This Privacy Policy explains how Casebound, operated by Mecon Immigration Inc., operating as Casebound, collects, uses, stores, and protects personal information, and is written with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation in mind.
1. Two roles: your account, and your clients' data
Casebound has two distinct relationships with personal information, and this policy covers both:
- Your account information (you, as a lawyer, RCIC, or firm staff member) — here Casebound is the controller, responsible under this policy directly to you.
- Your clients' information, which your firm enters into the platform to manage their immigration matters — here your firm is the controller andCasebound is a processor acting on your firm's instructions. This includes people who contact a firm through its public enquiry form or book a consultation on its booking page before they become clients. If you are a client or prospective client of an immigration firm using Casebound, your privacy relationship is with that firm; this policy describes how Casebound, as their service provider, technically safeguards your data on their behalf.
2. What we collect
- Account data: name, email, phone, credential type and number (e.g. RCIC number), province of practice, firm name.
- Client/application data: contact details, immigration history, intake-form answers, and any other information a firm records to prepare an application or agreement.
- Enquiry and booking data, when someone uses a firm's public enquiry form or booking page: their name, email and phone number, their answers to the firm's questions, the consent wording they agreed to, which of the firm's links they came from, and the consultation time and time zone they chose. Their IP address is kept only as a keyed hash, and a booking's private change-or-cancel link is stored only as a hash.
- Documents uploaded by firms or their clients in support of an application (e.g. passports, supporting letters).
- Payment records firms choose to log for their own bookkeeping (amount, date, method) — this is record-keeping only; we do not process the underlying payment. The one exception is the practice described in §7, whose clients can pay it online by card.
- Platform billing data: your firm's subscription plan and billing status, handled by our payment processor, Stripe — we do not store full card numbers.
- Browser extension data, if your firm uses the Casebound browser extension: each connected browser's name and type, when it was connected and last used, and a log of which portal pages were filled for which application — see §6.
- Usage and security data: sign-in timestamps, IP address, and browser information, used for account security (e.g. our email-code sign-in verification) and to diagnose issues.
3. How we use it
- To provide the platform: client intake, agreements, applications, document storage, IRCC form generation and IRCC portal filling, invoicing records.
- To run a firm's enquiry form and booking page: recording the enquiry for the firm, offering and holding consultation times, and screening out spam and automated submissions.
- To secure accounts: authentication, multi-factor sign-in codes, detecting suspicious activity.
- To send transactional email: invites, notifications about your matters, sign-in codes, receipts, and booking confirmations, changes and reminders with calendar invites.
- To operate and improve the platform, and to comply with legal obligations.
We do not sell personal information, and we do not use client data to train external AI models.
4. Where your data is stored
Casebound's database, authentication, and file storage are hosted with Supabase in the ca-central-1 (Canada) region. Some service providers we rely on (see §8) process data outside Canada as part of delivering their service — most commonly the United States; where that happens, we rely on their own security and privacy commitments and select providers with strong data-protection practices.
5. Security
Every firm's data is isolated at the database level using row-level security, so one firm cannot access another's records even in the event of an application bug. Passwords are never stored in plain text, sign-in is protected by email-code multi-factor authentication, and sensitive one-time codes and session tokens are stored using keyed hashes rather than in the clear. No system is perfectly secure, and we cannot guarantee absolute security.
6. The Casebound browser extension
Practitioners at firms on an eligible plan can use an optional Chrome extension to fill IRCC's Representative Permanent Residence portal, and a client's Express Entry profile in IRCC's online services, from an application their firm has finalized in Casebound, one page at a time, for them to review and save.
- What it can reach. Casebound itself, and — only once the practitioner allows it — the IRCC Representative PR portal (prson-srpel.apps.cic.gc.ca) and IRCC's online services (onlineservices-servicesenligne.cic.gc.ca), where Express Entry profiles are filed. It acts on a portal page only when the practitioner asks it to ("Detect page" or "Fill this page"). It does not read other websites, browsing history, or IRCC sign-in details, and it never submits, signs, declares or pays anything on the portal.
- What it receives. For each fill, the answers for one portal page and one person, taken from the firm's finalized application. The extension types them into that page and keeps no copy; the practitioner reviews the page and decides whether to save it. Information reaches IRCC only when the practitioner saves or submits in the portal, under the firm's own authority as the client's representative.
- What it keeps in the browser. A connection token for the browser, and a description of the portal's pages (where each field is — no personal information). The application picked in the extension is forgotten when the browser closes.
- What we record. The browsers connected to each account (as in §2), and for every page of answers sent and every page filled: the application, the page, the person's role on the application and how many answers were filled, kept or missing — never the answers themselves. Firms can see this record.
- Your control. A connection lasts 30 days, ends after 7 days unused, and can be ended at any time from Settings → Security or from the extension. Firm owners can disconnect any member's browser, and removing a member from a firm disconnects theirs.
7. The practice that takes clients directly on our site
On Casebound's own site, at /immigration, one licensed immigration practice offers its services directly to the public. Those pages name the practice and its licensed practitioner. As with any firm, that practice is responsible for its clients' information, and Casebound runs the platform for it. For that practice only, and for no other firm:
- Online card payments. Its consultation fees and invoices can be paid online. Stripe processes the card through Casebound's Stripe account; we receive the payer's name and email and the payment's amount, status and reference, but never the full card number. Receipts, refunds and credit notes are kept in the practice's records.
- Where a visit came from. When someone sends an enquiry or books, we record the campaign that brought them (for example an ad's “utm” tags or its click reference), the page they landed on and the website that referred them.
- Ad measurement, only with consent. If the visitor clicks “Accept” on the cookie banner on those pages, the Meta pixel and Google's tag (Google Analytics and Google Ads) load. When that visitor sends an enquiry or pays for a consultation, we also report it to Meta and Google from our server, with their email address and phone number hashed, and their IP address and browser information, so the event can be matched to an ad. If they decline, none of this happens.
- Facebook and Instagram lead forms. If the practice runs lead ads, Meta sends us the answers a person gives in Meta's form, and they are saved as an enquiry to the practice.
The practice's own privacy page, at /immigration/privacy, explains this for its visitors and lets them change their cookie choice.
8. Sub-processors we use
- Supabase — database, authentication, and file storage. Canada (ca-central-1).
- Vercel — application hosting and content delivery. Canada (Montréal), with edge delivery via its global network.
- Stripe — platform subscription billing, and the online card payments described in §7 (no other firm's client payments). Canada.
- Resend — sends transactional email (invites, notifications, sign-in codes). United States.
- Upstash — short-lived rate-limiting data to prevent automated abuse of sign-in and invite links. Canada (ca-central-1).
- Sentry — error monitoring, to help us detect and fix bugs. United States.
- Cloudflare — Turnstile, a spam and bot check on firms' public enquiry forms and booking pages; it processes the visitor's IP address and browser signals. Global network.
- Google — optional sign-in via Google OAuth, if you choose to use it; and Google Analytics and Google Ads measurement on the pages described in §7, only after the visitor accepts it. United States.
- Meta — the Meta pixel and Conversions API on the pages described in §7, only after the visitor accepts it, and the practice's Facebook and Instagram lead forms. United States.
9. Retention
We retain account and client data for as long as your firm's subscription is active, plus a reasonable period afterward to allow data export, unless a longer period is required by law or your regulator's record-keeping rules. You can request deletion of your firm's data by contacting us, subject to any records we are legally required to keep.
Enquiries that never become clients are deleted automatically, with their answers, activity and any consultation bookings, once they have had no activity for the period the firm chooses (6, 12 or 24 months). An enquiry with an upcoming consultation is kept until that consultation has passed. A firm can also delete an enquiry at any time, for example when the person asks it to.
10. Your rights
Subject to PIPEDA and applicable provincial law, you may request to:
- access the personal information we hold about you;
- correct inaccurate information;
- withdraw consent, where consent is the basis for processing; and
- request deletion of your account information, subject to legal retention requirements.
If your information was entered by an immigration firm as their client, or you sent a firm an enquiry or booked a consultation with it, please contact that firm directly — they control your data and are best placed to action your request.
11. Cookies
See our Cookie Policy for details on the cookies Casebound uses.
12. Breach notification
If a breach of security safeguards creates a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada as required by PIPEDA. Our privacy officer is responsible for overseeing this process — see §15 for contact details.
13. Children
Casebound is a professional tool and is not directed at children.
14. Changes to this policy
We may update this policy from time to time. Material changes will be communicated by email or an in-app notice before they take effect.
15. Contact
Mecon Immigration Inc., operating as Casebound — Privacy Officer. Questions, or requests relating to your personal information, can be sent to privacy@casebound.ca.