Privacy Policy

Last updated: July 22, 2026

This Privacy Policy explains how CanLegal (operated by CQL.ca) collects, uses, and protects personal information when you use the canlegalbench.com website. We are committed to complying with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and the Canadian Anti-Spam Legislation (CASL).

What we collect

When you submit your email address through our “Notify me at release” form, we collect:

• Email address — stored as a one-way cryptographic hash (SHA-256). We do not store your email in readable plaintext. This means that even in the event of a data breach, your email address cannot be read or reconstructed from our records.
• Name (optional) — if you choose to provide it, we store your name so we can personalize the one-time release notification. It is stored in cleartext alongside the email hash. Providing a name is entirely optional and not required to join the list.
• IP address — collected automatically for rate-limiting and abuse prevention. This is not used to identify you personally and is not shared with third parties.
• Timestamp — the date and time of your submission, used solely for record-keeping.

We do not collect your location, browsing history, or any other personal information through this website.

Why we collect it

The sole purpose of collecting your email is to notify you when the CanLegal benchmark is publicly released. This constitutes a single, identifiable communication directly related to your expressed interest, consistent with CASL's exception for existing business relationships and express consent.

Consent

By submitting your email address, you provide express consentto receive a single notification email from us regarding the CanLegal release. You are not subscribing to a newsletter or recurring marketing communications. We will contact you at most a small number of times in connection with the release.

How we store it

Your email hash, optional name, and associated metadata are stored in an append-only data file on our own infrastructure. Access is restricted to authorized personnel and protected by standard filesystem permissions and encrypted connections (HTTPS/TLS). We do not use any third-party cloud database service to store your information.

Data retention

We retain your email hash, optional name, and the associated metadata (timestamp and IP address) for a maximum of 18 months from the date of submission. The IP address is retained for the same period to support abuse-prevention forensics if needed; it is not used to identify you personally. After this period, the record is automatically and permanently deleted. If you unsubscribe before then (see below), your record is deleted within 30 days.

Unsubscribe

You may withdraw your consent and have your email hash deleted at any time. Every notification email we send includes a one-click unsubscribe link. Alternatively, you can email [email protected] with the subject line “Unsubscribe,” and we will remove your record within 30 days. There is no penalty for unsubscribing.

Third parties

We do not sell, rent, or share your email address or any personal information with third parties. Your email hash and associated metadata are stored in a self-hosted data file on our own infrastructure — we do not use any third-party cloud database service to store your information.

Cookies and analytics

This website does not use tracking cookies. We do not embed third-party analytics or advertising trackers.

Your rights under PIPEDA

Under PIPEDA, you have the right to:

• Know what personal information we hold about you;
• Access your personal information;
• Challenge the accuracy and completeness of your information; and
• Withdraw consent for the collection, use, or disclosure of your information.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

Security

We take reasonable measures to protect your information, including storing email addresses only as one-way hashes, using encrypted connections (HTTPS/TLS), and restricting database access. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Children's privacy

This website is not directed to individuals under the age of 18, and we do not knowingly collect email addresses from minors. If you believe a minor has submitted an email, please contact us and we will delete it.

Changes to this policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated revision date. Continued use of the website after changes constitutes acceptance of the revised policy.

Contact

If you have questions about this Privacy Policy or your personal information, contact us at [email protected].