On this page
Privacy Policy#
Effective date: May 2, 2026 Version: 1.0
This Privacy Policy describes how simplyclose Law Professional Corporation ("simplyclose", "we", "us", or "our") collects, uses, discloses, and protects personal information in connection with simplyclause at simplyclause.ca (the "Service").
simplyclose is the publisher of simplyclause and is the organization accountable for personal information collected through the Service under the federal Personal Information Protection and Electronic Documents Act ("PIPEDA"). Our Privacy Officer is identified in section 13.
This Privacy Policy forms part of our Terms of Use and Disclaimer. Read all three before using the Service.
1. Scope and Consent#
This Privacy Policy applies to personal information collected through the Service. It does not apply to personal information collected when you retain simplyclose for legal services. That information is governed by our separate engagement letters and our duties of confidentiality and solicitor-client privilege under the Law Society of Ontario Rules of Professional Conduct.
By creating an account or using the Service, you consent to the collection, use, and disclosure of your personal information as described in this Privacy Policy. You may withdraw consent at any time, subject to legal and contractual restrictions, by deleting your account or contacting our Privacy Officer.
The Service is intended for licensed Ontario real estate professionals, mortgage agents and brokers, lawyers, paralegals, and similar regulated professionals. The Service is not intended for residents of Quebec, who are subject to the Act respecting the protection of personal information in the private sector, CQLR c P-39.1 (Quebec Law 25). We do not knowingly accept Quebec users.
2. What We Collect#
We collect the following categories of personal information.
Account and identity information. Your name, email address, password (hashed by our authentication provider), multi-factor authentication settings, and brokerage or firm name. We collect this through Clerk at sign-up and through your account management.
Authentication and security metadata. Sign-in times, IP addresses, device and browser fingerprints, and session identifiers, used to authenticate you and detect fraudulent or unauthorized access.
Onboarding information. Years of experience and topics of interest, which you provide voluntarily to help us tailor the Service.
Service usage information. Pages viewed, features used, conversation IDs, session duration, and click events, used for product analytics and to improve the Service.
AI prompts and responses. The text of every question you submit to the AI assistant, the responses generated, and the retrieved knowledge-base context used to generate those responses. This is the most sensitive category we hold and the one most likely to inadvertently include information you should not have entered. Section 6 of our Terms of Use prohibits you from entering confidential, privileged, or third-party personal information.
Communications. Emails you send to us, support tickets, and feedback you submit through the Service.
Cookies and similar technologies. Strictly necessary cookies for authentication and session management, and (with your consent) optional analytics cookies. See section 8.
Consent and acceptance records. When you create an account, we record the version numbers of the Terms of Use, Privacy Policy, and Disclaimer you accepted, along with a timestamp, your IP address, and your user-agent. This is used to demonstrate informed consent.
We do not collect financial, payment, or government-identifier information through the Service. We do not knowingly collect special categories of sensitive personal information.
3. Why We Collect It#
We collect and use personal information for the following purposes.
(a) To authenticate users, operate accounts, and provide the Service.
(b) To process AI prompts and return AI-generated educational responses.
(c) To improve the Service through aggregated and de-identified analytics, including identifying common topics, error rates, and content gaps in our knowledge base.
(d) To detect, investigate, and prevent abuse, fraud, account compromise, and unauthorized practice of law.
(e) To communicate with you about your account, security alerts, and changes to the Service or to these policies. These messages are transactional and continue regardless of marketing-email preferences.
(f) To send optional newsletters and product updates, only if you separately opt in. You can withdraw consent at any time using the unsubscribe link.
(g) To comply with legal obligations, including responses to lawful requests from regulators (such as the Law Society of Ontario), court orders, breach-notification duties under PIPEDA section 10.1, and tax and corporate-record-keeping obligations.
(h) To enforce our Terms of Use, defend against legal claims, and protect the rights, property, and safety of simplyclose, our users, and the public.
We do not use your personal information for any purpose materially different from those described in this Privacy Policy without further notice and, where required, consent.
4. Legal Basis under PIPEDA#
We rely on your meaningful consent under PIPEDA Principle 3 for the collection, use, and disclosure of personal information. Where consent is implied (for example, transactional emails to your account address), we identify the purpose at or before collection. Where consent is express (for example, optional marketing emails or optional analytics cookies), we obtain it through a clear, unchecked checkbox or banner action.
We collect only what we reasonably need (Principle 4), and we limit use, disclosure, and retention to the purposes identified at collection (Principle 5).
5. Service Providers and Cross-Border Transfers#
We use the following service providers to operate the Service. Each acts as our processor under PIPEDA Principle 4.1 and is bound by a written data-processing agreement requiring it to protect personal information at a level comparable to that required under PIPEDA.
| Provider | Purpose | Location of processing | Notes |
|---|---|---|---|
| Anthropic, PBC | Generates AI responses (Claude API) | United States | Default API retention is up to 30 days for inputs and outputs and up to 7 days for short-term API logs. Anthropic does not train its models on commercial API data under its Commercial Terms. Inputs flagged by Anthropic's safety classifiers may be retained longer. |
| Supabase, Inc. | Database, vector storage, file storage (RAG corpus, conversation history, analytics) | Canada (ca-central-1, Montréal) | SOC 2 Type II. Encryption in transit and at rest. |
| Clerk, Inc. | User authentication and identity management | United States | SOC 2 Type II. Encryption in transit and at rest. |
| Vercel, Inc. | Application hosting and serverless functions | Global edge network with United States primary | SOC 2 Type II. |
| Email service provider | Transactional and (with your consent) marketing email | United States | CASL-compliant unsubscribe. |
Some of our service providers are located in the United States. Your personal information may be transferred to, stored in, and processed in the United States or other countries. While in those countries, your information may be subject to lawful access requests by foreign courts, law enforcement, and national-security authorities, including under the United States CLOUD Act. Such access may occur without notice to you or to us. By using the Service, you acknowledge and consent to this transfer and processing.
We do not sell personal information. We do not disclose personal information to third parties for their own marketing purposes.
We may disclose personal information to a successor entity in the event of a merger, acquisition, reorganization, or sale of all or substantially all of our business or assets, on terms that protect your information consistent with this Privacy Policy.
6. AI Prompts and Outputs — Important Notice#
When you submit a prompt to the AI assistant, the prompt and the relevant retrieved context are transmitted to Anthropic in the United States for processing. Anthropic returns a generated response, which we display to you and store in our database.
Your prompts and outputs are not confidential and are not subject to solicitor-client privilege. Section 7 of our Terms of Use prohibits you from inputting confidential, privileged, or third-party personal information. We may review prompts and outputs for the purposes described in section 3, including service quality, security, abuse prevention, and improvement of our knowledge base. We may use de-identified and aggregated prompt data to identify topics, develop educational content, and produce statistics about how the Service is used.
If you mistakenly submit confidential or third-party personal information, contact our Privacy Officer at christian@simplyclose.ca and we will take reasonable steps to delete that information from our systems, subject to backup retention timelines and any legal obligation to retain.
7. Retention#
We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, satisfy legal and regulatory obligations, and resolve disputes.
| Category | Retention period |
|---|---|
| Active account profile | Duration of account, plus 12 months after account closure or extended inactivity |
| Authentication and session logs | 90 days |
| AI prompts and responses (your account history) | 24 months from creation, after which they are deleted or de-identified |
| AI prompts and responses (system-level operational logs) | 90 days |
| Aggregated and de-identified analytics | Indefinite, no longer constituting personal information |
| Email correspondence with support | 24 months |
| Database backups | 30 days rolling |
| Consent and acceptance records | 7 years after account closure, for evidentiary purposes |
| Records required by Law Society of Ontario By-laws | As required by Law Society By-laws |
| Records required by federal or provincial tax law | As required by applicable tax legislation |
Retention periods may be extended in connection with security incidents, legal holds, regulatory investigations, or pending or threatened litigation.
8. Cookies and Similar Technologies#
We use cookies and similar technologies in two categories.
Strictly necessary cookies. Required to authenticate you and operate the Service. Set without prior consent because the Service cannot function without them. Includes Clerk session cookies and our own authentication tokens.
Optional analytics cookies. Enabled only with your consent through our cookie banner. Used to measure how the Service is used in aggregate, identify errors, and improve performance. You can change your cookie preferences at any time through the cookie settings link in the footer.
We do not use advertising or third-party tracking cookies. We do not participate in cross-context behavioural advertising.
9. Security#
We use commercially reasonable technical and organizational safeguards to protect personal information, including encryption in transit (TLS 1.2 or higher) and at rest (AES-256 or comparable), role-based access controls, multi-factor authentication for administrative access, audit logging, regular security reviews, and contractual safeguards with our service providers.
No internet transmission, electronic storage, or AI processing system is perfectly secure. We cannot guarantee absolute security. If we determine that a breach of security safeguards has created a real risk of significant harm, we will notify the Office of the Privacy Commissioner of Canada and affected individuals as required under PIPEDA section 10.1, and we will keep records of all breaches as required by Schedule 1.
10. Your Rights#
Subject to applicable law and the limitations identified at Principle 9 of Schedule 1 of PIPEDA, you have the following rights.
Access. You can request a copy of the personal information we hold about you, including your conversation history.
Correction. You can request correction of personal information that is inaccurate, incomplete, or out-of-date.
Withdrawal of consent. You can withdraw consent for any non-essential processing at any time. If withdrawal of consent prevents us from continuing to provide the Service, we will notify you. Withdrawal does not affect the lawfulness of processing before withdrawal.
Deletion. You can request deletion of your account and personal information, subject to retention required for security, legal, regulatory, and dispute-resolution purposes.
Complaint. You can complain to our Privacy Officer or to the Office of the Privacy Commissioner of Canada at priv.gc.ca or 1-800-282-1376.
To exercise any of these rights, contact our Privacy Officer at christian@simplyclose.ca. We will respond within 30 days as required by PIPEDA, or notify you if we need an extension. We may require reasonable verification of your identity before responding.
11. Children#
The Service is intended for licensed real estate professionals 18 years of age or older. We do not knowingly collect personal information from individuals under 18. If you believe a minor has provided personal information through the Service, contact our Privacy Officer for prompt deletion.
12. Changes to This Privacy Policy#
We may update this Privacy Policy from time to time. We will post the updated version with a revised effective date. For material changes, we will provide at least 30 days' notice by email to your account address or by in-product notification before the changes take effect. Your continued use of the Service after the effective date constitutes acceptance.
13. Privacy Officer and Contact#
The Privacy Officer for simplyclause is:
Privacy Officer, simplyclause simplyclose Law Professional Corporation 625 Erie Street East Windsor, Ontario N9A 3Y1 Email: christian@simplyclose.ca
Direct all access requests, correction requests, complaints, and other privacy enquiries to the Privacy Officer.
This Privacy Policy was last updated on May 2, 2026.