Privacy Policy

Platfirm AI Pty Ltd (Platfirm, we, us, our), an Australian company (ACN 679 859 744 / ABN 24 679 859 744) of Level 17 & 18, International Tower 3, 300 Barangaroo Avenue, Sydney NSW 2000, Australia, operates CabRank Legal (cabrank.legal). This Privacy Policy explains how we collect, use, share, retain, and disclose personal information, and what your rights are.

CabRank is a referral marketplace, AI intake and referral handoff platform. It is not a legal practice management system, case management system, billing system, trust accounting system, document management system or system of record for legal matters. Where information is passed to a law firm’s own practice management system or document store, the firm controls that information from that point on.

The Canadian platform runs on its own dedicated database in Montréal (ca-central-1), never shared with any other country. Referral, intake and client information for Canadian users is hosted in Canada by default — a choice we made deliberately for Canadian privacy law. We handle personal information consistently with the Personal Information Protection and Electronic Documents Act (PIPEDA) and, for Quebec users, with Quebec’s private-sector privacy law (Law 25).

1. Who this policy applies to

• Members of the public who interact with our intake channels (web bookings, partner-site web forms, voice AI hotlines) and become legal enquiry referrals on the CabRank platform.
• Lawyers and law-firm administrators who sign up to receive referrals through the CabRank platform.
• Website visitors who browse cabrank.legal without signing up.

2. Personal information we collect

From members of the public seeking legal help:

• Name, phone number, email address.
• Province or territory of residence; postal code.
• Area of law of the legal enquiry; a brief description of the enquiry or requested assistance.
• For paid bookings: billing information processed by Stripe (CabRank does not see or store card details).
• For voice intake calls: an audio recording and AI-generated transcript and summary of the call.

From lawyers and law-firm administrators:

• Name, work email, mobile number, firm name, business identifiers, position.
• Licensing / practising details, areas of law, preferences for receiving referrals.
• Connection credentials for handoff destinations the firm chooses: OAuth tokens for bring-your-own storage such as Google Drive, and, for firms connecting DeedBox directly, the connection key the firm issues from its own DeedBox (revocable by the firm at any time). We never see your third-party system password. For firms whose practice-management system (Clio, LEAP, Smokeball or Actionstep) connects through our Zapier integration, your practice-management login is entered by you directly with Zapier and is never visible to CabRank.
• Billing information for subscription payments processed by Stripe.

From website visitors:

• Standard server log information (IP address, browser, page requested, timestamp).
• Cookies necessary for the site to function. We do not use third-party advertising cookies.

3. Consent, and how we use your personal information

We collect, use and disclose personal information with your knowledge and consent. When you ring the hotline or complete a booking, you provide your information for the purpose of being connected with a lawyer — that is exactly, and only, what we use it for, together with the directly related purposes below.

We use personal information for the purpose for which it was collected, and for purposes that are reasonably necessary or directly related, including:

• Members of the public: to route your legal enquiry to a suitable Canadian lawyer; to process bookings; to send confirmations and follow-ups; to operate our referral matching and AI redaction; to respond to enquiries; and to support our intake-channel partners where you came in through their channel.
• Lawyers and firms: to provide the CabRank platform; to match referrals to your practice profile; to pass confirmed intake information to your connected handoff destination or bring-your-own storage where enabled; to bill your subscription; to provide support; and to send service notifications such as digests, referral alerts, account changes and security advisories.
• All users: to operate, secure, and improve the platform; to comply with legal obligations; to investigate complaints; to detect and respond to misuse.

We do not sell your personal information. We do not use your personal information to train AI models.

4. Who we share your personal information with

CabRank shares personal information with third parties only as described in this policy. The third parties fall into three categories.

Sub-processors are service providers we engage to operate the platform — hosting, payment processing, email delivery, AI summarisation, and so on. We disclose all of them, including their hosting region and what data they handle, on our Security page. Sub-processor changes are notified to firm administrators by email at least 14 days before taking effect, unless otherwise agreed.

Canadian lawyers receiving referrals. When a member of the public becomes a referral on the platform and a lawyer claims the referral, we share the relevant referral and intake information — including your name, contact details, jurisdiction and enquiry summary — with that lawyer so they can assess the enquiry and decide whether to act. AI-redacted summaries are shown before a referral is claimed, so the commercial framing of any intake call is stripped before anyone sees it.

Connected systems chosen by the firm. Once a referral is claimed and the firm chooses to proceed, confirmed intake information may be passed to the firm’s chosen handoff destination: the firm’s own DeedBox installation (connected directly), the firm’s practice-management system (Clio, LEAP, Smokeball or Actionstep, delivered via Zapier, our workflow sub-processor), or bring-your-own Google Drive. The firm is responsible for that information once it is in the firm’s own system. CabRank does not maintain the legal file of record.

Compliance and lawful requests. We may disclose personal information where required or permitted by law, including in response to a valid request from a court, regulator, or law-enforcement agency.

5. Where your information is processed

Primary hosting is in Montréal, Canada. Because Platfirm is an Australian company, limited personal information may be processed in Australia (platform administration and support), and several sub-processors are based in the United States (listed with their regions on our Security page). Information processed outside Canada is protected by contractual safeguards with each sub-processor and remains subject to this policy; it may also be subject to the laws of those jurisdictions.

6. How long we keep your personal information

We keep personal information only for as long as necessary for the purposes for which it was collected, or as required by law.

• Pre-claim referral and intake information: retained on the platform for up to 90 days from creation, after which it is deleted or anonymised unless still active.
• Claimed referral metadata: limited operational metadata such as referral ID, area of law, jurisdiction, claim event and paid status — with no client-identifying detail — is retained for audit and analytics. The legal file of record lives in the firm’s chosen system, not on CabRank’s servers.
• Professional / firm-administrator profiles: retained for the lifetime of the account, plus a reasonable archival period after account closure to comply with tax, audit, and legal obligations.
• Connection credentials (OAuth tokens and connection keys): deleted immediately when a firm disconnects the relevant integration, or within 30 days after account closure if not earlier disconnected.
• Call recordings and transcripts from voice intake: redacted summaries may be retained as part of the referral and intake record; raw recordings are retained only as long as needed for AI processing and quality assurance, typically less than 90 days.
• Server logs and analytics: retained for up to 12 months.

7. Your rights — access, correction, and deletion

You may access the personal information we hold about you, correct any inaccuracy, withdraw consent (subject to legal or contractual restrictions and reasonable notice), and request deletion, subject to any legal obligation we have to retain information.

To exercise any of these rights, contact support@platfirm.ai. We will:

• Acknowledge your request within 5 business days.
• Verify your identity before acting on the request.
• Complete a verified deletion request within 30 days.
• If we are unable to comply with all or part of your request, explain why in writing.

Where personal information has been passed to a firm’s own system or storage as part of a claimed referral, that information is under the firm’s control, not CabRank’s. We will help you contact the firm to make a separate request to them.

8. How we protect your personal information

CabRank’s data hosting, encryption, access controls, incident-response procedure, vulnerability-disclosure path, and patching SLAs are documented on our Security page. In summary:

• Each country runs on its own dedicated database, never shared with any other country.
• HTTPS-only connections, TLS 1.2 or higher.
• Encryption at rest (AES-256), encryption in transit, bcrypt password hashing.
• Row-level security at the database layer; named, least-privilege administrative access with strong authentication on the hosting, code and deployment platforms.
• Material security incidents affecting customer data are notified to affected firms within 72 hours of CabRank becoming aware.

Cookies and analytics

cabrank.legal uses cookies necessary for the site to function (such as session cookies for signed-in users). We do not use third-party advertising cookies and we do not run cross-site tracking. Server-side analytics is limited to anonymised page-view metrics required to operate and improve the platform.

Children

CabRank’s services are not directed at children under 18. We do not knowingly collect personal information from children. If you believe a child’s personal information has been provided to us, contact support@platfirm.ai and we will delete it.

Changes to this policy

We may update this Privacy Policy from time to time. The version number and last-updated date at the top of this page indicate the current version. Material changes will be notified to firm administrators by email at least 14 days before taking effect. Continued use of the platform after a change takes effect constitutes acceptance of the updated policy.

Accountability, questions and complaints

Platfirm’s privacy officer can be reached at support@platfirm.ai for any question, access request or complaint about our handling of personal information. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, in Quebec, the Commission d’accès à l’information.