Privacy policy

Our commitment to privacy

PragmaLegal Inc. (“we,” “us,” or “our”) protects the personal information entrusted to it in accordance with applicable laws, including Quebec’s Act to modernize legislative provisions as regards the protection of personal information (Law 25) and the Code of Professional Conduct of Lawyers of the Barreau du Québec. This policy explains what we collect, why we use it, who we share it with, and the choices available to you.

Information we collect

Account and identity

· Name, professional contact information, and language preference
· Firm, role, and professional membership number, where applicable
· Login credentials and security settings

Usage and technical data

· IP address, device type, browser, and security logs
· Features used, login dates, and preferences
· Essential cookies and, with your consent, analytics data

Professional data and content

· Matters, documents, notes, calendars, and communications you upload
· Billing, time, accounting, and trust-account data you choose to process
· Prompts and outputs from artificial intelligence features

Payment and support

· Billing details and transaction status; full card numbers are processed by our payment provider
· Support requests, feedback, and communications with our team

Your matter content may be protected by solicitor-client privilege or professional secrecy. You remain responsible for ensuring that your use of the Service complies with your professional duties and obligations to clients.

Why we use your information

Necessary uses

Create, secure, and administer your account
Provide requested features, process payments, and deliver support
Prevent fraud, investigate incidents, and maintain Service continuity
Meet our legal, tax, and regulatory obligations

Consent-based uses

Measure site usage through optional analytics
Send promotional communications
Enable an optional integration or processing activity you requested

You may withdraw consent at any time, subject to legal or contractual restrictions. Withdrawal is not retroactive and may limit certain optional features.

Sharing and service providers

We do not sell your information

We do not sell or rent personal information. We disclose it only as needed to provide the Service, with your authorization, or as required by law.

Key service providers

Service	Purpose	Processing location	Safeguards and certifications
Application and database hosting	Store and run the Service (matters, accounts, files)	Data centre located in Quebec, Canada; off-site backups also in Canada when used	Access controls; encryption at rest and TLS in transit where supported
Supabase (operated for PragmaLegal)	Database, authentication, and file storage	Quebec / Canada (same geographic location as the hosting above)	SOC 2 Type II (provider); AES-256 encryption at rest and TLS in transit where supported
Stripe	Payments and subscription management	Canada and the United States	PCI DSS Level 1; SOC 1 and SOC 2
Resend	Transactional email delivery	United States	Contractual and technical security measures
Sentry	Technical error logging to maintain and secure the Service	United States	Default PII sending disabled; app-level scrubbing of emails, tokens and sensitive headers before transmission — unstructured fragments may remain
Anthropic (Claude)	User-initiated AI features (suggestions, document analysis, assistant)	United States	Processed on user instruction; provider contractual and technical measures
xAI	Audio transcription when that feature is used	United States	Processed on user instruction; provider contractual and technical measures
Google	Optional integrations (OAuth, calendar, email, Drive or contacts) when the firm connects them	United States	OAuth; the firm chooses to enable the connector
QuickBooks Online (Intuit)	Invoice export and payment status when the firm connects the integration	United States	OAuth; the firm chooses to enable the connector
CanLII	Canadian legal research (search queries and related metadata)	Canada	Third-party API; query content is sent to CanLII
CourtListener (Free Law Project)	US case-law research	United States	Third-party API; query content is sent to CourtListener
Judilibre (via PISTE / Cour de cassation)	French case-law research	France	Third-party API; query content is sent to Judilibre / PISTE

Information processed in the United States or France may be accessible to authorities in those jurisdictions under applicable laws. We assess the risks and use appropriate contractual and technical safeguards. Legal research modules, AI features, and accounting or Google integrations are used only when you enable or query them. Learn more about the CLOUD Act

Your rights

Access

Ask what information we hold about you and obtain a copy.

Correction

Have inaccurate, incomplete, or ambiguous information corrected.

Withdraw consent

Withdraw consent for an optional use, subject to applicable law.

Cessation or de-indexing

Where permitted by law, request that dissemination stop or that information be de-indexed.

Portability

Receive computerized information collected from you in a structured, commonly used technological format.

Exercise your rights

Email privacy@pragmalegal.ca. We may verify your identity and request details needed to process your request.

We generally respond within 30 days after receiving a complete request, subject to extensions permitted by law.

Make a complaint

Please contact our Privacy Officer first. You may also contact the appropriate regulator.

Commission d'accès à l'information du Québec

1 888 528-7741

Commission website

Privacy incidents

Our commitment

If a privacy incident occurs, we act as soon as reasonably possible and in accordance with applicable legal requirements, including Quebec Law 25.

Contain the incident, preserve relevant evidence, and assess the risk of serious injury
Notify affected individuals when legally required, as soon as reasonably possible and within the timelines prescribed by Law 25
Notify the Commission d'accès à l'information du Québec (CAI) when legally required, as soon as reasonably possible and within the timelines prescribed by Law 25
Maintain required records and implement measures to reduce the risk of recurrence

Cookies and similar technologies

Essential cookies

These cookies are necessary for the Service's operation and security and cannot be disabled in our systems.

· Authentication and session continuity
· Attack protection and fraud prevention
· Language, consent, and interface preferences

Duration varies from the session to 12 months, depending on the function.

Optional analytics

With your consent, we may use analytics data to understand usage and improve the Service.

You can change your choice in the privacy settings or clear cookies in your browser.

We do not use behavioural advertising cookies or sell advertising profiles.

Transfers outside Quebec and Canada

Some providers may process information outside Quebec or Canada. Before a transfer, we assess relevant factors and require safeguards proportionate to the information's sensitivity.

Foreign lawful access

No measure can entirely eliminate the risk that a foreign authority may obtain lawful access to data processed in its jurisdiction.

Safeguards

· Contractual clauses, confidentiality commitments, and subprocessor controls
· AES-256 encryption at rest and TLS in transit where supported by the relevant service
· Access controls, logging, minimization, and limited retention periods
· Privacy impact assessments where required

To understand risks associated with US laws, read our note on the CLOUD Act

Questions about your information?

Contact our Privacy Officer.

Contact our Privacy Officer

Version 1.0 — March 2025

Designed to address applicable Quebec and Canadian requirements, including Law 25. This policy is not legal advice.

Privacy Officer