Privacy
What we collect
Your address, the public assessment record for it, what you tell us, and — if you become a client — what the engagement, the payment and the filing require.
Why we collect it
Every collection point carries a stated purpose. We do not reuse information for a different purpose without asking you.
How long we keep it
On a retention schedule by document class. MPAC access keys are a special case: held encrypted, for at most 30 days.
Where it is held
We store your information in Canada, on servers in Toronto, and keep our backups there too. Some service providers process part of it outside Canada, mainly in the United States; they are named below. Information processed in another country may be accessible to that country’s courts and authorities.
Your rights
Access, correction, portability, deletion, and the right to have a person review any automated decision.
Who else sees it
The service providers below, each only to provide its service to us, under a contract. We do not sell personal information.
- DigitalOcean (Toronto, Canada): Hosting, database and backups
- Documenso (run on our own servers) (Toronto, Canada): Electronic signatures: name, email, signed documents, signing IP address
- Stripe (United States and Canada): Card and pre-authorized debit payments: name, email, amounts. Card numbers go straight to Stripe; we keep only a token.
- Twilio (United States): Text messages: phone number and message content
- Anthropic (United States): AI-assisted drafting and sorting: case text, with names, addresses and other direct identifiers removed first
- Intuit QuickBooks (United States and Canada): Accounting: customer name and invoice amounts
- PostGrid (Canada): Printed letters: name, mailing address, letter content
- Canada Post (AddressComplete) (Canada): Address lookup: the address you type
- Zoho CRM (Canada): Customer records: name, email, phone, file stage