This Privacy Policy explains how Casebound, operated by Mecon Immigration Inc., operating as Casebound, collects, uses, stores, and protects personal information, and is written with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation in mind.
1. Two roles: your account, and your clients' data
Casebound has two distinct relationships with personal information, and this policy covers both:
- Your account information (you, as a lawyer, RCIC, or firm staff member) — here Casebound is the controller, responsible under this policy directly to you.
- Your clients' information, which your firm enters into the platform to manage their immigration matters — here your firm is the controller andCasebound is a processor acting on your firm's instructions. If you are a client of an immigration firm using Casebound, your privacy relationship is with that firm; this policy describes how Casebound, as their service provider, technically safeguards your data on their behalf.
2. What we collect
- Account data: name, email, phone, credential type and number (e.g. RCIC number), province of practice, firm name.
- Client/application data: contact details, immigration history, intake-form answers, and any other information a firm records to prepare an application or agreement.
- Documents uploaded by firms or their clients in support of an application (e.g. passports, supporting letters).
- Payment records firms choose to log for their own bookkeeping (amount, date, method) — this is record-keeping only; we do not process the underlying payment.
- Platform billing data: your firm's subscription plan and billing status, handled by our payment processor, Stripe — we do not store full card numbers.
- Usage and security data: sign-in timestamps, IP address, and browser information, used for account security (e.g. our email-code sign-in verification) and to diagnose issues.
3. How we use it
- To provide the platform: client intake, agreements, applications, document storage, IRCC form generation, invoicing records.
- To secure accounts: authentication, multi-factor sign-in codes, detecting suspicious activity.
- To send transactional email: invites, notifications about your matters, sign-in codes, receipts.
- To operate and improve the platform, and to comply with legal obligations.
We do not sell personal information, and we do not use client data to train external AI models.
4. Where your data is stored
Casebound's database, authentication, and file storage are hosted with Supabase in the ca-central-1 (Canada) region. Some service providers we rely on (see §6) process data outside Canada as part of delivering their service — most commonly the United States; where that happens, we rely on their own security and privacy commitments and select providers with strong data-protection practices.
5. Security
Every firm's data is isolated at the database level using row-level security, so one firm cannot access another's records even in the event of an application bug. Passwords are never stored in plain text, sign-in is protected by email-code multi-factor authentication, and sensitive one-time codes and session tokens are stored using keyed hashes rather than in the clear. No system is perfectly secure, and we cannot guarantee absolute security.
6. Sub-processors we use
- Supabase — database, authentication, and file storage. Canada (ca-central-1).
- Vercel — application hosting and content delivery. Canada (Montréal), with edge delivery via its global network.
- Stripe — platform subscription billing only (not client retainer payments). Canada.
- Resend — sends transactional email (invites, notifications, sign-in codes). United States.
- Upstash — short-lived rate-limiting data to prevent automated abuse of sign-in and invite links. Canada (ca-central-1).
- Sentry — error monitoring, to help us detect and fix bugs. United States.
- Google — optional sign-in via Google OAuth, if you choose to use it.
7. Retention
We retain account and client data for as long as your firm's subscription is active, plus a reasonable period afterward to allow data export, unless a longer period is required by law or your regulator's record-keeping rules. You can request deletion of your firm's data by contacting us, subject to any records we are legally required to keep.
8. Your rights
Subject to PIPEDA and applicable provincial law, you may request to:
- access the personal information we hold about you;
- correct inaccurate information;
- withdraw consent, where consent is the basis for processing; and
- request deletion of your account information, subject to legal retention requirements.
If your information was entered by an immigration firm as their client, please contact that firm directly — they control your data and are best placed to action your request.
9. Cookies
See our Cookie Policy for details on the cookies Casebound uses.
10. Breach notification
If a breach of security safeguards creates a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada as required by PIPEDA. Our privacy officer is responsible for overseeing this process — see §13 for contact details.
11. Children
Casebound is a professional tool and is not directed at children.
12. Changes to this policy
We may update this policy from time to time. Material changes will be communicated by email or an in-app notice before they take effect.
13. Contact
Mecon Immigration Inc., operating as Casebound — Privacy Officer. Questions, or requests relating to your personal information, can be sent to privacy@casebound.ca.