Last updated September 13, 2026
YourLegalAid is a legal-technology platform operated through YourLegalAid.ca. This policy applies to the website, accounts, legal-information tools, document tools, AI-enabled features, review features, and related services. Private legal-content data is not made public merely because it is submitted to a Service.
1. Information we collect
Account and contact information
Depending on the Service, we may collect a name, email address, telephone number where provided, account identifiers, authentication information, organization or workspace information, and communication preferences. Profile information is not public by default. A field may be publicly visible only where the relevant feature clearly identifies it as public before submission or publication.
Legal-matter and service information
Users may submit information concerning legal matters, forms, court or tribunal proceedings, immigration matters, witnesses, landlords or tenants, research, drafts, deadlines, and similar matters. This information may be sensitive.
Uploaded files and user content
We may process documents, images, PDFs, word-processing files, and other materials submitted to the Services. Where a user intentionally submits a review, rating, or other public contribution, that material may be displayed publicly. Public-content features are distinct from private legal workspaces and private submissions.
Technical and usage information
Hosting and security systems may process technical information needed to deliver and protect the site, including IP address, request time, requested page, browser information, login events, diagnostics, and error records. Analytics or session-recording technologies, if enabled, must be configured so sensitive legal-content fields, authentication data, payment data, and private document contents are not intentionally captured.
2. Guided-form answers, PDFs, and drafts
Interview answers are used to prepare the selected form. Where multilingual guidance is supported, the original response should remain distinguishable from any translated or normalized value used for an official form. Completed PDFs are intended to be generated for the user to review and download rather than retained as a permanent YourLegalAid copy unless the product expressly says otherwise.
Anonymous device drafts are encrypted before being stored in that browser. Clearing browser storage or using another device may make those drafts unavailable. Where cross-device drafts are enabled, the Service stores an encrypted answer payload, form and definition version, progress, revision number, and timestamps. Owner checks are applied to each request. Inactive cloud drafts are intended to expire after 90 days, and supported products provide a way to request immediate deletion.
3. Contact enquiries
Contact-form names, email addresses, organization names, and messages are encrypted before storage. The Service also keeps the selected topic, product, submission time, status, and a one-way request fingerprint used to limit spam. Contact records are intended to expire after 180 days and are visible through the protected administrator inbox.
FormSubmit processes completed contact enquiries server-side to deliver an email notification. The browser does not submit the contact form directly to FormSubmit.
4. Accounts and authentication
ChatGPT sign-in and direct Google sign-in are currently supported. When ChatGPT sign-in is used, the connected OpenAI Sites authentication path provides the verified email address and, when available, the name associated with the signed-in account. When direct Google sign-in is used, the Service stores the verified email address, Google account identifier, display name, profile image URL, and session records required to keep the user signed in. YourLegalAid does not receive the user's provider password.
5. Payments
Signing in does not by itself start a payment or subscription. Payment is requested only where a user chooses a paid product. We retain the records reasonably required for product entitlements, pilot access, orders, and eligible cross-device records. If a third-party payment processor is enabled, that provider will process payment details under its own privacy terms; YourLegalAid should not retain a reusable payment-card number.
6. Why we use personal information
- to provide requested Services and generate requested outputs;
- to create and administer accounts and workspaces;
- to maintain security and prevent fraud or abuse;
- to provide customer support;
- to administer billing and transactions where paid Services are enabled;
- to send service, security, and account notices;
- to send commercial communications where legally permitted;
- to comply with legal obligations and investigate incidents;
- to enforce agreements; and
- to improve Services where permitted by law and consistent with our disclosures and contractual commitments.
7. AI and automated processing
Information submitted to an AI-enabled feature may be transmitted to an AI or infrastructure provider when necessary to generate the requested output or operate the feature. We will identify material providers in the Service Provider list when their production use and role are verified.
If personal information is used to render a decision concerning an individual based exclusively on automated processing and Quebec law applies, we will provide the notices, information, correction rights, and opportunity for observations required by applicable law.
8. Disclosure
We may disclose personal information to:
- service providers that host, secure, process, transmit, analyze, authenticate, or support the Services;
- payment processors and financial-service providers when paid Services are enabled;
- professional advisers subject to confidentiality obligations;
- law-enforcement, regulators, courts, or other authorities where disclosure is lawfully required or permitted;
- a purchaser or successor in a lawful corporate transaction, subject to applicable safeguards; and
- other persons where the user directs or authorizes the disclosure.
9. Cross-border processing
Some service providers may process information outside the province or country where a user resides. Where required, we assess relevant privacy risks and use contractual, organizational, and technical safeguards appropriate to the information and processing activity.
10. Consent and choices
Where consent is required, the form of consent will be appropriate to the sensitivity of the information and the reasonable expectations of the individual. Consent may be withdrawn where legally permitted, subject to reasonable notice and any legal or contractual consequences. Non-essential cookies and similar technologies are addressed in the Cookie Policy.
11. Access, correction, and other privacy rights
Subject to applicable law, individuals may have rights to:
- request access to personal information held about them;
- request correction of inaccurate or incomplete information;
- withdraw consent where processing depends on consent;
- request deletion where applicable;
- request information concerning certain automated decisions;
- request cessation of dissemination or de-indexing in circumstances recognized by Quebec law; and
- make a complaint about our privacy practices.
Submit a privacy request through the Contact page. We may need to verify identity before completing a request.
12. Deletion
A deletion request should identify the account and information the user wants deleted. We process valid requests within the period required by applicable law, subject to legal retention duties, fraud-prevention needs, dispute preservation, backup cycles, and other lawful exceptions. Deleting an account does not remove copies of documents the user has already downloaded, filed, emailed, published, or shared with third parties.
13. Retention
We retain personal information only as long as reasonably necessary for the purpose for which it was collected and for legal, accounting, security, dispute-resolution, and compliance requirements. Service- specific retention periods may be disclosed in the relevant feature.
- Inactive cloud drafts: intended to expire after 90 days.
- Contact records: intended to expire after 180 days.
- Billing and transaction records: retained as required for tax, accounting, fraud, and dispute purposes.
- CASL consent evidence: retained while the consent or other relied-upon basis remains relevant, plus an appropriate compliance period.
- Public reviews: retained until removed, de-indexed, or no longer needed, subject to lawful preservation requirements.
14. Security
We use safeguards appropriate to the sensitivity, volume, context, and risks of the information processed. No system can guarantee absolute security. We do not make public promises about particular encryption standards, certifications, penetration-test frequency, universal MFA, or monitoring capabilities unless those controls have been verified in production.
15. Cookies, analytics, and session replay
Cookies and similar technologies are governed by the Cookie Policy. If session-replay or behavioral analytics tools are enabled, sensitive routes and fields must be excluded or masked so providers are not intentionally supplied with private legal narratives, document contents, passwords, payment details, or other highly sensitive field content.
16. Browser privacy signals
We will not claim to honor Global Privacy Control, Do Not Track, or similar browser preference signals unless the production site detects the signal and changes processing accordingly. If such functionality is implemented, this policy and the Cookie Policy will be updated to describe the actual behavior.
17. Minors
The Services are intended for persons able to lawfully use them under the Terms. We do not knowingly design the Services to solicit sensitive legal information from children without an appropriate legal basis and safeguards.
18. Changes and contact
We may update this policy as our Services, providers, or legal obligations change. Material changes will be communicated as required by law. Use the Contact page for privacy or security enquiries and the Legal Centre for related policies.