Privacy Policy
Effective 2026-06-27
Mandato provides client-intake software to Canadian law and accounting firms. This policy explains what personal information we handle, why, where it is stored and processed, and the rights you have over it. It is written to meet Quebec's Act respecting the protection of personal information in the private sector (Law 25) and Canada's PIPEDA.
Who is responsible
Mandato (a sole proprietorship registered in British Columbia, Canada) is responsible for the personal information handled through its platform. Our designated person in charge of the protection of personal information (privacy officer) can be reached at george@usemandato.com.
What we collect
On behalf of the firms that use Mandato, we process the information a prospective or existing client provides when they reach out — typically their name, contact details (phone, email), the language they write in, and the content of their message describing what they need. We also keep operational records such as timestamps and the channel used (web form, WhatsApp, or email).
We do not ask clients for sensitive information, and Mandato never provides legal or accounting advice. No professional relationship is created until the firm reviews the file and acts on it.
Why we use it, and consent
We use this information only to receive, acknowledge, triage, and organize incoming inquiries for the firm, and to alert the firm to anything urgent. We do not sell personal information, and client information is never used to train AI models.
Information is collected with the knowledge and consent of the person providing it, for the purposes described above.
Where your data is stored
Client data is stored in Canada, in a database hosted in the Canadian (ca-central-1) region. While data is stored in Canada, some message content is processed by service providers located outside Quebec, as described in the next section.
How long we keep it
We retain inquiry data for as long as needed to provide the service to the firm and to meet legal obligations, after which it is deleted or anonymized. A firm may request deletion of records associated with it at any time.
Your rights
Subject to applicable law, you may request access to the personal information we hold about you, ask us to correct it, and withdraw your consent to its use. To exercise these rights, contact our privacy officer at the address above.
If you are in Quebec and are not satisfied with how we handle your request, you may file a complaint with the Commission d'accès à l'information du Québec (CAI).
Security
Personal information is encrypted in transit and at rest, and access is restricted to what is necessary to operate the service.
Changes to this policy
We may update this policy as the product evolves. The effective date above reflects the latest version. Questions? Email george@usemandato.com.
Service providers & cross-border processing
Loi 25 requires us to disclose when personal information is communicated outside Quebec. Although data is stored in Canada, the following providers process some information outside the province to deliver the service. Each is bound by its published data processing terms, which include Standard Contractual Clauses (or equivalent safeguards) for transfers outside Canada.
| Provider | Purpose | Processing region | Safeguard |
|---|---|---|---|
| Anthropic (Claude) | Generates and drafts replies and proposals from inquiry content | United States | Published data processing terms / DPA; data is not used to train models |
| Meta (WhatsApp Cloud API) | Transmits and receives WhatsApp messages between clients and the firm | United States / global | Published data processing terms with Standard Contractual Clauses |
| Resend | Sends urgency-alert emails to the firm (may include a client name and summary) | United States | Published data processing terms / DPA |
Storage of client records is provided by Supabase in the Canadian (ca-central-1) region.