Privacy Policy

Last updated: October 1, 2026

ClearStand is operated by Taylor Hamilton ("we", "us", "our"). This Privacy Policy describes how we collect, use, store, and protect your personal information when you use ClearStand, and your rights under the Personal Information Protection and Electronic Documents Act (PIPEDA).

What We Collect

• Account information — your name and email address at registration
• Payment information — processed entirely by Stripe; ClearStand never stores your card number, CVV, or full payment details on our servers
• Case information — documents, facts, and details you enter for document preparation and AI analysis
• Analysis output — when you run a disclosure analysis, the findings it produces are saved to your account so that later disclosure can be assessed against them. The uploaded documents themselves are not retained. The findings may quote and name people involved in your case, including complainants, witnesses, and children.
• Usage data — your plan tier, feature usage, and login timestamps
• Technical data — IP address and browser type collected automatically for security monitoring

How We Use Your Information

• To provide the ClearStand service and generate documents and analysis
• To process payments through Stripe
• To send account, billing, and service emails
• To monitor for abuse and protect the security of the platform
• To improve the platform based on usage patterns

Who We Share With

• Stripe — payment processing only. Stripe's privacy policy governs their handling of payment data.
• Anthropic — AI query processing only. The facts of your case are sent so the AI can answer; your stored identity details are not. See What We Send to the AI Provider for exactly what this means.
• Resend — transactional email delivery only.

We do not sell your data to third parties. We do not share your data with advertisers. We do not use your data to train AI models.

What We Send to the AI Provider

ClearStand uses Anthropic's Claude API to generate legal guidance, analysis, and draft documents. This section describes what leaves our servers when you use those features.

We do not send:

• Your legal name, date of birth, home address, postal code, phone number, or email address
• Your court file number
• The names of other parties, children, police officers, judges, or counsel. These are replaced with role placeholders such as [ACCUSED], [WITNESS_1], or [CHILD_1] before anything is sent, and put back before you see the response
• Children's dates of birth. Where a child's age is relevant, the AI is told the age only

We do send:

• The facts of your case — charges and Criminal Code sections, court and court type, hearing dates, bail conditions, prior record, your role in the proceeding, and the substance of what is in dispute. The AI cannot give useful guidance without these.
• Text you type or dictate — chat messages and dictated narratives are sent as you write or speak them. We remove names already saved in your profile where we can match them, but we cannot remove a name or detail we have never been given.
• Documents you upload, in full and unredacted. A disclosure package, financial statement, or affidavit uploaded for analysis is transmitted exactly as provided, including every name, address, and account number it contains.

Retention Periods

• Account data — retained while your account is active
• On account deletion — all personal data permanently deleted within 30 days
• Payment records — retained as required by Canadian tax law (7 years)
• Security logs — retained for 90 days
• Privacy breach records — retained for a minimum of 24 months as required by PIPEDA

Data Security

ClearStand implements industry-standard security measures including:

• All data transmitted over HTTPS (TLS encryption in transit)
• Passwords hashed using bcrypt — never stored in plaintext
• JWT authentication for all API access
• Rate limiting to prevent brute force attacks
• Security headers (HSTS, Content Security Policy)
• Regular security monitoring

Data Breach Notification Policy

• Notify all affected users by email at their registered email address as soon as reasonably possible
• Report the breach to the Office of the Privacy Commissioner of Canada as required under PIPEDA
• Provide affected users with:
  • A description of what happened
  • What personal information was involved
  • What steps ClearStand has taken to address the breach
  • What steps users can take to protect themselves
  • Contact information for follow-up questions

ClearStand maintains records of all privacy breaches for a minimum of 24 months as required by law.

To report a suspected security issue: support@clearstand.ca

Your Rights Under PIPEDA

• Right to access your data — email support@clearstand.ca
• Right to delete your account and data — available in Account Settings → Danger Zone, or by emailing us
• Right to correct inaccurate information — available in Account Settings → Profile
• Right to withdraw consent — you may cancel your subscription and request data deletion at any time

Cookies

ClearStand does not use tracking cookies. We use browser localStorage to store your authentication token on your device. This data does not leave your device except as part of authenticated API requests to ClearStand servers.

Children's Privacy

ClearStand is not intended for users under the age of 18. We do not knowingly collect personal information from minors. If you believe a minor has created an account, contact us immediately.

Changes to This Policy

We will notify registered users by email of any material changes to this Privacy Policy. Continued use of ClearStand after changes constitutes acceptance of the updated policy.

Contact

Privacy inquiries: support@clearstand.ca
Office of the Privacy Commissioner of Canada: priv.gc.ca