1.Introduction and scope
This Privacy Policy (the "Policy") describes how BinderCo, the business name of 2787168 Alberta Ltd., an Alberta corporation ("BinderCo", "we", "us", or "our"), collects, uses, discloses, and safeguards personal information in connection with Binder, the legal claim management service operated by BinderCo, including its Record, Advocate, Counsel, and Binder University components (collectively, "Binder" or the "Service"). This Policy governs Binder only. Other BinderCo products and services are governed by their own privacy policies where published.
BinderCo is the data controller for personal information processed in Binder. Our processing is subject to Canada's Personal Information Protection and Electronic Documents Act, SC 2000 c 5 ("PIPEDA"), and, where applicable to personal information collected, used, or disclosed in the course of commercial activities in Alberta, the Alberta Personal Information Protection Act, SA 2003 c P-6.5 ("PIPA").
By creating an Account, purchasing a Membership, or otherwise accessing or using Binder, you acknowledge that you have read and understood this Policy. Capitalised terms used but not defined in this Policy have the meanings given to them in the Binder Terms of Use.
2.Information we collect
The categories of information we collect through Binder are as follows.
Account data
When you create an Account, we collect your name, email address, password (stored as a salted hash), and, where you provide them, organization name, role, phone number, and mailing address. We also collect information relating to your Membership tier, your billing relationship with BinderCo, and any identifiers we assign to you for internal record-keeping.
Record and Advocate content
Record is where you capture documents, correspondence, photographs, notes, dates, and other materials describing the facts of your claim. Advocate is where those materials are analysed to identify gaps and questions. Content you submit to Record and Advocate may include personal information about you and, in many cases, about third parties (for example, witnesses, insurers, counterparties, medical providers). You are responsible for the content you submit.
Counsel communications
When you are referred to Counsel, we collect the communications you exchange with the supervising lawyer and the advisory memoranda, opinions, and written materials Counsel produces for you. These communications are handled under the privilege framework described in Section 5.
Payment data
Payments are processed by Stripe, Inc. ("Stripe"). BinderCo does not receive or store full payment card numbers. We receive from Stripe a tokenised reference, the last four digits of the card or other payment method descriptor, the card brand, the expiry date, and the billing postal code, together with transaction identifiers and status. Your full payment credentials are held by Stripe under Stripe's own privacy terms.
Usage and device data
We collect information about how you interact with Binder, including pages accessed, features used, timestamps, session identifiers, IP address, browser type and version, device type, operating system, and referring URL. This information is used for security, service delivery, and platform analytics.
Cookies
Binder uses first-party cookies to maintain your session, remember your preferences, and secure the Service. We do not use third-party advertising cookies. See Section 11 for detail.
Communications with BinderCo
When you contact BinderCo directly (for example, by email or through the contact page), we collect the contents of your communication and any information you include in it.
3.How we use information
We use personal information for the purposes set out in this Section, and for no other purposes without your consent or as otherwise permitted or required by law.
Delivering the Service
We use Account data, Record and Advocate content, and usage data to provide Binder to you, to authenticate your access, to surface the features appropriate to your Membership tier, to maintain your documentation and analysis over time, and to make the Service available to you in a usable form.
Platform notifications
We use your email address to deliver operational notifications about your Account, your Membership, and the Service.
Counsel delivery
We use the information you submit in a Counsel referral, together with your Record and Advocate content, to deliver Counsel to you. Counsel communications are routed to the supervising lawyer and retained as part of your Counsel matter file.
Billing
We use payment data, Membership data, and Account data to process payments, issue receipts and invoices, manage renewals, process refunds where applicable, and maintain financial records required by law.
Security and integrity
We use usage and device data to detect, prevent, and respond to unauthorised access, fraud, abuse, and breaches of the Terms of Use or the Acceptable Use Policy, and to protect the integrity of Binder and its Users.
Anonymised educational derivatives
Under the licence granted in Section 10 of the Terms of Use, we process Your Content through BinderCo's internal anonymisation pipeline (the "Folio pipeline") so that de-identified derivatives may be used to create Binder University educational materials. No personally identifiable information, no privileged Counsel communications, and no content reasonably identifiable to you or to third parties is reproduced in educational materials. You may opt out of this educational use by written notice to privacy@binderco.ca.
Legal compliance
We use personal information to comply with our legal obligations, to respond to lawful requests from public authorities, to enforce the Terms of Use, and to establish, exercise, or defend legal claims.
4.Legal basis for processing
Under Canadian privacy law, processing of personal information must be reasonable, identified purposes must be stated, and consent (express or implied) is the default basis for collection, use, and disclosure. Where we rely on a specific basis other than express consent, we identify it below.
Contract performance
We process Account data, Membership data, Record and Advocate content, Counsel communications, and payment data to perform the contract between you and BinderCo (the Terms of Use) and to provide Binder to you.
Legitimate interests and reasonable business purposes
We process usage and device data, and a limited set of Account metadata, for the reasonable business purposes of securing the Service, preventing abuse, improving the Service, and maintaining the stability and integrity of Binder. We conduct these activities in a manner that a reasonable person would consider appropriate in the circumstances.
Consent
Where you provide optional information (for example, your phone number), submit content to Record or Advocate, or refer a matter to Counsel, you consent to the processing described in this Policy. You may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice, by contacting privacy@binderco.ca. Withdrawal of consent may limit or end your ability to use Binder.
Legal obligation
We process personal information as necessary to comply with applicable law, including tax and financial record-keeping requirements, regulatory obligations, and obligations arising from valid legal process.
5.Solicitor-client privilege and litigation privilege
Two categories of privilege are relevant to Binder.
Solicitor-client privilege (Counsel)
Counsel is supervised by a lawyer licensed by the Law Society of Alberta and insured through the Alberta Lawyers Indemnity Association. Solicitor-client privilege attaches from the date of your first referral to Counsel. Communications between you and Counsel, and the advisory memoranda and opinions Counsel produces for you, are confidential communications made for the purpose of obtaining legal advice and are treated accordingly within Binder.
Access to Counsel communications is restricted to personnel with a need to know for the purpose of delivering Counsel. BinderCo will not disclose Counsel communications to third parties except where you instruct us to do so, where disclosure is necessary to deliver Counsel, or where compelled by a court of competent jurisdiction after any applicable privilege claim has been properly asserted and determined.
Litigation privilege (Record and Advocate)
Binder is designed to support the documentation and analysis of legal claims. Record and Advocate content is created with the dominant purpose of contemplated or existing litigation in connection with your claim. BinderCo will not voluntarily produce Record or Advocate content to third parties. Privilege is yours to assert. Where an application is made to compel production of that content, BinderCo will not take a position on the application, and BinderCo will notify you of the application so that you have a reasonable opportunity to respond and to assert litigation privilege, except where notice is itself prohibited by the order or by law.
Responses to legal process
Where BinderCo receives a subpoena, production order, warrant, or other legal process calling for personal information or User content, BinderCo will review the request and satisfy itself that it is valid on its face. BinderCo takes no position on applications to compel the production of information. BinderCo will notify affected Users promptly of any such application so that they have a reasonable opportunity to respond and, where applicable, to assert privilege, except where notice is itself prohibited by the order or by law. Subject to the preceding paragraphs, BinderCo will produce only what is legally required.
6.Sharing of information
BinderCo does not sell personal information. We share personal information only as described in this Section.
Service providers
We engage the following service providers, each under a written agreement that restricts their use of personal information to the delivery of their service to BinderCo and that obliges them to safeguard that information.
- Supabase — database, authentication, and storage for Account data, Record and Advocate content, and application state. Primary region: ca-central-1 (Canada).
- Amazon Web Services (AWS) — object storage for attached files and media via Amazon S3, with encryption keys managed through AWS Key Management Service (KMS). Region: ca-west-1 (Canada).
- Stripe, Inc. — payment processing. Stripe receives payment credentials directly from you and returns tokenised references to BinderCo. See Stripe's privacy policy for its handling of payment data.
- Resend — transactional email delivery for Account notifications and receipts.
- Anthropic, PBC — language-model processing used to power certain Advocate analyses, Counsel drafting workflows, and the Folio pipeline. Anthropic processes content on BinderCo's behalf and does not use that content to train its models under the applicable commercial terms.
Disclosure on legal process
We may disclose personal information where required by a valid legal obligation, including a subpoena, production order, warrant, or court order, or where disclosure is necessary to establish, exercise, or defend legal claims, subject to the privilege framework in Section 5.
Change of control
If BinderCo is involved in a merger, acquisition, financing, reorganization, asset sale, or other change of control, personal information may be transferred as part of the transaction. Any successor entity will be bound by this Policy, or will provide notice of a successor policy at least thirty (30) days before any material change to how your personal information is handled.
With your consent
We may share personal information for additional purposes with your express consent.
7.International transfers and data residency
Canadian data residency is Binder's default. Primary storage and processing of Account data, Record and Advocate content, and Counsel communications occur in Canadian regions of the service providers identified in Section 6, being Supabase in ca-central-1 and AWS S3 in ca-west-1.
Limited cross-border processing may occur through enumerated sub-processors for functions that are not hosted by us in Canada. These include payment processing through Stripe (United States and other jurisdictions as operated by Stripe), transactional email delivery through Resend (United States), and language-model processing through Anthropic (United States). In each case, the sub-processor is bound by a written agreement addressing confidentiality, security, and use limitations, and we transfer only the personal information necessary for the relevant function.
Where personal information is processed outside Canada, it may become subject to the laws of the jurisdiction in which it is processed, including lawful-access laws. We consider this risk when selecting and engaging sub-processors, and we limit the scope of cross-border processing to what is reasonably necessary to deliver Binder.
A current list of sub-processors is available on request to privacy@binderco.ca.
8.Retention
Active Accounts
Personal information associated with an active Account is retained for as long as the Account is active and for as long as is reasonably necessary to deliver Binder to you. Operational records (for example, billing records) are retained for periods consistent with legal and accounting obligations.
Post-termination window
Following termination of your Membership, Records and Counsel threads remain available to you in read-only mode for ninety (90) days, consistent with Section 18 of the Terms of Use. On request within that window, BinderCo will provide an export of Your Content in a machine-readable format. After the 90-day window, Your Content is deleted in the ordinary course.
Legal-hold exceptions
Personal information that is the subject of a legal hold, a pending or reasonably anticipated regulatory investigation, a pending or reasonably anticipated legal proceeding, or an ongoing legal obligation to retain, will be retained for the duration of that hold or obligation, after which it is deleted in the ordinary course.
Anonymised derivatives
De-identified derivatives produced by the Folio pipeline do not identify you and are retained on an ongoing basis to support Binder University. These derivatives are not personal information for the purposes of PIPEDA or Alberta PIPA, and are not subject to the deletion provisions above.
Backups
Deleted personal information may persist in secure, encrypted backups for a limited period, consistent with our backup retention schedule, after which it is purged.
9.Security
BinderCo maintains administrative, technical, and physical safeguards designed to protect personal information against unauthorised access, use, disclosure, alteration, and destruction. Our safeguards include the following.
Encryption
Personal information is encrypted in transit using TLS 1.2 or higher. Personal information at rest is encrypted using industry-standard algorithms. Object storage in AWS S3 is encrypted with keys managed through AWS Key Management Service (KMS), with key policies scoped to Binder workloads.
Access controls
Access to production systems is restricted to authorised personnel on a least-privilege basis. Authentication uses multi-factor controls where appropriate. Privileged actions are logged and reviewed. Access to Counsel communications is further restricted to personnel with a need to know for the purpose of delivering Counsel, consistent with Section 5.
Operational security
We apply vendor-supported versions of our operating systems, runtimes, and libraries, monitor for security advisories, and remediate vulnerabilities on a risk-prioritised basis. Production configurations are managed through code, with changes reviewed and tracked.
Incident response
We maintain an incident-response process covering detection, containment, investigation, remediation, and post-incident review. Incidents affecting personal information are triaged for legal-notification obligations.
Breach notification
Where a breach of security safeguards involves personal information under our control and creates a real risk of significant harm, BinderCo will report to the Office of the Privacy Commissioner of Canada and notify affected individuals, as required by PIPEDA and the Breach of Security Safeguards Regulations. Where Alberta PIPA applies, we will comply with its notification obligations to the Office of the Information and Privacy Commissioner of Alberta.
No system is perfectly secure. You are responsible for keeping your Account credentials confidential and for notifying us promptly at privacy@binderco.ca of any suspected unauthorised access to your Account.
10.Your rights
Under PIPEDA and Alberta PIPA (where applicable), you have the following rights in respect of personal information we hold about you.
- Access — you may request confirmation that we hold personal information about you, a description of that information, and a description of how it has been used and to whom it has been disclosed.
- Correction — you may request correction of inaccurate or incomplete personal information. Where a correction is made, we will, where reasonable, notify third parties to whom we have disclosed the inaccurate information.
- Withdrawal of consent — you may withdraw consent to the collection, use, or disclosure of your personal information, subject to legal or contractual restrictions and reasonable notice. Withdrawal of consent may limit or end your ability to use Binder.
- Complaint — you may complain to BinderCo's Privacy Officer at privacy@binderco.ca. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, where Alberta PIPA applies, the Office of the Information and Privacy Commissioner of Alberta (oipc.ab.ca).
How to exercise your rights
Requests should be submitted in writing to privacy@binderco.ca. We may ask you to verify your identity before responding. We will respond within the timelines required by applicable law (generally thirty (30) days under PIPEDA and forty-five (45) days under Alberta PIPA), and will explain any permitted extension in writing.
Certain information may be withheld where disclosure would reveal personal information about a third party, where the information is subject to solicitor-client privilege or litigation privilege, where disclosure would reasonably be expected to threaten the life or security of another individual, or where another exception under PIPEDA or Alberta PIPA applies. Where information is withheld, we will say so and identify the basis.
11.Cookies and tracking
Binder uses a small number of first-party cookies to operate. These cookies maintain your authenticated session, remember user-interface preferences, secure the Service against cross-site request forgery, and support basic operational analytics about feature usage and errors.
Binder does not use third-party advertising cookies and does not participate in cross-site advertising networks. We do not sell, rent, or license browsing data.
Most browsers allow you to block or delete cookies through browser settings. Blocking session or authentication cookies will prevent you from signing in to Binder and using features that require authentication.
Our policies on automated access, scraping, and other non-interactive use of Binder are set out in the Acceptable Use Policy.
12.Children
Binder is a business-to-business legal claim management service. It is not directed at individuals under the age of 18, and we do not knowingly collect personal information from individuals under 18. If you believe that a minor has provided personal information to Binder, please contact privacy@binderco.ca and we will take reasonable steps to delete that information.
13.Changes to this policy
BinderCo may update this Policy from time to time. Where updates are material, BinderCo will give notice by email to the email address on your Account at least thirty (30) days before the updates take effect. For non-material updates, including clarifications and drafting corrections, BinderCo will update the "Last updated" date at the top of this page.
Your continued use of Binder on or after the effective date of an update constitutes your acceptance of the updated Policy. If you do not accept an update, your remedy is to cancel your Membership before the effective date of the update and request deletion of your Account in accordance with Section 8.
14.Contact
Privacy inquiries, rights requests, and complaints should be directed to BinderCo's Privacy Officer at privacy@binderco.ca. Consistent with Section 15 of the Terms of Use, BinderCo accepts service of privacy-related notices and correspondence by email. BinderCo does not maintain a public mailing address for privacy correspondence.
For non-privacy inquiries about Binder, please use the contact page.