Privacy Policy
This policy explains what personal information WarmLoop Ltd ("WarmLoop", "we", "us") collects through this website, the WarmLoop research and verification service, and WarmLoop Record at record.warmloop.com; why we collect it; where it is kept; and the rights you have. We handle personal information in accordance with the Personal Information Protection and Electronic Documents Act (Canada) and the applicable provincial laws. Our privacy officer is Nathan Phillips, nathan@warmloop.com.
In one paragraph. We collect what is needed to run the service for a law firm: the account holder's details, the queries and documents they submit, the readers they name, and the access records of a published document. We keep it in Canada, we do not sell it, we do not use it to train AI models, and we do not advertise. The firm that submits client material remains its custodian; we process it on the firm's instructions.
1. What we collect
Account information
Name, firm, work email address, role, and the assistant or client you connect. For a paying account, the billing contact and the invoice history; card details are entered with and held by our payment processor, Stripe, and never reach our systems.
Service use
The queries your assistant sends to the service, the responses, the tools called, timestamps, network addresses and the identity of the connecting client. We log these to operate and secure the service, to meter usage against a seat's allowances, to investigate errors you report, and to improve the corpus and the tools. Query logs are treated as the firm's confidential information.
Customer content
The documents, briefs, evidence files and reader lists you submit for verification or publication, and the published record built from them. Customer content often contains personal information about clients, witnesses and other parties; the submitting firm is the custodian of that information, and we process it only to provide the service to the firm.
Reader information (WarmLoop Record)
When a firm shares a published document, we hold the reader's email address as the firm entered it or as the reader entered it on the access page, the one-time code we send, the network address and time of each request, and an access log of which version of the document was read and when. That log is part of the record's audit trail and is available to the firm that published it.
Correspondence
Email you send us, and our replies, kept in our mailboxes.
This website
warmloop.com sets no analytics or advertising cookies. The site is served through Cloudflare, which processes standard request logs (network address, page requested, browser type) to deliver and protect the site.
2. Why we use it
- To provide the service: answer queries, verify citations, build and serve published records, locate evidence, send the emails described at warmloop.com/email, and give support.
- To keep the service secure: authenticate users and readers, enforce access controls, apply rate limits, detect abuse and investigate incidents.
- To bill for paid seats and keep the records the law requires.
- To improve the service, using usage information in aggregate or de-identified form.
- To meet legal obligations and respond to lawful requests, as described in section 4.
We do not sell personal information. We do not use customer content or query logs to train artificial-intelligence models. We do not use personal information for advertising or share it with advertisers.
3. Where it is kept
Customer content, query logs and account information are stored and processed in Canada: on WarmLoop's own servers in Saskatchewan and in Amazon Web Services' Canada (Central) region in Montreal. Published records are served from Canada. Transactional email is sent through Amazon Simple Email Service in the Canada (Central) region. Some processing steps, such as ranking search results, use machine-learning models hosted by Amazon Web Services in that same region. Our own business mailboxes are hosted by Microsoft 365. This website is delivered through Cloudflare's global network, which may serve a page to you from outside Canada; no customer content passes through it.
The assistant you connect to the service (for example Claude or ChatGPT) is provided by its own vendor under its own terms. The queries your assistant sends to WarmLoop, and the responses it receives, are handled by that vendor according to your agreement with it, not by us.
4. When we share it
- Service providers that host or support the service under contract and on our instructions: Amazon Web Services (hosting, storage, email delivery), Cloudflare (this website), Stripe (payments) and Microsoft (our mailboxes).
- The readers a firm approves, who receive the published document and the emails needed to reach it.
- The firm itself, which can see its own users' activity and the access log of its published records.
- Where the law requires: to comply with a court order, a lawful demand or a legal obligation, or to protect the rights, property or safety of WarmLoop, our customers or others. Where the request concerns a firm's customer content we will, unless legally prevented, tell the firm so that it can assert any privilege or objection.
- A successor to the business, on notice to account holders, if WarmLoop is sold or merged.
5. How long we keep it
- Account information: for the life of the account and for seven years afterwards where needed for billing and tax records.
- Usage and query logs: for up to twenty-four months, then deleted or de-identified.
- Customer content: until you delete it or your account closes, and for thirty days after closure to allow export, then deleted, subject to the exceptions in the Terms of Service. Backups are retained for up to ninety days.
- One-time codes: minutes; a code expires ten minutes after it is sent and is deleted once used or expired.
- Record access logs: for as long as the published record exists, because they are part of its audit trail.
6. How we protect it
Data is encrypted in transit and at rest. Access to systems is restricted to the people who operate the service, through individual identities, and administrative access to servers is logged. Published records are protected by an approved reader list, an emailed one-time code, a signed access session that expires on a fixed date, and, during the pilot, a network restriction. Stored documents and records are kept in versioned storage so that an alteration or deletion leaves a trace and can be reversed. We review access and incidents, and we will notify affected firms and, where the law requires, the Privacy Commissioner, of a breach that creates a real risk of significant harm.
7. Cookies and sessions
warmloop.com uses no cookies of its own. record.warmloop.com sets one signed, first-party cookie after a reader enters a valid one-time code; it grants access to that one document only, expires on a fixed date stated when the code is issued, and is not extended by a visit. write.warmloop.com sets the session cookie needed to keep an account holder signed in. None of these is used for tracking or advertising.
8. Your rights
You may ask what personal information we hold about you, ask us to correct it, or withdraw consent to our use of it, subject to legal and contractual limits; withdrawing consent may mean we can no longer provide the service to you. Write to nathan@warmloop.com. We will respond within thirty days. If you are not satisfied with our response you may complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca.
If your personal information is contained in a firm's customer content, please direct your request to that firm, which is the custodian of the information; we will assist the firm in responding.
9. Children
The service is for legal professionals and is not directed at children. We do not knowingly collect personal information from anyone under eighteen except as it appears in a firm's customer content.
10. Changes
We may update this policy. We will post the updated policy here with a new date and, for a change that materially affects how we handle personal information, notify account holders by email before it takes effect.
Contact
WarmLoop Ltd, Regina, Saskatchewan, Canada. Privacy officer: Nathan Phillips, nathan@warmloop.com. General enquiries: info@warmloop.com.