Privacy Policy
Last Updated: April 9, 2026 | Effective: April 9, 2026
Welcome to L'Avocat (https://lavocat.ca), a legal justice platform operated by GoSiteMe from Quebec, Canada. This Privacy Policy describes how we collect, use, retain, protect, and disclose your personal information when you use our justice platform, including class action services, legal research, messaging, document management, the People's Journal, and all related services (collectively, the "Services").
SENSITIVE DATA NOTICE
L'Avocat processes highly sensitive legal data including testimonies, evidence, court documents, solicitor-client communications, and information relating to detention conditions. We apply enhanced protection measures to these categories of data.
1. Information We Collect
1.1 Information You Provide
- Registration: Name, email address, password (hashed), language preference, role (member, lawyer, administrator).
- Lawyer Profile: Bar association number, firm name, specializations, jurisdictions, biography, credentials, professional photo.
- Class Action Membership: Full name, address, phone number, identification number, detention facility information, incarceration period, description of conditions experienced.
- Testimonies: Written accounts describing detention conditions, dates, locations, witness names.
- Documents: Supporting evidence, photographic proof, official correspondence, court filings uploaded to the platform.
- Messages: Communications between members and lawyers related to case files.
- People's Journal: Articles, official acts, and reactions published to the gazette.
- Contact Form: Name, email, subject, and message content.
1.2 Information Collected Automatically
- Session Data: IP address, browser type, operating system, pages visited, timestamps.
- Session Cookies: PHP session identifier to maintain your login state (no third-party tracking cookies).
- Security Logging: Login attempts, administrative actions, and document modifications for audit purposes.
1.3 Information from Third Parties
- Google Authentication: If you log in via Google OAuth, we receive your name, email address, and profile photo. We never receive your Google password.
- Barreau du Québec: We may verify a lawyer's standing through the Barreau's public databases.
- CanLII: Legal research queries are proxied through the CanLII/Lexum API. Your search terms are transmitted to CanLII for results.
- Stripe: Payments are processed by Stripe. We never store your credit card number. Stripe provides us with a customer identifier and transaction status.
2. How We Use Your Information
We use your information for the following purposes:
- Administer your account and provide the Services.
- Facilitate the class action, including lawyer assignment, case tracking, and evidence management.
- Enable secure communications between members and lawyers.
- Verify lawyer identity and credentials.
- Process payments (subscriptions, SOS Life packages).
- Publish and manage the People's Journal.
- Send notifications about your cases, document reviews, and platform updates.
- Maintain platform security, detect fraud, and prevent abuse.
- Comply with legal obligations and respond to court orders.
What We Do NOT Do:
• We never sell your personal information.
• We use no third-party tracking cookies or advertising analytics.
• We share no data for third-party direct marketing purposes.
• We do not profile users for commercial purposes.
3. Privileged Communications (Solicitor-Client Privilege)
ENHANCED PROTECTION
Communications between lawyers and clients on the platform are protected by solicitor-client privilege under Quebec and Canadian law. These communications are never shared, disclosed, or exploited by L'Avocat or GoSiteMe, except pursuant to an express court order.
- Messages between a lawyer and their assigned client are encrypted in transit (TLS) and stored in a secured database with restricted access.
- Only the lawyer, the client, and the judicial administrator (Commander) can access these messages for case management purposes.
- Documents marked as "confidential — solicitor-client privilege" receive additional access protection.
- GoSiteMe technical staff do not have access to the content of privileged messages, except for database maintenance operations with read-only access, in strict compliance with professional secrecy obligations.
4. Data Retention
| Data Type | Retention Period |
|---|
| User Account | Until account deletion or 3 years of inactivity |
| Class Action Data | Duration of litigation + 10 years after final judgment |
| Testimonies & Evidence | Permanent (judicial archive) |
| Solicitor-Client Communications | Duration of mandate + 7 years (Barreau du Québec) |
| Uploaded Documents | Until deleted by owner or end of case + 7 years |
| People's Journal (Official Acts) | Permanent (public archive) |
| Financial Transactions | 7 years (Canadian tax requirements) |
| Session/Security Logs | Rolling 12 months |
| Contact Form Submissions | 24 months or until resolved |
5. Sharing & Disclosure
We never sell, rent, or trade your personal information. We may share it only with:
- Your Assigned Lawyer: Case-related data within the scope of the legal mandate.
- Arsenault Dufresne Wee Avocats: Lead counsel for the class action — relevant data for case 500-06-001298-245 is shared pursuant to the collective mandate.
- Payment Processors: Stripe receives data necessary to process transactions.
- CanLII/Lexum: Legal research search terms are transmitted to obtain results.
- Judicial Authorities: By court order only, in accordance with applicable law.
- GoSiteMe: Technical hosting and platform infrastructure.
6. Security
- TLS encryption in transit for all communications.
- Passwords hashed with resistant algorithms (bcrypt/argon2).
- CSRF protection on all forms.
- Secure sessions with unique tokens and automatic expiration.
- Role-based data access (member, lawyer, administrator).
- Sensitive document storage in private directories outside the public web root.
- Access and modification logging for audit purposes.
- Regular encrypted backups.
- Hosted in Canada (Quebec) on a dedicated OVH server.
7. Your Rights
7.1 Quebec Law 25
As a Quebec resident, you have the right to:
- Access personal information we hold about you.
- Request rectification of inaccurate or incomplete information.
- Withdraw your consent (subject to legal and contractual obligations).
- Be informed about automated decision-making and profiling.
- Obtain data portability in a commonly used format.
- Request de-indexation (removal from public-facing systems and search engines).
- File a complaint with the Commission d'accès à l'information du Québec (CAI).
7.2 PIPEDA (Canadian Residents)
- Right to access personal information held by us.
- Right to challenge the accuracy and completeness of your data.
- Right to withdraw consent (subject to legal and contractual restrictions).
- Right to complain to the Office of the Privacy Commissioner of Canada.
7.3 GDPR (EEA, UK, Switzerland Residents)
- Rights of restriction, objection, and data portability.
- Right not to be subject to automated decisions with legal effects.
- Right to withdraw consent at any time.
- Right to lodge a complaint with your data protection authority.
7.4 Exercising Your Rights
Submit requests to privacy@lavocat.ca. We will respond within 30 days (or sooner if required by law). We may verify your identity before processing your request.
Limits on Deletion: Certain data connected to the class action cannot be deleted during the litigation, as it constitutes judicial evidence. You may, however, request account deletion and data disassociation from the case file, subject to court approval.
8. Artificial Intelligence (Alfred)
- Alfred, our AI assistant, may process your questions and assist with legal research.
- AI queries are sent to third-party providers (Anthropic, OpenAI, Groq) for response generation. These providers do not retain your data beyond query processing.
- Alfred is not a lawyer. Its responses do not constitute legal advice.
- Conversations with Alfred may be logged for service improvement. No personally identifiable data is shared with AI providers.
9. Cookies
We use only strictly necessary cookies:
- PHPSESSID: PHP session cookie to maintain your login. Expires when the browser is closed.
- lavocat_lang: Language preference (fr/en). Expires after 1 year.
We use no tracking, advertising, or third-party analytics cookies (no Google Analytics, no Facebook Pixel, no trackers).
10. Children
The Services are not intended for persons under 18 years of age. We do not knowingly collect personal information from minors. If you believe a minor has provided information, please contact privacy@lavocat.ca so we can delete it.
11. International Transfers
Your data is primarily hosted and processed in Quebec, Canada on a dedicated OVH server. Canada has received an adequacy decision from the European Commission. For AI processing (Anthropic, OpenAI), minimal and anonymized data may be transmitted to the United States, protected by standard contractual clauses and encryption in transit.
12. Changes to This Policy
We may modify this policy at any time. Significant changes will be announced by email or platform notification at least 30 days before taking effect. Your continued use of the Services after the effective date constitutes acceptance of the changes.
13. Contact
For any questions about the protection of your personal information: