Can Law Easy
Made in Canada · For Canadians
Data retention
Canadian privacy law requires that personal information be kept only as long as it is needed for the purpose it was collected, and then destroyed or anonymised. This schedule says exactly how long each record lives on Can Law Easy. It applies under PIPEDA, Quebec's Law 25 and the privacy laws of Alberta and British Columbia.
Account and profile (name, email, phone, address)
While your account is open. Deleted within 30 days of account closure.
Case files, timelines, notes and checklists
While your account is open, or until you delete the case. Deleted from the database within 30 days of deletion.
Uploaded and signed documents in the vault
While your account is open, or until you delete the file. Removed from storage within 30 days; encrypted backups roll off within 90 days.
Quote requests and messages with professionals
2 years after the matter closes, so a fee dispute can be resolved, then deleted.
Payment records and receipts
7 years, as required by Canadian tax and bookkeeping rules. Only the amount, date and reference are kept — never full card numbers.
Consultation bookings
2 years after the appointment date.
AI prompts and generated drafts
Kept in your case file while you keep it. Not retained by us for model training.
Security and access logs
12 months, then deleted. Used only to detect abuse and keep the service running.
Anonymised usage statistics
Kept indefinitely; contains no personal information and cannot be linked back to you.
You can delete any case or document yourself at any time, or ask us to delete your entire account and everything in it. We act on a verified request within 30 days and confirm in writing when it is done.
We keep a record past its normal period only where the law requires it — tax records, a legal hold during litigation, or a regulator's investigation — and only that record, for only as long as the obligation lasts.
Deleted records are removed from the live database and object storage, and cycle out of encrypted backups within 90 days. Paper is not used. Where deletion is technically impossible, the record is irreversibly anonymised instead.
Data is stored and processed on servers under contract with us, encrypted in transit and at rest. If any processing occurs outside Canada, it stays subject to this policy and to comparable protection, as PIPEDA and Law 25 require.
Approved panel listings are kept while the listing is active and for 2 years after removal, so past clients and regulators can verify who was listed and when.
This policy is enforced through access controls that lock every record to its owner's account. If you believe it has not been followed, write to us first; you may also complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca, or to the Commission d'acces a l'information du Quebec, the Alberta or the British Columbia commissioner.