Privacy Policy

1. Information We Collect

We collect the following types of personal information:

Account information: your name, email address, and password (or Google account credentials if you sign in with Google). When you use Google sign in, we receive your name, email address, and profile picture from Google.

Your situation: when you set up your profile, you tell us your province or territory and, if you choose, whether children are involved and whether you and your spouse agree on the main issues. We use these to build your timeline and to set the starting filters when you browse lawyers, which you can change. We also keep what you enter in your timeline, like checklist items and notes.

Lawyer profile information: your professional qualifications, bar membership, areas of expertise, rates, availability, bio, professional photo, and practice details.

Lawyer applications: proof of your licence, your law society details, your firm's contact details, and the names and contact details of any references you give us. Please let your references know you've shared their details with us.

Consultations and messages: when you book a consultation, the topic, a note if you write one, and your spouse's or partner's full name. The lawyer needs that name to check they don't already act for them (a conflict check). We also keep messages between clients and lawyers, and any feedback a client gives after a consultation.

Waitlist: your email address and province, if you ask us to tell you when lawyers join in your area. You don't need an account for this.

Contact form: your name, email address and message. We send it to our support inbox and keep a short record that you wrote to us.

Email choices: whether you'd like news and tips from us, and when you told us.

Usage data: pages visited, features used, actions taken (such as completing timeline milestones or toggling checklist items), and general interaction patterns. We collect this to improve the platform.

Payment data: for lawyers, payment information is collected and processed by Stripe. We do not store credit card numbers. We receive confirmation of payment status and subscription details from Stripe.

Device and technical data: your IP address, the session token that keeps you signed in, and records of sign-ins and failed sign-in attempts. Our hosting providers also see your browser type in their logs.

2. Why We Collect Your Information

We collect each type of personal information for specific, identified purposes:

Account information: to create and manage your account, authenticate your identity, and communicate with you about your account.

Your situation: to build your timeline, tailor guides to your province, pre-fill the filters you choose when you browse lawyers, and keep your situation in one place so you can come back to it. Your answers are private to you. Lawyers don't see them, and we don't use them to match, rank or recommend lawyers.

Lawyer profile information: to display your profile in the lawyer directory, let clients filter by expertise, approach, province, language and rate, and manage your subscription. We do not rank lawyers.

Communication data: to facilitate communication between clients and lawyers, support consultation booking, and improve the platform using post-consultation feedback. Once a lawyer has at least 5 ratings, their average rating appears on their public profile. Nobody, including the lawyer, ever sees an individual client's rating or answers.

Spouse's or partner's name: only so the lawyer you book can do their conflict check.

Usage data: to improve the platform, fix bugs, understand how features are used, and ensure the platform works correctly. We do not use usage data for advertising.

Payment data: to process lawyer subscription payments.

Device and technical data: to secure your account, prevent unauthorized access, and maintain session authentication.

We do not sell your personal information to third parties. We do not use your information for advertising or targeted marketing outside the platform.

3. How We Share Your Information

We share your personal information only in the following circumstances:

With lawyers you connect with: when you book a consultation or send a message, the lawyer you are connecting with receives your name, your profile photo (if you have one), your province and what you include in your request, including your spouse's or partner's name. They don't receive your email address or phone number. You talk through Uncoupled messages and the consultation video link, and you choose whether to share contact details. Lawyers do not see your timeline progress, checklist items, or other private dashboard data unless you share it directly.

With clients (for lawyers): your profile information (name, bio, expertise, rates, photo) is visible to all platform users browsing the lawyer directory.

With service providers who help operate the platform:

• MongoDB Atlas (Canada): database hosting
• Stripe (United States): payment processing; processes lawyer subscription payments, including the card and billing address you enter at checkout
• Resend (United States): email delivery; sends transactional emails such as welcome messages, consultation notifications, and password resets
• Vercel (United States): frontend hosting; serves the website and static assets, and counts visits with Vercel Web Analytics (cookieless)
• Google (United States): processes sign in with Google and, only if you choose "Accept all" on our cookie banner, runs Google Analytics so we can see how people use our site
• Google Workspace (United States): our company email, including our support and privacy inboxes, and our company calendar. When a lawyer confirms a video consultation, we create the event on our company calendar and Google sends you both the invitation and Meet link. The event holds both your names, both email addresses and the consultation topic. Neither of you can see the other's email address. We don't join, listen to or record consultations.
• Render (United States): backend hosting; hosts the application server that processes platform requests and personal data

People at Uncoupled: a small number of people at Uncoupled can see account information when they need to, for example to fix a problem you've reported, review a lawyer's application or keep the platform safe. They may view the platform as you see it. We record every time they do.

When required by law: we may disclose personal information when required to do so by law, court order, or legal process.

With your explicit consent: in any other circumstance, we will only share your information with your prior consent.

4. Cross-Border Data Transfers

Uncoupled is a Canadian platform, and our database is in Canada. Some of the service providers we use to run the platform are in the United States, so your personal information may also be processed there.

The following data is processed outside Canada:

• Payment information is processed by Stripe in the United States
• Emails are sent through Resend, which operates in the United States
• The website is hosted on Vercel infrastructure in the United States
• Our servers are hosted by Render in the United States
• Google processes data for sign-in with Google, calendar invites and video links for consultations, and Google Analytics if you accept analytics cookies, in the United States

While your data is in the United States, it may be subject to US laws which differ from Canadian privacy protections.

We ensure that all service providers we use maintain appropriate security measures and we have agreements in place requiring them to protect your data. However, we want you to be aware that the privacy protections in the United States may differ from those in Canada.

5. Data Retention

We retain your personal information for as long as your account is active and as needed to provide you with our services.

If you delete your account, we delete your account, profile, timeline, notes and waitlist entries straight away. A few things stay because they also belong to someone else, or because we need them for billing and security:

• Messages you sent stay in the other person's inbox, shown as from a deleted account.
• If you're a client, lawyers keep only the date, time and status of consultations you had with them. Your topic, note, your spouse's or partner's name and your rating are removed.
• If you're a lawyer, clients keep their record of consultations and confirmed retainers with you. Stripe keeps your billing records for as long as tax law requires.
• We keep referral records and security records, such as sign-in records.
• Backups may hold copies for a limited period.

Breach records are retained for a minimum of 24 months as required by PIPEDA.

You may request deletion of your data at any time by using the "Delete my account" function in your account settings or by contacting our Privacy Officer.

6. Data Security

We implement security measures to protect your personal information, including:

• All data transmitted between your browser and our servers is encrypted using HTTPS/TLS
• Authentication tokens are generated with 256-bit entropy and stored securely
• Passwords are hashed using bcrypt (never stored in plain text)
• Session tokens are invalidated on logout and password changes
• Rate limiting protects against brute force attacks
• Input validation and sanitization prevents injection attacks
• Access to production systems is restricted and logged

No method of electronic storage or transmission is 100% secure. While we strive to protect your personal information, we cannot guarantee absolute security. If you become aware of any unauthorized access to your account, please contact us immediately.

7. Your Privacy Rights

Under PIPEDA and applicable provincial privacy legislation, you have the following rights:

Right to access: you may request a copy of all personal information we hold about you. You can export your data at any time from your account settings, or contact our Privacy Officer.

Right to correction: you may request that we correct inaccurate or incomplete personal information. You can update most information directly through your profile settings.

Right to deletion: you may request the deletion of your personal information. If you delete your account, we delete your account, profile, timeline, notes and waitlist entries straight away. A few things stay because they also belong to someone else, or because we need them for billing and security:

• Messages you sent stay in the other person's inbox, shown as from a deleted account.
• If you're a client, lawyers keep only the date, time and status of consultations you had with them. Your topic, note, your spouse's or partner's name and your rating are removed.
• If you're a lawyer, clients keep their record of consultations and confirmed retainers with you. Stripe keeps your billing records for as long as tax law requires.
• We keep referral records and security records, such as sign-in records.
• Backups may hold copies for a limited period.

Right to withdraw consent: you may withdraw your consent to the collection, use, or disclosure of your personal information at any time. Note that withdrawing consent may affect your ability to use the platform.

Right to complain: if you believe we have not handled your personal information properly, you have the right to file a complaint with the Office of the Privacy Commissioner of Canada:

Office of the Privacy Commissioner of Canada
30 Victoria Street
Gatineau, Quebec K1A 1H3
Toll-free: 1-800-282-1376
Website: www.priv.gc.ca

We will respond to all access, correction, and deletion requests within 30 days. If we need more time, we will notify you of the reason and the expected timeline.

8. Cookies and Tracking Technologies

We use a small number of cookies and similar storage in your browser. Essential items are always used. Google Analytics cookies are used only if you choose "Accept all" on our cookie banner (see Analytics below). We don't use advertising cookies, tracking pixels or retargeting.

The specific items we store in your browser:

• session_token: required for authentication. Identifies your logged-in session and is invalidated on logout, password change, or account deletion. Without this, you cannot use the platform while signed in.
• user: a minimal cached copy of your account display data (name, email, role, profile picture) used to render the dashboard before the server confirms your session on each page load. Refreshed on every login and on every /me call.
• cookie_consent and cookie_consent_at: record your response to the cookie banner ("accepted" or "essential_only") and the timestamp at which you responded. This records your choice on the cookie banner and when you made it, so we don't ask again.
• _ga cookies: set by Google Analytics only if you choose "Accept all", to count visits. They're deleted if you switch to "Essential only".
• Sign-up drafts (uncoupled_client_onboarding_progress, uncoupled_lawyer_onboarding_progress): what you've typed into the sign-up questions, so reloading the page doesn't lose it. They're deleted when you finish, start over or sign out. On a shared computer, please sign out when you're done.
• Small preferences (timelineProvinceKeep, resourceProvinceTab): remember choices like which province tab you were reading.
• Stripe cookies, on the lawyer checkout page only: Stripe uses these to prevent fraud when you pay.
• Vercel Web Analytics (cookieless): counts visits without setting a cookie.

Managing cookies and storage: you can clear these items at any time through your browser's settings (clear cookies, clear site data, or "delete browsing data"). Essential items (session_token, user, cookie_consent) are required for the platform to function. Clearing them will sign you out, and you'll need to sign in again.

What we don't use: we don't use Facebook Pixel or any advertising tracker, we don't place advertising cookies, and we don't share browsing data with advertising networks or use cross-site tracking.

Server-side analytics: we record usage events (page views, actions taken, features used) on our own servers under your account, separately from cookies. This is described in Section 1 (Information We Collect) and is part of the personal data you can export under Section 7.

We also count visits without cookies. Each browser tab gets a random visit number that's cleared when you close the tab, so we can see which pages people visit and in what order. We don't store your IP address with it. We also use Vercel Web Analytics, which counts page visits without cookies.

Analytics. If you choose "Accept all" on our cookie banner, we use Google Analytics to understand how people use our site, such as which pages they visit, how they found us and whether pages load properly. Google Analytics doesn't receive your name, email address or anything you type into our forms, and we've turned off advertising features. If you choose "Essential only", we don't load Google Analytics. You can change your choice at any time using "Cookie settings" at the bottom of every page. Google may process this information outside Canada, including in the United States.

Visit counts: we use Vercel Web Analytics to count visits to our pages. It doesn't use cookies or identify you. It records the page you visited, the site you came from, your country and the type of device, and we only see these as totals.

9. Children

Uncoupled is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from minors. If we become aware that we have collected personal information from someone under 18, we will delete it promptly.

10. Data Breach Notification

In the event of a data breach involving your personal information that creates a real risk of significant harm, we will:

• Notify the Office of the Privacy Commissioner of Canada as soon as feasible
• Notify you directly as soon as feasible, describing the nature of the breach, the types of information involved, what we are doing to address it, and steps you can take to protect yourself
• Maintain records of all breaches for at least 24 months, as required by PIPEDA

A "real risk of significant harm" includes bodily harm, humiliation, damage to reputation or relationships, loss of employment, financial loss, identity theft, negative effects on credit records, and damage to or loss of property.

11. Canadian Privacy Law

Uncoupled follows the Personal Information Protection and Electronic Documents Act (PIPEDA). Where a provincial privacy law applies to you, we follow it too.

If you are located in a province with substantially similar privacy legislation, that provincial law may apply to the collection, use, and disclosure of your personal information within that province. PIPEDA continues to apply to any cross-border data transfers.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make significant changes, we will:

• Update the "Last updated" date at the top of this page
• Notify you by email if the changes affect how we use your personal information
• Post a notice on the platform for 30 days following the change

Your continued use of the platform after changes are posted constitutes your acceptance of the updated policy. If you do not agree with the changes, you may delete your account.

13. Privacy Officer and Contact

Our Privacy Officer is responsible for ensuring compliance with this policy and applicable privacy legislation.

Privacy Officer
Uncoupled Inc.
Email: privacy@uncoupled.me
Uncoupled Inc., 15 Queens Quay East, Toronto, ON M5E 0C5

For general questions about the platform, contact us at hello@uncoupled.me.

For privacy-specific inquiries, complaints, or data access requests, contact privacy@uncoupled.me.