Privacy Policy

This Privacy Policy explains how CanLegal Bench (operated by CQL.ca) collects, uses, and protects personal information when you use the canlegalbench.com website. We are committed to complying with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and the Canadian Anti-Spam Legislation (CASL).

What we collect

When you submit your email address through our “Notify me at release” form, we collect:

• Email address — stored encrypted(AES-256-GCM), together with a one-way cryptographic hash (SHA-256) that we use only to detect duplicate sign-ups. We need your readable address to send you the release email, so it is encrypted with a key that is kept separately from the data file: the file on its own does not reveal your address.
• Name (optional) — if you choose to provide it, we store your name so we can personalize our emails to you. It is stored in cleartext alongside your encrypted address. Providing a name is entirely optional and not required to join the list.
• IP address — collected automatically for rate-limiting and abuse prevention. This is not used to identify you personally and is not shared with third parties.
• Timestamps and consent record — the date and time of your submission and of your confirmation, and which version of this consent wording you agreed to, kept as the record of your consent.

We do not collect your location, browsing history, or any other personal information through this website.

Why we collect it

The sole purpose of collecting your email is to notify you when the CanLegal Bench benchmark is publicly released. This constitutes a single, identifiable communication directly related to your expressed interest, consistent with CASL's exception for existing business relationships and express consent.

Consent

We ask for your express consent in two steps (double opt-in). When you submit the form we send you one email with a confirmation link. Nothing else is sent unless you press the confirmation button; an unconfirmed sign-up is never emailed again and is deleted with the rest of the list. Once confirmed, you will receive a notification when the CanLegal Bench benchmark is publicly released. You are not subscribing to a newsletter or recurring marketing communications; we will contact you at most a small number of times in connection with the release.

How we store it

Your encrypted address, its hash, your optional name, and the associated metadata are stored in an append-only data file on a server we operate in Amazon Web Services' us-west-2 region (Oregon, United States). Access is restricted to authorized personnel and protected by standard filesystem permissions and encrypted connections (HTTPS/TLS). We do not use any third-party cloud database service to store your information.

How we send email

Our emails are sent from a cql.ca address and delivered by Amazon Simple Email Service (Amazon Web Services, us-west-1 region, California, United States), which processes your address and the message only to deliver it on our behalf. Information stored or processed in the United States may be accessible to authorities there under U.S. law.

Data retention

We retain your email hash, optional name, and the associated metadata (timestamps and IP address) for a maximum of 18 months from the date of submission. The IP address is retained for the same period to support abuse-prevention forensics if needed; it is not used to identify you personally. After this period, the record is automatically and permanently deleted by a daily clean-up. If you unsubscribe before then (see below), your record is deleted within 30 days.

Unsubscribe

You may withdraw your consent and have your record deleted at any time. Every email we send includes an unsubscribe link, and supporting email apps also show a one-click unsubscribe button; unsubscribing takes effect immediately. Alternatively, you can email [email protected] with the subject line “Unsubscribe,” and we will remove your record within 30 days. There is no penalty for unsubscribing.

Third parties

We do not sell, rent, or share your email address or any personal information with third parties. We use Amazon Web Services only as a service provider: our server runs on its infrastructure, and Amazon Simple Email Service delivers our emails. Your information is stored in a self-hosted data file — we do not use any third-party cloud database service to store it.

Cookies and analytics

This website does not use tracking cookies. We do not embed third-party analytics or advertising trackers.

Your rights under PIPEDA

Under PIPEDA, you have the right to:

• Know what personal information we hold about you;
• Access your personal information;
• Challenge the accuracy and completeness of your information; and
• Withdraw consent for the collection, use, or disclosure of your information.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

Security

We take reasonable measures to protect your information, including encrypting email addresses at rest, keeping the encryption key separate from the data, using encrypted connections (HTTPS/TLS), and restricting access to the server. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Children's privacy

This website is not directed to individuals under the age of 18, and we do not knowingly collect email addresses from minors. If you believe a minor has submitted an email, please contact us and we will delete it.

Changes to this policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated revision date. Continued use of the website after changes constitutes acceptance of the revised policy.

Contact

If you have questions about this Privacy Policy or your personal information, contact us at [email protected].