Privacy Policy

Last updated: October 25, 2026

This policy explains how Vansure Insurance Services Ltd. ("Vansure", "we", "us") collects, uses, shares and protects personal information when you use vansure.ca, our forms and our quote tools. We follow British Columbia's Personal Information Protection Act (PIPA) and, where it applies, Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

1. Who we are

Vansure Insurance Services Ltd. provides insurance-related information, quote services and assistance to individuals, families and businesses in British Columbia.

Insurance advice and applications are handled by individually licensed advisors. Depending on the product, an application may be placed through a managing general agency, such as Hub Financial Inc., and the insurance company you choose. Vansure is not an insurance company.

Contact: Vansure Insurance Services Ltd., #209–11950 80th Ave, Delta, BC V4C 6P6 · info@vansure.ca · (778) 892-7800

Our Privacy Officer is responsible for how we handle personal information. You can reach them at info@vansure.ca.

2. What we collect

We only collect what we need for the purpose you came to us for.

When you contact us or ask for a quote

• Your name, email address and phone number.
• The product you're interested in and your message.
• For a quote: details such as date of birth, sex, smoking status, coverage amount, term and plan type, and any health information you choose to give us.

When you use the Community forms

We have three Community forms: Ask Vansure, Suggest an event and Nominate a business. They collect:

• Your first name and email address.
• Your message.
• For Ask Vansure, the topic you choose.
• For event suggestions, an event link if you add one.
• For nominations, the name of the business.
• That you agreed to the consent statement, which version of it you saw, and when.

Please leave policy numbers, health details, dates of birth and banking information out of these forms. We'll ask for anything we need later, in a safer way.

When you contact us as a partner

Your name, company, partner type, work email, phone number, website and notes. Please don't include client names or client details.

Information about other people or businesses

An event suggestion or a nomination may include details about an event organizer or a business. Please only share what is needed and what you're comfortable sharing. We contact the organizer or business before we list or feature them. We only publish a local story with permission.

Technical information

When you visit our site, your browser sends technical information to us and to the services that run the site. This includes your IP address, browser and device type, the pages you visit and the time of your visit. See sections 8 and 9 for details.

3. Why we use it

We use personal information to:

• Answer your questions and requests.
• Prepare quotes and connect you with a licensed advisor.
• Process an application you choose to make, with the managing general agency and the insurer.
• Check and follow up on event suggestions and business nominations.
• Keep our forms safe from spam and abuse.
• Understand how our site and tools are used, so we can improve them.
• Meet our legal and regulatory obligations.

We do not sell personal information.

4. Consent

We ask for your consent before or when we collect your information. Each Community form has a consent box that explains how we'll use your name and email. We record that you agreed, which consent statement you saw, and the time.

You can withdraw your consent at any time by emailing info@vansure.ca, subject to legal or contractual limits. If you withdraw consent, we may not be able to answer your question or continue helping you, and we'll tell you if that's the case.

5. Who we share it with

We share personal information only as this policy describes:

• Insurance partners. If you apply for insurance, we share what's needed with the managing general agency, such as Hub Financial Inc., and the insurer you choose.
• Service providers. These companies help us run the site and our forms. They may only use your information to provide their service to us:
  • Webflow hosts our website.
  • Zoho CRM is our customer records system. Form submissions, questions and enquiries are saved there.
  • Supabase runs the system that receives our Community forms and holds a temporary encrypted copy until delivery to Zoho is confirmed (see section 7).
  • Cloudflare Turnstile checks that a form is sent by a person, not a bot (see section 8).
  • Google Analytics measures how our site is used (see section 9).
  • Content and font delivery services, such as jsDelivr and Google Fonts, deliver parts of our pages to your browser.
• Legal reasons. We may share information when the law requires it, for example with a regulator or a court.

If you choose to buy travel or visitor insurance online, you may be sent to an insurer's or administrator's website. That site's own privacy policy applies to what you give it there.

Our online quote portal (app.vansure.ca). When you ask for a quote online, these providers also handle your information:

• Vercel runs the quote portal. Its servers process your quote in the United States.
• Supabase stores your quote request in the portal's database.
• WinQuote / LifeGuide returns live rates for life, critical illness and mortgage protection quotes. It receives rating details only, such as age, sex, tobacco use, province and coverage amount, not your name or contact details.
• SIDKICK, our client file system, may receive and store a copy of your quote request in Canada so your advisor can access it.
• Resend sends your quote confirmation email.

Quote answers can include health information you choose to give, such as whether you have pre-existing conditions.

6. Where your information is stored

Our Community form system stores its temporary copies in Supabase's Canada (Central) region.

Our Zoho CRM account is hosted in Zoho's Canadian data centres.

Some of our service providers, including Webflow, Vercel, Cloudflare and Google, store or process information in the United States or other countries. Supabase may also process a form request, its service logs or quote portal data outside Canada. When information is outside Canada, the laws of that country apply to it. This can include lawful access by that country's authorities.

7. How the Community forms handle your information

When you send a Community form:

1. Checks. Your submission goes to our form system at Supabase. It checks the form, the spam check (section 8) and how many messages have been sent in a short time.
2. Delivery to Zoho. The system sends your submission to our Zoho CRM. That is where we read and answer it.
3. Temporary encrypted copy. In case delivery to Zoho is slow or interrupted, the system keeps an encrypted copy of your submission so it can try again. The copy is encrypted before it is stored, and the encryption key is stored separately from the encrypted copy, in Supabase's secure secrets storage.
   • As soon as Zoho confirms it has your submission, the encrypted copy is deleted.
   • If Zoho refuses the submission, the copy is deleted and you'll be asked to try again.
   • If delivery still can't be confirmed, the copy is deleted before 48 hours have passed since you sent it. In that case we may not have received your message. If you don't hear from us, please contact us and mention the reference number shown on screen.
4. 30-day technical log. For 30 days we keep a short technical record of each submission. It lets us confirm delivery and investigate problems. It contains:
   • the reference number shown to you;
   • the form type (question, event or nomination);
   • the delivery status and number of attempts;
   • any error code;
   • the Zoho record number;
   • dates and times (sent, last updated, confirmed, and when the temporary copy expires).
   It does not contain your name, email address, message or any code made from them.
5. Spam limits. To limit repeated messages, we keep keyed codes made from your IP address and email address, with the time, for about 24 hours.
6. Service logs. Supabase keeps short-term request logs for security and troubleshooting. They include your IP address, approximate location (such as city and region), browser details and the address of the request, but not the content of your form. These logs are kept for up to 7 days.
7. Backups. Any backup of our form system is kept for no more than 7 days. Other providers, such as Zoho, may keep deleted information in their own backups for a limited time before it is overwritten.

We read and answer submissions in Zoho CRM. What happens to your information there is covered in section 10.

8. Spam and bot protection

Our Community forms use Cloudflare Turnstile to check that a person, not a bot, is sending the form. Turnstile collects technical signals from your browser. These include your IP address, browser details and the website you're on. Cloudflare says it uses these signals to detect and block bots and to improve its bot detection. It does not use them to profile or target you. Cloudflare's Turnstile Privacy Addendum explains this in more detail.

We also use a hidden field that people don't see but bots often fill in, and we limit how many messages can be sent in a short time.

9. Analytics and cookies

We use Google Analytics to understand how people use our site, such as which pages, guides and tools are visited.

What we set up

• Our site code sends Google Analytics a short description of actions. Examples are which guide was opened, which filter or topic was chosen, which button was clicked, and whether a form was started and sent.
• Our site code does not send what you type into forms to Google Analytics. That includes your name, email address, message and the words you type into our search box.

We have not turned on Google signals or Google's advertising features.

What Google Analytics still receives

Like any website service, Google Analytics receives standard information from your browser. This includes your IP address, the page address, browser and device details, and an identifier stored in a cookie. Google uses the IP address to estimate your location, such as your city, region and country, and records device details such as device type, brand and model, operating system and browser versions, and screen resolution. Google Analytics does not log or store IP addresses.

Cookies

Google Analytics sets cookies (named _ga and _ga_ followed by an ID) to recognize repeat visits. They can last up to two years. Cloudflare Turnstile may use strictly necessary cookies or browser storage for bot detection.

You can block or delete cookies in your browser settings. You can also use Google's Analytics opt-out browser add-on. Blocking Turnstile may stop you from sending a Community form. You can always email us instead.

We have set Google Analytics to keep event and user-level data for 14 months.

10. How long we keep information

We keep personal information only as long as we need it for the reason we collected it, or as long as the law requires.

• Community form copies at Supabase: deleted when delivery is confirmed or refused, and no later than 48 hours (section 7).
• 30-day technical log: 30 days.
• Spam-limit codes: about 24 hours.
• Supabase service logs: up to 7 days. Form system backups: no more than 7 days.
• Zoho CRM records (questions, suggestions, nominations, enquiries and quote requests), and quote and client records in our quote portal and client file system: as long as we need them to help you and to keep accurate records, including any minimum period the law or insurance regulations require. When we no longer need them, we delete them or remove what identifies you.
• Community records: we review Ask Vansure questions, event suggestions and business nominations regularly, and delete those we no longer need after about two years, unless they became part of a client relationship or we must keep them by law.
• Applications: kept as required by our managing general agency, the insurer and insurance record-keeping rules.
• Analytics data: 14 months.

11. How we protect it

We use reasonable safeguards for the sensitivity of the information. They include:

• Encrypted connections (HTTPS) between your browser and our services.
• Encryption of the temporary Community form copy before it is stored, with the key stored separately from the copy in Supabase's secure secrets storage.
• Access limited to the people at Vansure who need it, with passwords and secret keys kept on the server, not in the website.
• Database access rules that block public access to form records.
• Spam checks, rate limits and limits on which websites can send to our form system.
• Choosing service providers that commit to protecting the information they handle for us.

No system is perfectly secure. If a breach of your information creates a real risk of significant harm to you, we will tell you. We will also report it to regulators where the law requires.

12. Your rights

You can ask us to:

• Tell you what personal information we have about you, how we've used it and who we've shared it with.
• Correct information that is wrong or incomplete.
• Withdraw your consent (section 4).

To make a request, email info@vansure.ca. We may need to confirm your identity first. We'll respond within 30 days, as BC law requires, unless the law allows more time. Some limits may apply. For example, we can't share someone else's information, and we may need to keep some records by law.

13. Questions and complaints

If you have a question or concern about privacy, please contact our Privacy Officer at info@vansure.ca first. We'll try to resolve it.

If you're not satisfied, you can contact:

• the Office of the Information and Privacy Commissioner for British Columbia (oipc.bc.ca); or
• the Office of the Privacy Commissioner of Canada (priv.gc.ca).

Questions about insurance licensing can go to the Insurance Council of British Columbia (insurancecouncilofbc.com).

14. Changes to this policy

We may update this policy when our services or the law change. We'll post the new version here and update the date at the top.

15. Contact us