It is a system operated by the IRCC. They have advised that the information is, in every case, handled according to Canada's privacy laws. They've also assured us that no application or biometrically collected data is stored at the visa application centre, that all databases containing personal information are located in Canada, and that the information submitted—
On February 25th, 2021. See this statement in context.