A short, plain-language privacy notice.

Who this applies to

This notice describes how Supacorp handles information from website inquiries, firm users and the clients whose information firms manage in the platform. This includes intake responses, uploaded documents, corporate records and content used by AI features.

What we collect

We collect information firms and prospective partners provide directly: website inquiry and pilot application details (name, work email, firm name, role, firm size, jurisdiction, and message, as well as browser user-agent and IP metadata for spam prevention); account details (name, work email, role); entity records (corporations, directors, shareholders, addresses); generated documents; intake responses from clients invited by the firm; and integration tokens for tools like Microsoft 365, Actionstep, Clio, QuickBooks, and Cosmolex. We also collect operational telemetry needed to run the service: authentication events, error logs, and the activity log a firm sees inside the product.

How we use information

We use information to operate the platform: manage records, generate documents, process intake, provide AI assistance, route signature requests, send emails and support the firm. Website inquiry and pilot application details are used to respond to your questions, evaluate pilot fit, and provide the updates you request. We do not sell personal information.

AI and zero data retention

Built-in AI uses zero data retention (ZDR) model endpoints. Relevant records, document text or images, prompts and conversation context are sent through OpenRouter, with ZDR required and provider data collection disabled on every request. If no compliant endpoint is available, the request stops. This applies to built-in document analysis, drafting, template setup, the assistant and AI field detection in Supacorp Signatures. The content can include information about directors, shareholders and clients. ZDR limits model-provider retention of prompts and responses and prevents their use for model training. It does not specify a processing country.

What ZDR covers

ZDR governs LLM model inference processing. Supacorp still stores the records, documents, saved conversations and activity history needed to provide your workspace. Operational and billing metadata are separate from prompt content. OpenRouter classifies temporary in-memory prompt caching as compatible with ZDR; its account-level prompt logging is a separate setting that must remain disabled for firm-data processing. For legal research queries that use live web search, queries and retrieved references are routed through search integrations that do not operate under the same Zero Data Retention terms as direct LLM inference; web research requests submit only the legal question and jurisdiction, not confidential entity records.

Connected assistants

When your firm connects an external assistant such as ChatGPT or Claude, that service can receive records and documents available through the permissions you grant. These external services follow your agreement with their provider and are not covered by Supacorp's built-in AI routing policy. Review their retention settings and processing terms before connecting them to client records.

Where data lives

Firm records and documents use Supabase database and object storage; the application uses Vercel hosting. AI requests, connected integrations and backups involve additional services. Storage location does not establish the location of every processing step. Confirm the current hosting, backup and provider locations with us before onboarding if your firm has residency requirements.

Confidentiality and legal privilege

We treat the contents of corporate records, intake submissions, and generated documents as confidential. Supacorp staff do not access firm data except where strictly required to provide support, investigate a security event, or comply with a lawful order, and only with the level of access the task requires.

Sharing with sub-processors

Services used to deliver Supacorp include Supabase for database, storage and authentication; Vercel for hosting; OpenRouter and the model providers handling AI requests; the Supacorp Signatures signing service; configured email and identity providers; and GitHub Actions and configured backup storage for operations and encrypted backups. PostHog receives minimized operational route and error diagnostics, and Vercel Analytics provides website traffic analytics. Website inquiry notifications are sent to our team through Discord. Firm-selected integrations receive the information needed for the connected workflow. Ask us for the current provider list and processing terms before onboarding.

Retention and deletion

Retention differs between active records, source documents, audit history, operational logs, backups and provider-held data. Contact us to agree export, wind-down and deletion arrangements before onboarding or ending service. Deletion from an active workspace does not by itself establish deletion from backups or connected services; those copies follow their applicable retention arrangements.

Your rights

Individuals whose personal information is in the system (firm users and intake respondents) can request access, correction, or deletion of their personal information by contacting the firm that operates the workspace, or by contacting Supacorp directly. We will respond within timelines required by Canadian privacy law (PIPEDA and applicable provincial statutes).

Security incidents

If we become aware of a material security incident affecting your data, we will notify the firm without undue delay, share what we know, and cooperate on response. Our security posture is described on the Security page.

Changes

We will update this page when our practices materially change and post the effective date below. For ongoing engagements, material changes will also be communicated to firm administrators by email.

Contact

Privacy questions and requests can be sent through the Contact page or to privacy@supacorp.ca. We will respond within five business days.

This notice is informational and does not by itself create a contract. Firms with privacy requirements should request the current processing terms before onboarding.