Privacy policy

1. Introduction

Aurus Légal inc. is committed to protecting the privacy and personal information of its users. We comply with Quebec's Law 25 and Canada's PIPEDA.

2. What we collect

We collect the following information to operate the platform:

• First and last name and professional contact details (email, phone)
• Login information (email address, encrypted OAuth tokens)
• Billing and legal accounting data
• Activity logs and usage data
• IP address and device information (for account security)

3. How we use your data

Your data is used to:

• Provide and improve our legal management services
• Authenticate users and secure accounts
• Send invoices and emails on behalf of your law firm
• Generate compliance reports for the Barreau du Québec
• Ensure security and prevent unauthorized access

4. Hosting and security

All data is hosted in Canada. Sensitive data is encrypted at rest (AES-256) and in transit (TLS 1.3). OAuth tokens are encrypted before being stored. Our servers are SOC 2 Type II compliant.

5. Data sharing

We do not sell, rent, or share your personal information. The only exceptions:

• With your explicit consent
• To comply with a legal obligation
• With our service providers (hosting, email) who are bound by confidentiality agreements

6. Google and Microsoft integrations

With your authorization, Aurus connects to your Google (Gmail, Calendar) or Microsoft (Outlook) account to display your mailbox and calendar directly in the dashboard — a mirror of your emails and calendar, in the same place as the rest of your tools. From within Aurus you can perform the same actions as in Gmail: read, send, reply, forward, organize (folders and labels, mark as read, move) and delete your emails, reuse your signature, as well as view, create and delete events in your calendar. This access is used only to provide these features, at your request.

Only the owner of the email account can act on their own mailbox: send, modify, delete or forward their emails. No one else — neither another member of the firm, nor Aurus — can perform these actions on their behalf. Each user only accesses their own connected mailbox.

Limited Use: Aurus's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. This data is never sold, never used for advertising, and no humans can access it except with your explicit consent or when required by law or for security.

7. Data retention

Accounting and billing data is retained for a minimum of 7 years, as required by the Barreau du Québec and the revenue agency. Security logs are retained for 12 months.

8. Your rights

You have the right to:

• Access your personal information
• Request the correction of inaccurate information
• Request the deletion of your data (subject to legal obligations)
• Withdraw your consent at any time
• File a complaint with the Commission d'accès à l'information du Québec

9. Contact

For any question or to exercise your rights:

Aurus Légal inc.
Email: confidentialite@auruslegal.ca

10. Changes

We may amend this policy at any time. Changes will be posted on this page. If a change is significant, we will notify you by email.