Privacy Policy

This Policy explains how Azybia Inc. handles personal information in connection with its websites, accounts, support and enabled legal-practice services. It distinguishes Azybia’s own business records from client and matter information processed for a firm.

For account administration, security and our own communications, Azybia determines the relevant purposes. For a firm’s client records, the firm ordinarily determines the purposes and authorized users; Azybia processes information within the service and instructions agreed with it. Contact the firm first about its legal file, and Azybia about information under our own control.

Depending on what you use, information may include your name, professional role, firm, contact details, language, account identifiers, authentication records and support correspondence. Connected workspaces can also contain client contacts, matter details, documents, tasks, dates, time entries, invoices, payment records, signature evidence and access logs.

Legal files may include sensitive information about clients and third parties. Provide only information you are authorized to process and that is necessary for the task. Public demonstration content is illustrative and should not be replaced with real confidential client information.

Information can come directly from you, a firm administrator, an authorized colleague or client, an import you initiate, or a service you choose to connect. Website and service requests also involve technical information such as IP address, browser details and server logs.

An organization providing information about another person must have an appropriate basis to do so and provide required notices. We do not assume that access to a document authorizes every subsequent use or disclosure.

Information is used as needed to provide requested features, authenticate accounts, apply permissions, organize records, support users, administer subscriptions, investigate errors, prevent misuse and comply with legal obligations.

The applicable collection notice or service flow should explain a new purpose before information is used for it. This Policy is not blanket consent to unrelated marketing, profiling, AI training or disclosure of confidential matter content.

Where consent is required, it must relate to understandable purposes and the information needed for them. Sensitive information may require express consent. A firm must also consider professional secrecy and any lawful basis on which it acts for a client.

You may decline optional information or withdraw consent, subject to legal or contractual restrictions explained to you. This may prevent a feature from operating, but should not remove access to an unrelated service. Contact the Privacy Officer for help with a choice that is not available in the interface.

A local or demo workspace stores working data in browser storage, including localStorage or IndexedDB where used. Exported files are saved to the device or location you select. Clearing site data may permanently remove local records; a server account does not automatically back them up.

When live authentication or a connected workspace is enabled, information needed for that service is transmitted to its configured backend. The implementation supports Supabase for authentication and backend services. Local storage does not mean every visit is offline: hosting requests, sign-in, booking links and enabled connections can still communicate with providers.

Recipients depend on the service you use: authorized firm members, the client or signatory you select, and providers needed for hosting, authentication, storage, support or an explicitly connected function. Sharing a file, publishing website content or exporting records can create copies outside the workspace’s access controls.

Provider access must be limited to the purposes of the service and applicable contractual safeguards. Information may also be disclosed where required or permitted by law, including a lawful order, protection against fraud or a properly safeguarded business transaction. This Policy does not authorize selling client files or using them for unrelated advertising.

Animated Intelligence examples are prepared demonstrations, not evidence that live AI processing is active. If an external AI feature is enabled, its provider, information flow and relevant choices must be explained before protected information is sent.

These Services do not replace a lawyer’s judgment. We do not treat acceptance of this Policy as permission to use confidential matter content to train a shared AI model. If a decision based exclusively on automated processing is introduced, the legally required notices, explanation and review mechanisms must accompany it.

The site and enabled services may use cookies or device storage for authentication, security, language, preferences and workspace state. Browser settings can restrict or remove this storage, but doing so may sign you out or delete local work.

Optional analytics, advertising or profiling must be described and subject to the choices required by applicable law when introduced. External booking, source and provider links have their own privacy practices. Opening them may disclose ordinary request information to the destination; review its policy before submitting information.

Retention depends on the record, the purpose for which it was collected, the firm’s instructions, contractual commitments and applicable legal requirements. Information should not be kept longer than needed for those purposes. A legal hold, security investigation or statutory recordkeeping duty may require limited continued retention.

Deleting local browser data does not necessarily delete connected account records, and closing an account does not erase copies held by a firm, a recipient or you. Ask the Privacy Officer about deletion for a particular service, including any backup cycle or lawful exception. Do not rely on an unspecified retention period for a client file.

Safeguards must reflect the sensitivity of the information and the service involved. Connected-service controls can include authentication, access restrictions, secure connections and operational logging. A local preview does not offer the same controls as a configured production service, and no system eliminates every risk.

Protect your devices and exports, review permissions and report suspected exposure promptly. Where an incident occurs, Azybia must assess and respond to it, keep required records and notify affected people and authorities when applicable law requires. Do not send an entire confidential file merely to report a technical problem.

A provider or authorized recipient may process information outside your province or country. The location depends on the enabled service and its configuration; this Policy does not promise Canadian-only hosting or storage.

Before transferring protected information, obtain the service-specific information you need about providers, locations and safeguards. Where Québec law requires an assessment before communication outside Québec, the assessment and appropriate written safeguards must be completed. Foreign authorities may have lawful access under the laws that apply there.

You may request access to personal information under Azybia’s control, correction of inaccurate information, and other rights available under applicable law, including a portable copy where the right applies. You may also ask about purposes, recipients, retention and consent choices, or make a privacy complaint.

We may need proportionate identity or authority verification and must protect other people’s information and applicable privilege. If an exception limits a response, we will explain it as required. We respond within applicable legal time limits. You may contact the relevant privacy regulator, including the Office of the Privacy Commissioner of Canada or Québec’s Commission d’accès à l’information, as applicable.

Legal matters can involve children, family members, witnesses, opposing parties and other people who do not have an Azybia account. Firms remain responsible for lawful collection, appropriate authority, required notices and handling restrictions concerning those records.

Azybia’s professional account services are not directed to children. Do not create an account for a child or submit their information unless the service, your authority and applicable law permit it. A client’s consent does not automatically authorize disclosure of another person’s information.

Address privacy requests or complaints to: Privacy Officer, Azybia Inc., 135 Laurier Ave W, Ottawa, ON K1P 5J2, Canada. Describe the service involved and the request, and provide a way to reply. Do not include passwords or unnecessary client records. We can request further information through an appropriate channel.

We will update this Policy when practices change and show the revision date. A material new purpose may require a separate notice or consent; posting an update does not itself create that consent.