Privacy Policy

CaseEasy 360 – operated by Aubyn Innovations Inc.

1. Who We Are and What This Policy Covers

1.1 Us. CaseEasy 360 is a practice management platform for immigration law firms and licensed immigration consultants, operated by Aubyn Innovations Inc. (“CaseEasy”, “we”, “us”), 2967 Dundas Street West, Unit 937, Toronto, Ontario M6P 1Z2.

1.2 This Policy. It explains how we handle personal information that we collect for our own purposes, through the caseeasy.ca websites and the CaseEasy 360 platform. Section 2 explains what it does not cover, and section 2 is the part to read first if you are a client of a firm that uses our platform.

1.3 Enterprise customers. A fuller version of this Policy, dealing with enterprise data processing in detail, is available to enterprise customers through our Trust Center. Where we have a written enterprise agreement with a customer, that agreement governs our handling of the information that customer puts into the platform and prevails over this Policy in respect of it.

2. Two Kinds of Information, and Two Different Roles

2.1 What we hold for ourselves. When you visit our website, ask for a demo, register for an account, use the platform as an authorized user, pay us or contact support, we collect information about you for our own business purposes. For that information we are the organization accountable under Canadian privacy law, and this Policy tells you how we handle it.

2.2 What we hold for a firm. Our customers are law firms and licensed immigration consultants (“Subscribing Firms”). A firm uses CaseEasy 360 to run its own client files, and in doing so it puts information about its own clients and their matters into the platform, including application data, identity and supporting documents, completed government forms, correspondence and file notes. We call that “Firm Client Information”.

2.3 This Policy does not govern Firm Client Information. We process it only on the firm's instructions and only to provide, support and secure the platform for that firm. The firm, not CaseEasy, is the organization accountable to the individuals its files are about. That information is governed by the firm's agreement with us and by the firm's own privacy policy and professional obligations.

2.4 If you are a client of a Subscribing Firm. To see what information is held about you, to correct it, to withdraw a consent or to complain, contact the firm rather than us. We will not give you access to, or change, anything in a firm's files without that firm's authorization, because the information is the firm's to control and may be subject to solicitor-client privilege.

2.5 We do not use Firm Client Information for ourselves. We do not use it, and we do not permit our service providers to use it, for our own marketing, advertising or promotional purposes, to market our services to anyone else, or to train any general-purpose machine learning model. Everything this Policy says about marketing, product development or promotion applies only to the information described in section 4, and never to Firm Client Information.

3. Our Privacy Officer

3.1 Accountability. We are responsible for the personal information under our control, including information we transfer to a service provider for processing. Our Privacy Officer is Orane Cole, Founder and Chief Executive Officer, and you can reach that office at [email protected] or at the address in section 1.1.

4. What We Collect for Our Own Purposes, and Why

4.1 What we collect. Account and profile information such as your name, business email address, telephone number, job title and firm; the name, business email and role of each authorized user a Subscribing Firm registers; business contact details if you ask us for a demo or information; billing records, though our payment processors handle card details directly and we do not store full card numbers; your correspondence with our support, sales and success teams; and technical and usage information such as internet protocol address, device and browser type, pages and features accessed, and sign-in and administrative logs.

4.2 Why we collect it. To create and administer accounts and issue credentials; to provide, maintain, support and improve the platform and websites; to authenticate users and keep the platform secure, including detecting fraud and unauthorized access; to bill and keep financial records; to answer enquiries, support requests and complaints; to send service and transactional messages such as security alerts and billing notices; with your consent or as otherwise permitted by law, to send marketing communications and conduct surveys and product development; and to meet our legal, regulatory and audit obligations.

4.3 Consent. We collect, use and disclose personal information with your knowledge and consent, except where the law permits or requires otherwise. You can withdraw consent at any time on reasonable notice, subject to legal and contractual restrictions, though withdrawing consent to what is necessary to run an account usually means we can no longer provide the account. We will tell you before we act on your request.

4.4 We do not sell personal information. We do not sell, rent or trade it. With one exception we do not disclose it to third parties for their own independent purposes, and the exception is the advertising and measurement technologies on our public marketing website described in section 7.3. Those run only on the marketing website. They are not present in the platform, they receive no Firm Client Information, and they receive nothing from the platform.

5. When We Disclose It, and to Whom

5.1 Service providers. We use third-party providers to host, operate, secure and support the platform. We remain responsible for personal information transferred to a provider for processing and we use contractual and other means to require each of them to provide a comparable level of protection. They include Microsoft Azure for hosting and storage, Cloudflare for content delivery and security, AWS SES and Twilio for email and SMS, Stripe, LawPay and Payload for payments, Drata for security and compliance management, and Intercom for our live chat support channel. Intercom connects users at a Subscribing Firm with CaseEasy Support. It is not a channel between a firm and that firm's own clients and is not intended to carry client file content, so please do not paste documents or client details into it. The full list, with what each provider does and where it processes, is in the enterprise version of this Policy. Where something you send us through that channel contains information from a Subscribing Firm’s client files, that information remains Firm Client Information, section 2 applies to it, and where the firm has an enterprise agreement with us that agreement governs our handling of it.

5.2 Where information is hosted. Our primary production environment, primary customer database and production backups are hosted in Canada, in the Microsoft Azure Canada Central and Canada East regions. Some providers operate global infrastructure and may process limited information outside Canada for email and SMS delivery, payment processing, traffic security and fraud prevention, logging and support. While information is outside Canada it is subject to the laws of the country it is in and may be accessible to the authorities of that country.

5.3 Optional AI features. Certain optional features use artificial intelligence. They are not part of the core platform, they are off by default, and each one operates only where a Subscribing Firm has expressly enabled that particular feature. Enabling one is not enabling the others.

5.4 Where they are enabled. Our eligibility assessment feature is supported by Microsoft Foundry. We remove the direct identifiers before anything is sent, including names, contact details, document numbers and addresses, and we reduce a date of birth to an age; documents are not sent to it. That deployment is a global one, so a request may be processed in any region where the model runs, and Microsoft applies its own screening for misuse, which can include review by authorized Microsoft personnel of a request its systems have flagged. Our optical character recognition feature is supported by Azure AI Vision in the Microsoft Azure Canada Central region. It has to read a document as it stands, so it cannot be de-identified first, and the provider does not retain the document or the result after processing. We do not permit information sent to either feature to be used to train any foundation model. Both are described in full in the enterprise version of this Policy.

5.5 Law, and business transactions. We may disclose personal information where required or permitted by law, including in response to a subpoena, warrant, production order or other lawful demand, and in connection with a financing, merger, acquisition or sale of our business, subject to appropriate confidentiality protections. Where a legal demand seeks Firm Client Information, we notify the firm and do not produce it until the firm has had a reasonable opportunity to assert privilege, unless we are legally prohibited from doing so.

6. How We Protect It, and How Long We Keep It

6.1 Safeguards. We maintain administrative, technical and physical safeguards designed to protect personal information against loss and theft and against unauthorized access, disclosure, copying, use or modification, appropriate to the sensitivity of the information. These include encryption in transit using TLS and encryption at rest using Microsoft Azure server-side encryption, least-privilege access controls, restriction of internal access to authorized personnel with a legitimate business need, confidentiality obligations on our employees and contractors, and encrypted backups. Multi-factor authentication is available to all customers and can be enforced by a firm administrator, and single sign-on through Microsoft Entra ID is available to enterprise customers. No security system is impenetrable and we cannot guarantee the security of information transmitted over the internet.

6.2 Independent assessment. We have completed a SOC 2 Type I examination, which reports on the suitability of the design of controls at a point in time. It is not a Type II report on operating effectiveness over a period, and we do not hold an ISO 27001 certification.

6.3 Retention. We keep personal information only as long as necessary for the purposes described here or as long as the law requires. Account information is kept for ninety (90) days after an account is closed and then permanently deleted, subject to any legal, regulatory or contractual retention requirement. Activity and audit records specific to a Subscribing Firm sit inside that firm's own database and are deleted with it. System and infrastructure security logs are generated at the server level, are not specific to any one customer, record events rather than the content of any client file, are not deleted when an individual account is deleted, and are retained for as long as they remain necessary for security monitoring, incident investigation and forensic purposes. Retention of Firm Client Information is a separate matter governed by the firm's agreement with us and is not the same period as the account rule above. Support conversations in our live chat channel are not deleted automatically when an account is closed. At a firm’s written request we delete the contact record of an identified user, together with the support conversation history associated with that contact record, unless the law requires us to keep them.

6.4 Security incidents. Where a breach of our security safeguards involving personal information under our control creates a real risk of significant harm to an individual, we report it to the Privacy Commissioner of Canada and notify the affected individuals as soon as feasible, as the law requires. Where an incident affects Firm Client Information, we notify the Subscribing Firm without undue delay and, where reasonably practicable, within seventy-two (72) hours after we confirm that the incident has occurred, and it is the firm that determines whether any regulatory report or individual notification is required for its own client information.

7. Your Rights and Your Choices

7.1 Access and correction. On written request we will tell you what personal information about you we hold, how we have used it and to whom we have disclosed it, and give you access to it, subject to the limited exceptions the law permits, for example where disclosure would reveal another individual's personal information or breach privilege. We respond within thirty (30) days, or tell you within that period that we need an extension permitted by law. If information we hold is inaccurate we will correct it. Requests about Firm Client Information go to the Subscribing Firm, for the reason in section 2.4.

7.2 Marketing messages. We send commercial electronic messages only where we have your consent or are otherwise permitted by law, and every one carries an unsubscribe link. You can also unsubscribe by writing to [email protected]. Service messages about your account, such as security alerts and billing notices, are not marketing and continue while you hold an account.

7.3 Cookies and the marketing website. We use cookies to keep you signed in, remember your preferences and language, maintain session security and understand which features are used. Most browsers accept cookies by default and you can set yours to refuse them, though parts of the websites and platform will not work without the cookies necessary to operate them. We do not use analytics, advertising, session-recording or similar tracking technologies inside the CaseEasy 360 platform or on any client-facing site or portal. We use them only on our public marketing website, where the tools are Google Analytics, Cloudflare Web Analytics, Meta (Facebook) Analytics and LinkedIn Analytics. Some of these collect online identifiers and some may use what they collect for their own purposes. Each offers its own opt-out, and declining them affects the marketing website only.

7.4 Minors. Our websites and platform are business tools for legal professionals and are not directed to children, and we do not knowingly collect personal information directly from children for our own purposes. A firm's client files may contain information about minors, because immigration matters frequently involve children and dependants. That is Firm Client Information, collected by the firm under the firm's authority, and section 2 applies.

8. Changes, Questions and Complaints

8.1 Changes. We may change this Policy. The current version is always posted at caseeasy.ca and shows the date it was last updated, and we will give notice before a change that materially affects how we handle personal information takes effect. A change to this Policy does not vary any enterprise agreement.

8.2 Questions and complaints. Contact our Privacy Officer at [email protected]. We will acknowledge your concern, investigate it and tell you the outcome. If you are not satisfied, you may complain to the Office of the Privacy Commissioner of Canada, 30 Victoria Street, Gatineau, Quebec K1A 1H3, or through priv.gc.ca, and depending on where you live a provincial privacy regulator may also be able to help. If you are a client of a Subscribing Firm, please raise your concern with that firm first.

Last Updated: August 17, 2026