 — see Part B, section 12 of our Terms and Conditions.

16. Cookies and Website Technologies

The Site is deliberately light on tracking:

  • No advertising or profiling trackers. The Site does not load third-party scripts for advertising, retargeting, social media, or behavioural profiling. It sets no cookies to measure how the Site is used, and it sends nothing about you or your visit to Google. The security check that protects the chat assistant has its own entry below; its purpose is to keep automated software out of the chat.

  • Advertising click identifiers and campaign tags. When you reach the Site from one of our advertisements, the link you clicked carries an identifier for that click and tags naming the campaign, the advertisement and the search term. We read them from the address of the page you land on, keep them with the record of your visit and, if you go on to apply, with your application, so that we know which advertisements lead to applications and to loans. We use them for nothing else. We do not send them, or anything about your visit or your application, back to the advertising platform, and no advertising script is loaded to do this. For a visit that does not lead to an application we keep them for 90 days; for one that does, they are kept with your application for the periods in section 10.

  • Local browser storage. Apart from the chat assistant and its security check, which have their own entries below, the Site stores two values in your browser’s local storage: your display-theme choice (light or dark), and your choice on the notice described below, so that we do not ask again and so that a decision to switch the audience measurement off is remembered. Both stay on your device, are never transmitted to us, and can be cleared at any time through your browser settings.

  • The application form. The online application is served in a frame from our secure application platform on a separate domain, and it loads only when you choose to start an application. That platform uses the cookies and browser storage strictly necessary to operate your application session.

  • Audience measurement. The Site uses Vercel Web Analytics, operated by Vercel Inc., our hosting provider, to count page visits and see which pages are used. It is cookieless: it sets no cookie and stores nothing on your device. To tell one visit from another, Vercel derives a short-lived identifier by hashing details of your request, including your IP address and browser; that identifier is held by Vercel, not by you, and is discarded within 24 hours. It cannot be used to follow you to other websites or to build a profile of you. What is recorded is the page visited, the referring page, your browser and device type, and your approximate location derived from your IP address, which may be as precise as your city. It does not record your name, email address, phone number, or anything you type into a form, and the online application is served from a separate domain that this measurement does not reach. You can switch it off, or switch it back on, at any time using Analytics preferences at the foot of any page on the Site; we stop measuring from that point on that browser. Your choice is remembered in your browser’s storage, which means it applies to that browser only, and it will be forgotten if you clear your site data, use a private window, or use a browser that restricts such storage — in which case the notice appears again so you can make the choice afresh.

  • Server logs. Our hosting infrastructure keeps standard, short-lived logs (IP address, request, timestamp) for security and reliability.

  • The chat assistant. The chat button on the Site opens an assistant that runs on the Site itself. Its code does nothing until you open the chat panel, and it sends nothing until you send your first message. Each message you send goes to the Site’s own server, which records it once it passes the security check below and the chat accepts it, also when the assistant does not answer it. Each message the assistant is asked to answer goes from our server, with your earlier messages and the assistant’s earlier replies in the same conversation, up to twenty in all, through a gateway to the language-model provider that generates the reply. This happens whether or not a reply is then shown to you. The gateway is run by us or for us by a legal entity related to us (section 8); it relays the messages and does not store their text. A message the assistant is not asked to answer is not sent to the provider at that time: for example, when the assistant is switched off, when a limit on its use has been reached, or when our own checks pass the message to a person first. It may be sent later, among those earlier messages, if the assistant is asked to answer a later message in the same conversation. The provider never receives a reply from a person on our team, a message you send while such a person is answering you, or a message you leave for us with your contact details. While the tab stays open, the conversation, with its reference, and a random conversation identifier are kept in your browser’s session storage. The identifier is sent to us each time the chat contacts our server, so that replies, including a reply from a person on our team, reach the right conversation, and so that a person on our team can see when your chat window last checked for a reply. Both are erased when you close the tab, unless your browser restores the tab, and ending the chat in the window erases them at once. The chat itself stores nothing else in your browser. Sections 4.6, 8, and 10 say what we record on our side, who receives it, and how long it is kept.

  • Security check on the chat. To keep automated software out of the chat, the Site uses Vercel BotID, a security check provided by Vercel Inc., our hosting provider. We use its Basic level only. It is invisible while it runs and asks you nothing. It does not run when a page loads or when you open the chat; it starts when you send your first message. Your browser then loads a script of the check from the Site’s own address and runs it. That request goes to Vercel and, like any request a web page makes for a script, carries the address of the page you are on and the Site’s cookies. Your browser loads the script again for your first message after you move to another page of the Site, come back to the tab, or reconnect. Each time you send a message, leave us a message, or ask for a conversation to be deleted, our server also sends Vercel the technical details of that request, including your IP address, your browser and device details, and your browser’s language settings, and Vercel returns a pass or a fail. When our server asks Vercel for the result, it never sends Vercel what you type. If the check fails, your message is not accepted and you are shown our email address instead. We keep the result with the conversation (section 4.6). Vercel may keep its own record of these checks, with details such as the IP address, browser, country, and result of each. Vercel may also use technical information about requests to operate, secure, and improve its own services, and keeps what it holds under its own retention terms (sections 8 and 10). We do not use the check to advertise to you, to follow you to other websites, or to build a profile of you.

Vercel Web Analytics is the only analytics on the Site. The chat assistant and its security check are not analytics. They are described above: the chat does nothing until you open it, the security check does not start until you send your first message, and you agree to both by sending a message, as section 6 explains. The chat keeps a record of the conversation itself, as section 4.6 describes. Apart from the chat assistant and its security check as they are described above, if we ever introduce anything that would track you across other websites, build a profile of you as an identified individual, record your session or your mouse and keyboard activity, or locate you more precisely than the city-level estimate described above — including advertising or retargeting pixels, cross-site tracking, session recording, and heat-mapping — we will update this Policy and ask for your express consent before switching it on.

17. Minors

The Site and the Services are directed to adults. You must be at least 18 years old and have reached the age of majority in Ontario to apply. We do not knowingly collect personal information from anyone under 18, and we do not lend to minors. If you believe a minor has given us personal information, contact the Privacy Officer and we will delete it.

18. Changes to this Policy

We may change this Policy at any time, without notice. Changes take effect when we post them on this page; the “Last updated” date at the top shows the last change. If you keep using the Site or our services after a change, the new Policy applies.

19. Contact

Instant Credit S.E.C, acting through its general partner Credit Inc. — licensed payday lender, Ontario licence no. 4741682, expiring 3 September 2027.

Questions about this policy? Email the Privacy Officer at privacy@instant.credit or call (514) 600-0924.

Chat with John Apply Now