Legal
Privacy Policy
Last updated: June 18, 2026
1. Who We Are
FairFirm.org is an AI-powered document analysis platform. We help individuals understand the legal documents they sign by identifying clauses that deviate from market norms and explaining them in plain English.
FairFirm.org is operated by Mark Krawczyk, who serves as the accountable operator and data controller under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), SC 2000, c 5, and Alberta's Personal Information Protection Act (PIPA), SA 2003, c P-6.5. All data handling obligations under this Privacy Policy are obligations of the operator in that capacity.
The platform is operated from Alberta, Canada. The platform is subject to a planned and documented internal ownership transition. This transition does not affect the continuity of any user's service, the handling of any user's personal data, or any user's rights or remedies under this Privacy Policy.
Privacy inquiries may be directed to: admin@fairfirm.org.
2. Information We Collect
FairFirm collects the following categories of personal information:
(a) Account Information
When you create an account, we collect your email address, full name, and plan type. This information is required to provide the service.
(b) Document Data
When you upload a document, we collect the uploaded file, extracted text (retained temporarily per your tier's retention rules), a SHA-256 document hash (retained permanently for duplicate detection), and file metadata (filename, file type, file size, page count).
(c) Audit Data
We retain audit results generated for your uploaded documents, including Fairness Scores, identified flags, summaries, and AI output. Audit results are retained for the life of your account.
(d) Payment Data
All payment processing is handled by Stripe. FairFirm never stores your full payment card number, CVC, or bank account details. FairFirm stores only your Stripe customer ID, subscription status, and plan information. For full details on how Stripe handles your payment data, see Stripe's privacy policy.
(e) Usage Data
We collect data about your use of the platform, including scan counts, feature usage patterns, and session activity. This data is used to enforce tier limits, improve the platform, and generate anonymized aggregate metrics.
(f) Communications
If you contact us by email at admin@fairfirm.org, we retain the content of that communication for as long as reasonably necessary to resolve your inquiry.
(g) Enterprise Inquiry Data
If you submit an enterprise inquiry form, we collect the information you provide (firm name, representative name, role, email, phone, firm size, use case, and notes). This information is used for sales purposes only and is retained for up to 2 years, or until you request deletion.
(h) Cookies and Tracking
FairFirm uses cookies for authentication session management and user preference storage. See our Cookie Policy for full details.
3. How We Use Your Information
FairFirm uses your personal information for the following purposes:
- To provide, maintain, and improve the platform and its features
- To process payments via Stripe and manage your subscription
- To enforce scan limits and tier access controls applicable to your plan
- To calculate and display anonymized aggregate platform metrics (e.g., total scans performed, total red flags found, total donated). These metrics never identify individual users.
- To trigger charitable donations based on paid scan count aggregates — no individual identification is involved
- To send transactional emails related to your account and billing (e.g., payment receipts, cancellation confirmations, security alerts)
- To respond to support requests and legal notices sent to admin@fairfirm.org
What FairFirm does not do:
- We do not use your document contents to train AI models without your explicit opt-in consent. See Section 12 for how anonymized aggregate patterns from audits are used for platform improvement.
- We do not sell your personal data to any third party, ever.
- We do not share your personal data with advertisers or for marketing purposes.
- We do not use your data for any purpose not listed in this policy.
4. Legal Bases for Processing (GDPR)
For users in the European Economic Area or other jurisdictions where GDPR or equivalent legislation applies, FairFirm processes your personal information on the following legal bases:
- Contract performance: Processing necessary to provide the service you have subscribed to, including account management, document processing, audit generation, and payment handling.
- Legitimate interests: Processing for platform security, fraud prevention, duplicate detection (document hashing), and platform improvement through anonymized aggregate analysis.
- Legal obligation: Processing required to comply with applicable law, including tax record retention (7 years under Alberta requirements) and responding to lawful law enforcement requests.
- Consent: Processing for optional features where you have provided explicit consent, including opt-in AI training participation (if you choose to enable it) and marketing emails (where applicable).
5. Data Retention
FairFirm retains your personal information for the following periods:
| Data Type | Retention Period |
|---|---|
| Free/Credits tier uploaded documents | Deleted within 24 hours of scan completion |
| Extracted document text (Free/Credits) | Nulled immediately after audit completes |
| Document hash (SHA-256) | Retained indefinitely for duplicate detection only |
| Retained documents (paid tiers) | Duration of active subscription + 30 days after cancellation |
| Audit results | Retained while account is active; deleted on account deletion |
| Account data (email, name, plan) | Duration of account + 90 days after deletion request |
| Payment records | 7 years for tax and accounting compliance (Alberta requirement) |
| Enterprise inquiry data | 2 years or until deletion requested |
| Chat session data | Same ZDR rules as documents per your tier |
6. Data Sharing
FairFirm shares your personal information only with the following categories of recipients, only as necessary to provide the service:
- Supabase:FairFirm's database and file storage provider. All user data and documents are stored on Supabase infrastructure. A data processing agreement is in place with Supabase governing their handling of FairFirm user data.
- Stripe:FairFirm's payment processor. Stripe is PCI-DSS compliant. Payment card data never passes through FairFirm's servers.
- Google Workspace: Used for operational email at admin@fairfirm.org. No user data beyond email communications is processed by Google Workspace.
- Vercel:FairFirm's hosting and deployment provider. Vercel hosts the FairFirm application but does not process user document content.
- AI providers (Anthropic, Google): Document content is sent to AI providers for analysis when you initiate a scan. FairFirm does not authorize these providers to use FairFirm user data for their own model training. Data is processed under their standard API terms. FairFirm uses Claude (Anthropic) for pre-screening and deep-scan analysis, and Gemini (Google) for standard scans.
- Law enforcement and regulatory authorities: FairFirm will disclose personal information to law enforcement only when legally required to do so (e.g., in response to a valid court order or legal process). Where legally permitted, FairFirm will attempt to notify you before disclosing your personal information.
FairFirm does not share your personal information with any other third party for any purpose. FairFirm does not sell personal data.
7. Zero Data Retention Policy
Zero Data Retention — FairFirm's Core Privacy Commitment
Zero Data Retention (ZDR) is a foundational privacy commitment at FairFirm. Here is exactly what it means in practice:
What gets deleted, and when:Documents uploaded by Scout (free) and Credits tier users are permanently deleted from FairFirm's Supabase Storage within 24 hours of the scan completing. An automated cron job runs hourly to enforce this deletion. The extracted text from those documents — the raw text pulled from your PDF or Word file during processing — is set to null immediately after the audit result is generated. After that point, FairFirm retains only the audit result (the scores and flags), not the original text.
What is retained and why: The document hash — a one-way SHA-256 cryptographic fingerprint — is retained indefinitely. This hash is used solely to detect if you (or another user) re-uploads the same document, so we can return a cached audit result at no additional charge rather than re-running the AI analysis. The hash cannot be reversed to recover your original document. It contains no readable content.
Paid tier storage:Peace of Mind and Guardian tier users have their documents retained in an encrypted Vault for the duration of their active subscription, up to their plan's storage limit. You can delete any document from the Vault at any time. Deletion is permanent and immediate — the file is removed from Supabase Storage and cannot be recovered.
What ZDR means for your privacy:Your sensitive documents — leases, employment contracts, medical bills — are not sitting on FairFirm's servers indefinitely if you're on the free or credits tier. The moment your audit is done, the document is gone. This is a deliberate trust-building choice, not a legal minimum.
8. Your Rights
Under PIPEDA, Alberta PIPA, and GDPR (as applicable), you have the following rights regarding your personal information:
- Right to access: You have the right to request a copy of the personal information FairFirm holds about you.
- Right to correction: You have the right to request that inaccurate or incomplete personal information be corrected.
- Right to erasure:You have the right to request deletion of your account and all associated personal information. This right is subject to FairFirm's legal obligation to retain certain records (e.g., payment records retained 7 years for tax compliance). Audit results and document data will be deleted; payment records will be retained only as required by law.
- Right to portability: You have the right to receive the personal information you have provided to FairFirm in a structured, commonly used, machine-readable format.
- Right to withdraw consent: Where FairFirm processes your personal information on the basis of consent (e.g., platform improvement data extraction, marketing emails), you may withdraw that consent at any time without affecting the lawfulness of processing before withdrawal.
- Right to object: Where FairFirm processes your personal information on the basis of legitimate interests, you have the right to object to that processing. FairFirm will cease that processing unless it has compelling legitimate grounds that override your interests.
How to exercise your rights: Email admin@fairfirm.org with your request. FairFirm will respond within 30 days. Most requests can be fulfilled through the account settings (delete account, download data) without needing to contact us.
Right to complain:If you are not satisfied with FairFirm's response to your privacy concern, you have the right to lodge a complaint with:
- The Office of the Privacy Commissioner of Canada: priv.gc.ca
- The Office of the Information and Privacy Commissioner of Alberta: oipc.ab.ca
9. Security
FairFirm implements the following security measures to protect your personal information:
- Supabase Row Level Security (RLS) on all user-facing database tables — your data is only accessible to you and to FairFirm's server-side processes
- All data transmitted between your device and FairFirm's servers is encrypted using TLS (Transport Layer Security)
- Data at rest is encrypted by Supabase's storage infrastructure
- No FairFirm employee accesses your document content — document processing is fully automated and handled by AI systems
- Authentication is managed by Supabase Auth with industry-standard session management
Security incidents: In the event of a confirmed security breach involving your personal information, FairFirm will notify affected users within 72 hours of becoming aware of the breach, as required by PIPEDA. The notification will describe the nature of the breach, the information affected, the steps FairFirm has taken to address it, and the steps you can take to protect yourself.
No security system is impenetrable. FairFirm cannot guarantee the absolute security of your personal information against all possible threats. We encourage you to use a strong, unique password for your FairFirm account.
10. International Transfers
FairFirm is operated from Alberta, Canada. Your personal information is stored on Supabase infrastructure, which uses servers located in the United States. By creating a FairFirm account and using the platform, you consent to the transfer of your personal information to servers located outside Canada.
Supabase maintains appropriate technical and organizational safeguards for the protection of personal information transferred internationally. For users in the European Economic Area, transfers of personal data to the United States rely on Standard Contractual Clauses (SCCs) or other appropriate transfer mechanisms where applicable.
When your document content is sent to AI providers (Anthropic, Google) for analysis, that data is processed on those providers' infrastructure, which is primarily located in the United States.
11. Children's Privacy
The FairFirm platform is not directed at children under the age of 13. FairFirm does not knowingly collect personal information from children under 13. If FairFirm becomes aware that it has collected personal information from a child under 13 without parental consent, that information will be deleted immediately.
Users between the ages of 13 and 17 may use the platform only with the express consent of a parent or legal guardian. By permitting a minor to create an account, the parent or guardian consents to the collection and use of the minor's personal information as described in this Privacy Policy.
If you believe FairFirm has inadvertently collected personal information from a child under 13, please contact us immediately at admin@fairfirm.org.
12. Data Used to Improve the Platform
Platform Learning — Opt-Out Available
FairFirm uses anonymized, aggregated intelligence derived from completed audits to improve the accuracy of its AI systems, refine its Fairness Score methodology, and publish statistical research about contract fairness. By creating an account and using FairFirm, you consent to this use. You may withdraw this consent at any time by emailing admin@fairfirm.org with the subject line “Opt Out — Platform Learning.”
What this process does involve:extracting normalized, anonymized descriptions of clause patterns identified in your audit. For example: “unrestricted landlord entry clause with no notice requirement — seen in 47 comparable residential leases.” These descriptions contain no verbatim text from your document, no personal information, and no data that could identify you or your document.
What this process does not involve: sharing your document contents with any third party; publishing your clause excerpts or audit results in identifiable form; using your personal information in any AI training dataset; selling your data; or associating your identity with any published statistic or research output.
Opt-out effect: Withdrawing consent stops future extraction from your audits. It does not delete pattern data already extracted, because extracted patterns are fully anonymized aggregate data — they contain no personal information, cannot be re-identified as yours, and cannot be individually deleted from an aggregate dataset without destroying the integrity of the dataset as a whole. This limitation is disclosed in advance and is a condition of using the platform. If you do not accept this limitation, do not use FairFirm.
13. Changes to This Policy
FairFirm may update this Privacy Policy at any time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes to this policy, we will notify you by email to your registered address. Your continued use of the platform after receiving notice of changes constitutes your acceptance of the updated policy.
14. Contact
For privacy inquiries, data access requests, correction requests, erasure requests, or complaints, contact:
Email: admin@fairfirm.org
You also have the right to escalate a complaint to:
- Office of the Privacy Commissioner of Canada — priv.gc.ca
- Office of the Information and Privacy Commissioner of Alberta — oipc.ab.ca
Also read: Terms of Service | Cookie Policy
FairFirm is operated by Mark Krawczyk as accountable operator under PIPEDA and Alberta PIPA. Operated from Alberta, Canada.