Your information matters.

Private pilot privacy notice · September 2026

What this pilot stores

Your signed-in Site identifier links your saved offices, office profile draft, selected plan and launch checklist. Claim requests store your representative name and business email for administrator review. Advertising requests store your office name, business email, preferred timing and quoted placement price. This information is stored on the Site’s database, not in browser storage. Do not enter confidential legal information.

What is not connected

Messages are encrypted in the browser using participant keys. The server stores ciphertext, a passphrase-encrypted key vault and routing metadata. Admin audit views contain no message text. Keep your inbox passphrase safe: lost passphrases cannot be recovered. Encryption has not received an independent security audit. Canadian data residency and complete privacy compliance are not claimed. Online checkout and document attachments are not connected.

Notifications and AI research

Optional office email alerts contain no client details or message text. Email requires a connected delivery service. AI questions are sent to OpenAI for web research only with your consent; they are separate from encrypted conversations. Do not submit confidential information to the AI assistant. Completed AI answers are encrypted at rest and saved to the signed-in account. Question text is shared with administrators only when you select the optional sharing checkbox. Shared questions are encrypted at rest and used to understand demand for legal services. Earlier questions were not stored separately. An answer may repeat parts of your question. Administrators can view account registration dates, practice and province selections, usage counts, and payment or credit records; their reports do not expose answer text. Provider retention policies also apply.

Your controls

You can export or reset your workspace from the client dashboard. Resetting removes the active workspace record but does not remove messages, inbox keys or ownership claims; contact the administrator to withdraw a claim. Infrastructure backups may retain records; infrastructure backups may have separate retention. A production retention schedule and deletion process must be approved before launch.

Images and Google reviews

Approved, subscribed offices can upload public profile images. Uploaded images are stored with their office identifier and uploader account. Do not upload confidential documents or client information.

Office images may load from the original directory or image hosts selected by the administrator or approved office owner. Google reviews load only when you request them. Google may provide up to five relevant reviews rather than the complete review history. Google content is governed by the Google Maps terms and Google Privacy Policy. External image hosts and Google receive standard connection information when you view their content. Approved office profiles may display OpenStreetMap location maps, subject to the provider’s privacy policy. This site does not store Google review content.

External links and analytics

Office and map links take you to other websites with their own policies. With your optional consent, Google Analytics (G-EHZER669X3) counts public-page visits using broad page categories, cookie identifiers and standard device/connection information. Google may process this information outside Canada under its privacy policy. We do not send searches, legal questions, messages, form contents, account details, profile identifiers, URL query strings or fragments to Google Analytics. Analytics does not run on private account, sign-in, assistant or payment pages. We do not use AdSense or advertising cookies. Accept or reject analytics in the cookie notice; you can change your choice or withdraw consent at any time using Cookie settings. Your choice is saved locally for up to 180 days. Rejecting analytics does not affect access to the site. First-party activity counts separately record signed-in profile views and contact clicks, deduplicated per visitor, day and action. Owners see aggregate counts, not visitor identities; those activity counts are not sent to Google Analytics.