Privacy Policy

Version: 1.3

Effective date: 16 August 2026

This Privacy Policy explains how Seracase AI Limited (“SeraCase,” “we,” “us”) collects, uses, discloses, and protects personal information in connection with SeraCase AI.

Organization: Seracase AI Limited

Privacy contact: privacy@seracase.ca

Privacy officer title: Privacy contact

Mailing address: British Columbia, Canada

Support: support@seracase.ca

Seracase AI Limited is responsible for personal information under its control. This policy is intended to describe our practices under British Columbia’s Personal Information Protection Act (PIPA) and other privacy laws that apply to a particular processing activity.

Authentication and account data

Email address, authentication credentials (handled by our auth provider), multi-factor authentication settings, session metadata, and account preferences.

Case and matter data

Case names, court file numbers (if provided), narratives, timeline events, tasks, topics, notes, intake responses, and related structured case information.

Uploaded evidence and documents

Court documents, financial records, communications, photographs, other evidence, OCR/extracted text, and AI-derived metadata (for example labels or summaries you request).

User control and responsibility: You control what information you choose to upload. SeraCase processes uploaded information only to provide the services you request (for example storage, organization, OCR, AI analysis, and export). You remain responsible for the legality of content you submit, including whether you have authority to upload, store, and share it. SeraCase does not determine whether uploaded content is legally permissible.

AI processing data

Prompts, relevant document excerpts and structured context sent to AI features, model responses, and related action or recommendation logs.

Technical and security data

IP address where collected for security/audit, device and browser information, login and security events, cookies and similar technologies, and diagnostic logs.

Analytics data

Product usage events (for example page views and feature interactions) and, when enabled, hosting-platform analytics. See Section 10 (Cookies and analytics).

Billing data (when enabled)

Subscription status, transaction identifiers, and billing contact details. Payment card data, if any, is processed by a payment processor rather than stored by SeraCase as full card numbers.

We use personal information to:

• create and secure accounts;

• store, organize, and display your case materials;

• perform OCR and AI analysis you request;

• generate timelines, summaries, recommendations, drafts, and exports;

• operate Forms & Filing discovery and verification tooling;

• detect abuse, fraud, and security incidents;

• troubleshoot, maintain, and improve reliability;

• communicate service notices;

• process payments when billing is enabled;

• comply with law and respond to privacy requests.

We do not use vague unlimited purposes such as “for any business purpose.”

Authentication is provided through our identity provider (currently Supabase Auth). Passwords are not stored by the application in plaintext. Session cookies and related security cookies are used to keep you signed in and enforce idle timeout and device-trust controls where enabled.

You control what you upload. Uploaded materials are stored in private storage with account and case ownership checks. Access is intended for your authenticated account (and system processes acting on your behalf).

• OCR and text extraction may run on uploaded files to make content searchable and usable in the product.

• AI features may send necessary excerpts and structured context to an AI provider (currently OpenAI, subject to configuration) to perform the feature you requested.

• AI output may be wrong or incomplete. Always review it.

• We use business/API services for AI processing. We do not authorize identifiable case documents for training third-party foundation models unless we obtain separate express consent.

Current primary processors (confirm hosting regions before launch):

Implemented product controls include (see also the Security Notice):

• HTTPS/TLS in transit;

• private (non-public) document storage;

• application-layer AES-256-GCM encryption for document uploads when the encryption master key is configured;

• row-level security and ownership checks on user data tables where enabled;

• multi-factor authentication options;

• audit logging for sensitive actions where implemented;

• malware/unsafe-content scanning on uploads (heuristics; remote scanner when configured);

• secure deletion and trash workflows where implemented.

We do not claim end-to-end encryption where SeraCase holds encryption keys, and we do not claim SOC 2, ISO 27001, or HIPAA certification unless formally attained.

• Active account data is retained while needed to provide the service.

• When trial or paid access is paused, account and document deletion is scheduled for three months later. Legal holds, mandatory retention, security requirements, and limited provider backup retention may delay complete deletion.

• Soft-deleted materials generally move to Trash and, by default, may be purged after approximately 30 days unless a different retention setting or legal hold applies.

• Backups, if maintained by cloud providers, may retain residual copies for a limited provider-controlled window after deletion. SeraCase does not operate a separate first-party backup product.

• Security and audit logs may be retained longer for security and compliance.

• Legal holds pause destructive cleanup for covered materials.

Exact operational windows may be adjusted; in-product My Data controls reflect current account options.

Depending on applicable law, you may be able to:

• access and correct account information in Settings;

• export case materials using Export / My Data tools while your trial or paid access is active;

• delete materials or request account deletion through My Data or by contacting privacy@seracase.ca;

• withdraw optional marketing consent where separately given.

We may need to verify identity. Limitations may apply for legal holds, security, fraud prevention, and backups. We respond within timelines required by applicable privacy law.

Essential cookies

Required for authentication, session security, trusted-device preferences, and core functionality.

Analytics

The product may use:

• first-party product analytics events stored in our database; and

• Vercel Analytics / Speed Insights when enabled in the deployment.

Where a cookie preference banner is presented, non-essential analytics that the banner controls will respect your choice. Essential cookies are not optional.

Service providers may process information outside your province or country. When that occurs, information may be subject to the laws of the processing jurisdiction. We will update the subprocessor table as locations are verified.

SeraCase is intended for adults (18+). It is not directed to children. Do not create an account for a child.

If we become aware of a security incident affecting personal information, we will contain and assess it, maintain required records, and notify affected individuals and regulators where required by applicable law. No security measure eliminates all risk.

Contact privacy@seracase.ca with privacy questions or requests. If we do not resolve your concern, you may contact the Office of the Information and Privacy Commissioner for British Columbia or another regulator with jurisdiction.

We may update this Privacy Policy. Material changes requiring re-acceptance will be presented in-product. The version and effective date appear at the top of this document.

• Privacy: privacy@seracase.ca

• Support: support@seracase.ca

• Security: security@seracase.ca