Privacy Policy

Version 1.0 — effective September 1, 2026 · Terms of Service

1. Two different kinds of information — and this policy is mostly about one of them

LexiManage handles two kinds of personal information, and they are governed differently.

A — Information about you, our customer. Names, email addresses and account details of the lawyers and staff who use LexiManage, plus what we need to run the business: billing, support conversations, and technical logs. We decide how this is used, we are accountable for it, and this policy is about it.

B — The client information a law firm puts into LexiManage. Matters, financial statements, trust records, documents — information about the firm’s own clients and the other people in their cases. We do not decide how this is used. The firm does. We hold it on the firm’s behalf, under our written agreement with the firm, and we do not use it for our own purposes.

If you are a client of a law firm that uses LexiManage and you want to know how your information is handled, section 6 is for you — and the short answer is that your lawyer, not us, is the person accountable to you for it.

2. Who we are, and who to contact

Leximanage Inc., a corporation incorporated under the Canada Business Corporations Act, of 61 Melrose Avenue, Toronto, Ontario M5M 1Y6.

Privacy questions, access requests and complaints: privacy@leximanage.ca
Person accountable for personal information: Stephen Gillies, President

3. What we collect about our customers, and why

We collect only what we need for the purposes above, by fair and lawful means. We do not sell personal information, rent it, or use it for advertising.

3.1 How we use it. To provide and support the Service, to bill you, to tell you about service issues and material changes, to keep the Service secure, and to meet our legal obligations. We do not currently send marketing email. If we ever do, it will be with your consent and with a working unsubscribe, as Canada’s anti-spam law requires — marketing will not be folded into service messages.

3.2 Consent. We collect and use this information on the basis of your consent, given when you subscribe and by using the Service. You can withdraw consent by closing your account, subject to information we must keep (section 8).

3.3 When we could be required to disclose information. Personal information leaves us in only these ways: on your instructions; to the service providers named in section 7, to the extent needed to run the Service; in a business transaction under section 3.4; or under legal compulsion. On compulsion, our commitments are these:

• we disclose only under a demand that has the force of law — a court order, warrant, production order, subpoena or statutory demand — and we do not treat an informal request, from police, a regulator or anyone else, as compulsion;
• we notify the affected firm promptly and before disclosing, wherever the law allows, so the firm can assert privilege, challenge the demand, or narrow it;
• where a law forbids us from giving notice, we disclose no more than the demand compels and give notice as soon as we lawfully can; and
• in every case we disclose only the minimum the demand requires.

We are a Canadian corporation, our servers are in Canada, and we act on demands as Canadian law requires.

3.4 If the business changes hands. In connection with a sale, financing or reorganisation of our business, personal information may be disclosed to a prospective purchaser or successor under confidentiality obligations, and transferred to a successor who must honour this policy. A firm’s client information remains subject to section 4 and to our agreement with the firm, and a successor must assume those obligations in full before receiving it.

4. Client information a firm puts into LexiManage

4.1 We handle this only on the firm’s instructions and only to provide the Service. It is governed by our agreement with the firm — our Terms of Service, and a data processing agreement where one is executed — not by this policy.

4.2 In particular, and as set out in that agreement:

• We do not use it for our own purposes — no analytics, no benchmarking, no statistical publication, and no training of artificial-intelligence or machine-learning systems — without the firm’s specific written consent.
• We have no standing access to it. Access happens only where the firm asks us to look at something, or where there is a security emergency, and every access is logged and the log is available to the firm.
• Each firm’s data is kept in a separate database, not pooled with other firms’.
• If we are ever served with a court order, warrant, subpoena or other demand with the force of law for a firm’s data, we notify the firm first wherever we are lawfully able to, so the firm can assert privilege — and we never treat an informal request as compulsion. Section 3.3 sets out these commitments in full.

5. Honest limits on what security can do

5.1 We encrypt information in transit and at rest, require strong authentication, keep access logs, and take encrypted backups. Details are in our agreement with your firm.

5.2 What encryption at rest does and does not do. It protects information stored on disks, in backups and in database copies — so someone who obtained a drive, a snapshot or a backup file could not read it. It does not make it technically impossible for us to access information while the Service is running, because the software has to read information in ordinary form in order to work — to render a court form, run a conflict search, or add up a trust balance.

5.3 So our commitment not to look at a firm’s client information is a promise backed by logging and by contract, not a claim that we are technically incapable of it. A firm that requires technical impossibility should run LexiManage on its own systems, which we also offer.

6. If you are a client of a law firm that uses LexiManage

You may have been invited to a secure portal to complete a financial statement, upload documents, or see your file.

6.1 Your lawyer is accountable to you for that information, not us. We provide the software; your law firm decides what is collected and why, and owes you the professional duties of confidentiality and privilege.

6.2 We hold what you enter on your firm’s behalf, in that firm’s separate database. We do not use it for anything else, and we do not contact you except as part of the portal itself.

6.3 If you want to see, correct, or ask about your information — contact your lawyer. They can act on it directly. If you contact us instead, we will not be able to give you access to a firm’s file; we will refer you to the firm, because releasing it to anyone else would breach the firm’s duties to you.

6.4 If your concern is about us rather than about your firm — for example how the software itself works — write to us at privacy@leximanage.ca.

7. Service providers we use

We use a small number of providers, each bound to protect the information they handle:

We do not currently use a payment processor — the Service is presently offered without charge during its beta. If paid billing begins, the processor will be named here before any payment information is collected.

7.1 The in-app help assistant. LexiManage includes an assistant that answers questions about how to use the software and about Ontario procedure. It is powered by Anthropic’s Claude. It is sent your question and our help documentation. It is never sent your client information — the assistant has no access to your matters, contacts, documents or accounts, and cannot answer questions about them. Ask it “how do I record a trust deposit” and it will tell you; ask it “what is the trust balance on the Smith file” and it will explain where to look, because it does not know.

That constraint is deliberate and is enforced in the software, not merely promised.

8. Where information is kept, and for how long

8.1 Location. The Service runs in Canada: information in LexiManage — including a firm’s client information — is stored and processed on servers in Quebec, Canada. Two disclosed exceptions:

• Backups. Offsite copies of our backups are stored with Google Drive and may be located outside Canada. Every backup archive is encrypted before it leaves our Canadian servers, with keys that remain in Canada under our control — the offsite copy is unreadable ciphertext to anyone without those keys.
• Email. Email you exchange with us passes through our email provider (Namecheap Private Email), whose systems may be outside Canada. Client information inside LexiManage does not travel by email.

We do not otherwise move a firm’s client information outside Canada without that firm’s written consent.

8.2 How long we keep it:

The last row matters, and trust records are the clearest example. Retention of a firm’s books and records — including its trust records — is the firm’s sole responsibility, not ours. As at the effective date of this policy, the Law Society of Ontario’s By-Law 9, s. 23 requires a licensee to keep the core trust records — including the trust journals, the clients’ trust ledger, the monthly trust comparisons, the valuable property record and trust transfer records — for at least the ten-year period immediately preceding the licensee’s most recent fiscal year end, and the other required financial records for at least the corresponding six-year period. Our retention rules never override those obligations — we do not delete records a firm is required to keep — but complying with them is the firm’s duty: a firm leaving the Service should export its records (see the Terms, section 8.7) and satisfy itself of its own retention obligations before asking us to delete anything.

9. Your rights

9.1 You may ask what we hold about you, ask us to correct it, ask us to delete it, or ask for a copy of it in a portable format. Write to privacy@leximanage.ca. We will respond within 30 days.

9.2 We may need to verify who you are first, and we may keep information we are legally required to keep (section 8.2). We rely on you to keep your account details current, and we correct promptly anything shown to be inaccurate.

9.3 If you are a client of a firm, see section 6.3 — your route is through your lawyer.

10. If something goes wrong

If personal information is lost or accessed without authorisation, we will investigate and contain it, and then do what PIPEDA requires of us:

• where the breach creates a real risk of significant harm, we report it to the Privacy Commissioner of Canada and notify the affected individuals as soon as feasible, with enough detail to understand what happened and reduce the harm;
• we notify any other organisation or institution that may be able to reduce the risk of harm; and
• we keep a record of every breach of security safeguards — whether or not it meets the reporting threshold — and make it available to the Commissioner on request.

In the case of a firm’s client information, we notify the firm, and the firm decides what to tell its own clients.

11. The website

The marketing site at leximanage.ca uses no analytics, no advertising trackers, and no non-essential cookies. The only thing it stores in your browser is your light/dark theme preference, which stays on your own device and is never sent to us.

12. Children

The Service is for law firms. We do not knowingly collect information directly from children. A firm’s matter records may legitimately contain information about children — that is client information under section 4, entered by the firm, not collected by us from the child.

13. Changes to this policy

We may update this policy. If a change is significant we will tell account holders by email before it takes effect. The date at the top shows the current version.

14. Questions and complaints

Contact us first at privacy@leximanage.ca — we would rather fix it.

You may also complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca), or to your provincial privacy commissioner where one has jurisdiction (Alberta, British Columbia and Quebec each have their own).

If your concern is about how a law firm handled your information, that is a matter for the firm and, if unresolved, the Law Society of Ontario — not for us.