Privacy policy

Our commitment to privacy

PragmaLegal (“we,” “us,” or “our”) protects the personal information entrusted to it in accordance with applicable laws, including Quebec’s Act to modernize legislative provisions as regards the protection of personal information (Law 25) and the Code of Professional Conduct of Lawyers of the Barreau du Québec. This policy explains what we collect, why we use it, who we share it with, and the choices available to you.

Information we collect

Account and identity

· Name, professional contact information, and language preference
· Firm, role, and professional membership number, where applicable
· Login credentials and security settings

Usage and technical data

· IP address, device type, browser, and security logs
· Features used, login dates, and preferences
· Essential cookies and, with your consent, analytics data

Professional data and content

· Matters, documents, notes, calendars, and communications you upload
· Billing, time, accounting, and trust-account data you choose to process

Payment and support

· Billing details and transaction status; full card numbers are processed by our payment provider
· Support requests, feedback, and communications with our team

Your matter content may be protected by solicitor-client privilege or professional secrecy. You remain responsible for ensuring that your use of the Service complies with your professional duties and obligations to clients.

Why we use your information

Necessary uses

Create, secure, and administer your account
Provide requested features, process payments, and deliver support
Prevent fraud, investigate incidents, and maintain Service continuity
Meet our legal, tax, and regulatory obligations

Consent-based uses

Measure site usage through optional analytics
Send promotional communications
Enable an optional integration or processing activity you requested

You may withdraw consent at any time, subject to legal or contractual restrictions. Withdrawal is not retroactive and may limit certain optional features.

Sharing and service providers

We do not sell your information

We do not sell or rent personal information. We disclose it only as needed to provide the Service, with your authorization, or as required by law.

Key service providers

Service	Purpose	Data transmitted	Location	Status
OVHcloud Canada (dedicated server)	Hosting, database, files	The application as a whole (Canadian entity, outside U.S. jurisdiction)	Quebec, Canada	Active
OVHcloud Canada (Object Storage)	Backups	Copies of the database and files (same Canadian entity)	Toronto, Canada	Active
Supabase (self-hosted)	Authentication, database, storage	Accounts, metadata, matters	Same server, Quebec	Active; no data transmitted to Supabase Inc.
Stripe	Subscriptions and payments	Billing identity, amounts (never full card numbers)	Canada and United States	Active
Resend	Transactional email	Address, first name, one-time codes, secure links — no matter titles or message excerpts	United States	Active
Sentry	Error monitoring and technical maintenance	Technical traces only; no access to client matters; personal information scrubbed before send	United States	Active
PostHog	Site usage analytics, after consent	Page views and interface events; no access to matters; session replay disabled; autocapture limited to the public site	United States	Active
Google Analytics	Site audience measurement, after consent	Page views and interface events; no access to matters; advertising signals disabled	United States	Active
Google, Microsoft, QuickBooks Online	Integrations	Whatever the firm chooses to connect	United States	Optional, at the firm's initiative
CanLII, CourtListener, Judilibre	Legal research	Search terms	Canada / United States / France	Not currently enabled

Client matters are hosted in Quebec with OVHcloud Canada (a Canadian entity); backups are in Canada. U.S.-based monitoring and maintenance tools (Sentry, PostHog, Google Analytics, Resend) do not receive matter content — only the technical or transactional data listed above. Services located in the United States or France may be subject to the laws of those countries. Last updated: October 18, 2026.

Learn more about the CLOUD Act

Your rights

Access

Ask what information we hold about you and obtain a copy.

Correction

Have inaccurate, incomplete, or ambiguous information corrected.

Withdraw consent

Withdraw consent for an optional use, subject to applicable law.

Cessation or de-indexing

Where permitted by law, request that dissemination stop or that information be de-indexed.

Portability

Receive computerized information collected from you in a structured, commonly used technological format.

Exercise your rights

Email privacy@pragmalegal.ca. We may verify your identity and request details needed to process your request.

We generally respond within 30 days after receiving a complete request, subject to extensions permitted by law.

Make a complaint

Please contact our Privacy Officer first. You may also contact the appropriate regulator.

Commission d'accès à l'information du Québec

1 888 528-7741

Commission website

Privacy incidents

Our commitment

If a privacy incident occurs, we act as soon as reasonably possible and in accordance with applicable legal requirements, including Quebec Law 25.

Contain the incident, preserve relevant evidence, and assess the risk of serious injury
Notify affected individuals when legally required, as soon as reasonably possible and within the timelines prescribed by Law 25
Notify the Commission d'accès à l'information du Québec (CAI) when legally required, as soon as reasonably possible and within the timelines prescribed by Law 25
Maintain required records and implement measures to reduce the risk of recurrence

Cookies and similar technologies

Essential cookies

These cookies are necessary for the Service's operation and security and cannot be disabled in our systems.

· Authentication and session continuity
· Attack protection and fraud prevention
· Language, consent, and interface preferences

Duration varies from the session to 12 months, depending on the function.

Optional analytics

With your consent, we may use Google Analytics and PostHog to understand site usage and improve the Service. These tools do not receive matter content.

You can change your choice in the privacy settings or clear cookies in your browser.

We do not use behavioural advertising cookies or sell advertising profiles.

Transfers outside Quebec and Canada

Some providers may process information outside Quebec or Canada. Before a transfer, we assess relevant factors and require safeguards proportionate to the information's sensitivity.

Foreign lawful access

No measure can entirely eliminate the risk that a foreign authority may obtain lawful access to data processed in its jurisdiction.

Safeguards

· Contractual clauses, confidentiality commitments, and subprocessor controls
· AES-256 encryption at rest and TLS in transit where supported by the relevant service
· Access controls, logging, minimization, and limited retention periods
· Privacy impact assessments where required

To understand risks associated with US laws, read our note on the CLOUD Act

Questions about your information?

Contact our Privacy Officer.

Contact our Privacy Officer

Version 1.0 — March 2025

Designed to address applicable Quebec and Canadian requirements, including Law 25. This policy is not legal advice.

Privacy Officer