Privacy Policy

1. Who we are

Cartulary is software for analysing Ontario land registry documents, operated from Toronto, Ontario, Canada. We are governed by the Personal Information Protection and Electronic Documents Act (PIPEDA).

2. Information you give us

• Account information — your name, work email address, firm name, and (if you sign in with Google or Microsoft) the basic profile that provider returns.
• Documents you upload — parcel registers and registered instruments, together with the matter name you file them under.
• Usage records — which analyses ran, when, and their cost, so that plans can be metered and invoiced.

3. What we do not collect

We do not ask for, and you should not upload, client identification records, financial account details, trust ledgers, or any document you would not put on a registry search. Cartulary is built for the public record.

4. Personal information inside registry documents

Registered instruments are public records, but they contain personal information: names, dates of birth, addresses, signatures. When you upload one, your firm remains the party accountable to the individuals concerned. Cartulary processes that content on your instruction, as a service provider, and for no purpose of its own.

5. The tenant wall

Every document, matter, analysis and usage record is stored against your firm's identifier and is accessible only to users of your firm. Which properties your firm searches, when, and for whom never leaves your workspace.

6. The shared instrument library

Cartulary maintains a library of knowledge about public registered instruments so that the same document is not re-read across the province forever. The library is deliberately built so that it cannot disclose your activity:

• It stores no uploaded documents — only content fingerprints (hashes) and, after human verification, a transcription of the public record's own text.
• Library entries carry no firm, matter, client or filename.
• It cannot be searched, browsed, listed or enumerated by any user. It responds only when a firm uploads a document it already lawfully holds.
• Parcel registers are never shared, because a register is a record of client activity by definition.
• Single-parcel instruments remain private to the uploading firm until the subscriber base is large enough that a match is attributable to no one.

7. Artificial intelligence

Document analysis uses a third-party large language model accessed under commercial terms that prohibit training on submitted content and provide zero data retention. No model is trained on your documents. The system improves only through verified knowledge about public instruments and through rules reviewed by humans.

8. Metadata and sanitisation

Uploaded files are stripped of document metadata (author names, document-management identifiers) on ingest. Filenames, annotations, and registry purchase banners are never carried into the shared library.

9. Service providers

Cartulary runs on Cloudflare (application hosting, database, and document storage) and uses Anthropic for document analysis. Documents are stored in Cloudflare's network. We will publish and maintain a current sub-processor list before onboarding paying subscribers.

10. Retention and deletion

Your documents and analyses are retained while your account is active. You may delete a matter or your account at any time, which removes the associated documents from storage. Verified knowledge about a public instrument may remain in the library, because it contains no information about you or your client.

11. Your rights

You may request access to, correction of, or deletion of your personal information, and you may ask what the library associates with your account. Write toprivacy@cartulary.ca. You may also complain to the Office of the Privacy Commissioner of Canada.

12. Security

Access requires authentication; data is encrypted in transit and at rest by our infrastructure providers; tenant isolation is enforced at the data layer rather than by application convention. No system is perfect, and we will notify affected firms without undue delay of any breach creating a real risk of significant harm.

13. Changes

We will post changes here and, for material changes affecting subscribers, give notice by email before they take effect.