Privacy Policy

Effective date: March 19, 2026

Operated by BlueWise AI · admin@bluewiseai.com

In the event of a discrepancy between the English and French versions, the French version shall prevail.

This policy is designed to comply with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and Quebec's Act respecting the protection of personal information in the private sector (Law 25 / Bill 64).

1. Who We Are

Not a Lawyer (notalawyer.app) is operated by BlueWise AI, a Canadian technology company. We provide AI-powered legal information — not legal advice — to Canadian consumers. Contact: admin@bluewiseai.com.

2. What We Collect

Account information: If you register, we collect your email address and hashed password or OAuth token. We never store passwords in plain text.

Chat messages: We process your messages to retrieve relevant legal information. Free tier: messages are held only for the duration of your session and deleted when you close it. Paid tiers: messages are stored encrypted at rest for history purposes per your subscription.

Usage analytics: We collect anonymized usage metrics (query counts, feature usage) to improve the service. We do not track individual browsing behaviour across sessions.

Payment information: Payment processing is handled entirely by Stripe. We never see or store your credit card number. We receive only your Stripe customer ID and subscription status.

3. What We Do NOT Collect

•No personally identifiable information (PII) is extracted from your chat conversations.
•No tracking cookies or advertising pixels.
•No third-party ad networks.
•No sale, rental, or sharing of your data for marketing purposes.
•We do not use your conversations to train AI models.

4. How We Use Your Information

•Provide the legal information service (retrieve and generate cited answers).
•Manage your account and subscription.
•Enforce usage quotas per subscription tier.
•Improve the quality of our responses (using anonymized aggregate data only).
•Comply with Canadian legal obligations.

5. Third-Party Service Providers

Provider	Role	Location	Note
Supabase	Database and authentication	Canada (Montreal, ca-central-1)	Data stored in Canada. Row-level security enforced.
OpenAI	AI processing (chat responses)	United States	OpenAI does not use API inputs for model training per their data usage policy.
Stripe	Payment processing	United States	PCI-DSS compliant. We receive no raw card data.
Vercel	Web hosting / CDN	Global (edge)	Standard web server logs (anonymized IPs).

We do not share your data with third parties for advertising, marketing, or any purpose beyond service delivery and legal obligations.

6. Data Retention

Tier	Chat messages	Account data
Free	Session only — deleted on close	Until account deletion
Starter	30 days	Until account deletion
Pro	1 year	Until account deletion

After cancellation of a paid subscription, all chat data is permanently deleted within 30 days. Account data (email) is deleted upon written request.

7. Data Security

•All data is encrypted in transit (TLS 1.3) and at rest (AES-256).
•Database hosted in Canada (Montreal, ca-central-1).
•Row-level security enforced — users can only access their own data.
•No personal information is extracted from chat conversations.
•Regular security reviews.

8. Your Rights (PIPEDA & Law 25)

Under PIPEDA and Quebec's Law 25, you have the following rights:

•ACCESS — Request a copy of the personal information we hold about you.
•CORRECTION — Request correction of inaccurate information.
•DELETION — Request deletion of your account and all associated data.
•WITHDRAWAL OF CONSENT — Withdraw consent for data processing (note: withdrawal may limit service functionality).
•PORTABILITY — Export your chat history (paid tiers).
•COMPLAINT — Lodge a complaint with the Office of the Privacy Commissioner of Canada (priv.gc.ca) or the Commission d'accès à l'information du Québec (cai.gouv.qc.ca).

To exercise any of these rights, email admin@bluewiseai.com. We will respond within 30 days.

9. Cookies

We use only essential cookies required for authentication and session management. We do not use advertising cookies, third-party tracking pixels, or analytics cookies that identify individual users.

10. Children

Not a Lawyer is not intended for persons under 18 years of age. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact admin@bluewiseai.com and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users by email of any material changes at least 30 days before they take effect. The current version is always available at notalawyer.app/privacy.

12. Contact & Privacy Officer

BlueWise AI · admin@bluewiseai.com · notalawyer.app For privacy complaints you may also contact: Office of the Privacy Commissioner of Canada — priv.gc.ca Commission d'accès à l'information du Québec — cai.gouv.qc.ca

Privacy questions? Email admin@bluewiseai.com