Privacy Policy

Service Delivery

To create your account, authenticate you, provide access to the platform, generate documents, and maintain your data

Contract & Document Generation

To process your answers and deal information to generate customized residential real estate contracts, amendments, and related documents

AI-Powered Guidance (See Section 5)

To submit your interview responses and deal data to Anthropic Claude for form completion suggestions and workflow guidance

Payment Processing

To process subscription fees and invoices (via Stripe)

Legal Compliance

To comply with applicable laws, regulations (including PIPEDA and Alberta PIPA), and lawful government requests

Customer Support

To respond to your inquiries, troubleshoot technical issues, and provide assistance

Product Improvement

To analyze usage patterns, identify bugs, improve features, and optimize the user experience

Security & Fraud Prevention

To detect, prevent, and address fraud, abuse, technical issues, and security threats

Communication

To send transactional emails (confirmations, receipts), service updates, security alerts, and—with your consent—marketing communications

Encryption in Transit

All data transmitted between your device and our servers uses TLS 1.2+ encryption (HTTPS)

Encryption at Rest

Sensitive data stored in our database and file storage is encrypted using industry-standard algorithms

Access Controls

Data access is restricted to authorized personnel and systems on a need-to-know basis. Staff access is authenticated via secure credentials and role-based access control (RBAC)

Audit Logging

We maintain audit logs of data access and modifications to detect and investigate unauthorized activities

Network Security

Our infrastructure includes firewalls, intrusion detection systems, and regular security testing

Third-Party Security

We vet subprocessors for security compliance and require them to maintain appropriate safeguards (SOC 2, ISO 27001, or equivalent)

Regular Updates

We regularly update software, patch security vulnerabilities, and perform security assessments

Right to Access

You may request access to the personal information we hold about you. Upon request, we will provide:

• A clear summary of all personal information and how it is used
• Export in your choice of formats: PDF, CSV, or JSON
• Response within 30 days of your verified request (or as required by law)

Cost: Free for all access requests. We may charge a maximum of $25 only for frivolous or vexatious requests that duplicate recent access

Right to Correction

You may request correction of inaccurate or incomplete personal information. We will verify your identity and update your information within 30 days. If we cannot verify the correction, we will note your request in your record

Right to Deletion

You may request deletion of your personal information, subject to legal retention obligations. We will delete data where permitted by law within 30 days and provide confirmation of deletion or a written explanation of any legal retention requirements

Right to Data Portability

You may request a copy of your personal information in a portable, machine-readable format for transfer to another service, including:

• CSV: Standard spreadsheet format for easy import to other platforms
• JSON: Structured data format for technical integration
• PDF: Human-readable format with all personal information clearly documented

Provided within 30 days at no cost

Right to Withdraw Consent

Where we rely on your consent to process data (e.g., for AI processing with Anthropic Claude), you may withdraw that consent at any time by contacting our Privacy Officer. This will not affect data already processed with your prior consent. Future processing will immediately cease upon withdrawal

Right to Opt-Out of Marketing

You may opt out of receiving marketing communications by clicking the unsubscribe link in any email or contacting us directly. We will honor opt-out requests within 10 business days

Right to Dispute Resolution

If you are dissatisfied with our handling of your personal information, you have the right to:

• File a complaint with the Office of the Privacy Commissioner of Canada (OPC) at www.priv.gc.ca
• File a complaint with the Information and Privacy Commissioner of Alberta (OIPC) at www.oipc.ab.ca

Step 1: Immediate Assessment (Within 24 hours)

We immediately investigate the nature, scope, and impact of the breach, including:

• What personal data was accessed or compromised
• How many individuals are affected
• Whether the data is encrypted, de-identified, or in plaintext
• Risk level and potential harm to affected individuals

Step 2: Notify Affected Users (Within 30 Days)

We will contact you via email at your registered address and on the ContractFill platform, providing:

• What data was breached: Specific types of personal information (e.g., name, email, RECA license number, deal data)
• When the breach occurred: Date of discovery and estimated date of unauthorized access
• Potential consequences: Possible risks to your personal privacy and security
• Steps you should take: Recommended actions (e.g., change password, monitor credit, enable 2FA)
• Our response: What ContractFill is doing to remediate and prevent future breaches
• Compensation or support: If applicable, information on free credit monitoring or identity theft protection services

Step 3: Notify Regulators (Within 30 Days)

We will report the breach to:

• Office of the Privacy Commissioner of Canada (OPC) at www.priv.gc.ca (PIPEDA breaches)
• Information and Privacy Commissioner of Alberta (OIPC) at www.oipc.ab.ca (Alberta PIPA breaches)
• RECA (Real Estate Council of Alberta): If the breach involves buyer/seller personal information, deal data, or transaction records related to real estate transactions

We will include the same details provided to you in regulatory notifications, with additional technical information as required by regulators

Step 4: Remediate & Prevent Future Breaches

We take appropriate steps to mitigate harm and prevent future breaches, including:

• Securing affected systems and closing vulnerability
• Conducting forensic investigation to understand root cause
• Implementing enhanced security controls and encryption
• Notifying third-party processors of the breach

Step 5: Preserve Evidence (3 Years)

We will preserve all logs, records, and evidence related to the breach for 3 years to support regulatory investigations, legal proceedings, and RECA inquiries

Material Changes

If we make material changes that significantly affect how we use your information, we will notify you via email at your registered address and/or prominently on our website. Continued use of the Service after such notification constitutes your acceptance of the revised policy

Minor Updates

Minor clarifications or updates may be made without prior notice. We encourage you to review this policy periodically