Privacy Policy
How we collect, use, and protect personal data.
Who we are
Descardes Legal Services Inc. Remote legal services for technology and SaaS companies. Contact: dimitri@descardeslegal.com. Privacy Officer: Dimitri Descardes.
What we collect
We collect personal data that you provide directly, including: name, email address, and company information; information submitted through forms or communications; and information required to provide legal services. Through our secure client portal, we also process the content you choose to share for your matters — the questions you ask, the messages you exchange, the documents you upload (and the text within them), and any company context you enter. This content may include personal information and confidential or legally privileged business information. We also collect limited technical data (such as IP address and browser type) for security and basic analytics.
How we use data
We use personal data to: respond to inquiries; provide and manage legal services; operate the client portal (including preparing draft responses for the lawyer’s review with AI assistance, organizing your documents, and tracking response-time commitments); communicate with clients and prospective clients; and send updates or resources if you choose to receive them. We only use personal data for relevant and proportionate purposes, and portal matter content is used solely to serve you on that matter.
Legal basis (where applicable)
Depending on the context, we process personal data based on: your consent; the necessity to provide requested services; our legitimate interest in operating and improving our services.
Service providers
We use a limited number of vetted service providers (sub-processors) to operate the client portal and our practice. Each processes personal data only as necessary, under confidentiality and data-protection obligations, and does not use it for its own purposes. Our current sub-processors are: Supabase (database, authentication, and encrypted file storage) — hosted in Canada (Montréal); Vercel (application hosting and compute) — United States; Anthropic (AI assistance used to prepare draft responses and organize documents) — United States, and which does not use our data to train its models; Resend (transactional and sign-in email) — United States; Stripe (payment processing) — United States; and Google Analytics (website analytics, with consent). We do not sell personal data.
Payments
We use third-party payment processors (e.g., Stripe) to process payments securely. Payment information is handled directly by these providers and is not stored on our servers.
International data transfers
Your client portal data — our database and the documents you upload — is stored in Canada (Montréal), with our hosting provider Supabase. Some processing takes place outside Canada: our application runs on Vercel (United States); AI-assisted drafting is performed by Anthropic (United States); and email is sent through Resend (United States). In addition, the firm operates remotely and may securely access the data from outside Québec (the data is consulted remotely, not stored on personal devices), under access controls and confidentiality obligations, and never from locations that would compromise the confidentiality or security of the information. For transfers and processing outside Québec, we rely on appropriate safeguards, including data-processing agreements with each provider, encryption in transit and at rest, and a privacy impact assessment as required under Québec’s Law 25. We do not authorize any provider to use your data for its own purposes.
Retention
We retain personal data only as long as necessary. Inquiries: up to 24 months. Client files: as a member of the Barreau du Québec, our lawyer must keep closed client files for at least 7 years from the date the file is closed, in accordance with professional obligations; some records may be kept longer where required. After the applicable period, files are securely destroyed. Retention periods may vary depending on the engagement.
Security
We implement technical and organizational measures appropriate to the sensitivity of the data, including: encryption in transit (TLS) and at rest; passwordless sign-in (secure magic links — we store no passwords); strict per-client access isolation enforced at the database level, so each client can access only their own data; private document storage accessed through short-lived, single-use links; keeping legal content out of email notifications; and lawyer review of any AI-assisted draft before it is sent to a client. Access is limited to the firm and to what is necessary to deliver the service.
AI assistance & the client portal
Our client portal uses an AI assistant (powered by Anthropic’s Claude) to help gather the facts of your matter, to prepare draft responses, and to organize your documents. This assistance is always subject to human oversight: a licensed lawyer reviews, edits, and approves every response before it is sent to you, and no legal advice is delivered by AI alone. The AI provider does not use your data to train its models. We do not make decisions producing legal or similarly significant effects about you by automated means without that lawyer review. If you would prefer we not use AI assistance on your matter, contact us and we will accommodate reasonable requests.
Your rights
Depending on applicable law, you may have the right to: access your personal data; request correction of inaccurate data; request deletion where appropriate; withdraw consent where applicable. You may also file a complaint with a competent data protection authority.
Updates
We may update this policy from time to time. The most recent version will always be available on our website.
Questions?
For any questions or requests regarding this policy, reach out anytime and we will clarify anything.