Privacy Policy

Account information. When you register we collect your name, email address, firm name, and LSO licence number. The licence number is stored as you enter it and is not currently verified against the Law Society of Ontario directory.

Practice records you enter. Matters, documents, templates, clauses, and client records (names, contact details, notes) that you create in the dashboard. This data belongs to you and is only used to provide the service to your account.

Audit records. An append-only log of actions taken in your account (for example, creating a matter or approving a document), kept so your firm has a verifiable record of activity.

Usage analytics (optional). With your consent via the cookie banner, we use analytics to understand how the product is used. If you decline, analytics are not loaded. We do not sell personal information.

Client contact details and notes are encrypted at rest with AES-256-GCM before they are written to the database, in addition to the encryption provided by our hosting providers. Access to your data requires authentication to your account; records are scoped to the account that created them.

LegalPilot does not use AI to process your data today. The per-client AI-consent field in the dashboard exists so that, if AI-assisted features ship in the future, they can be restricted to clients who have consented. No such processing currently occurs.

We use a small number of infrastructure providers to run LegalPilot: Vercel (application hosting), Supabase (authentication and database), and, only if you consent to analytics cookies, PostHog (product analytics). These providers process data on our behalf to deliver the service.

Essential cookies keep you signed in and make the site function; they cannot be disabled. Analytics cookies are used only if you choose “Accept All” in the cookie banner. You can change your choice by clearing site data in your browser, which will show the banner again.

Your records are retained while your account is active. You can delete individual records in the dashboard (approved documents are intentionally locked to preserve the integrity of your firm’s record). To delete your account and its data, contact us at the address below and we will complete the deletion within 30 days, except where a record must be retained to meet a legal obligation.

You may request access to, correction of, or deletion of your personal information, and you may withdraw consent for analytics at any time. You can also export your audit log from the dashboard as CSV.

Questions or requests about this policy: [email protected]. If we make material changes to this policy, we will update the effective date at the top of this page.