Legal

Privacy Policy

Status: Draft — pending legal review
Effective date: [ effective date ]
Applies to: northledger.claims and our intake process
Governing framework: PIPEDA and applicable provincial law

The short version

We collect only what an investigation actually needs, and we tell you why.
We never ask for seed phrases, private keys, passwords or 2FA codes, and we do not want them.
We do not sell personal information, and we do not use your case as marketing material.
We share your information with a partner only where it is needed to progress your case, and we tell you first.
You can ask us what we hold about you, ask us to correct it, and ask us to delete it.

This summary is provided for readability. The numbered sections below are the operative text.

01Who this policy covers

This policy explains how [ legal entity name ], operating as NorthLedger (“NorthLedger”, “we”, “us”), handles personal information. It applies to visitors to our website, people who submit a free case assessment, and clients who engage us for paid work.

We handle personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and any provincial privacy legislation that applies to us, including Quebec's Law 25 and the personal information protection statutes of Alberta and British Columbia where relevant.

For counsel: confirm which statutes actually apply based on the province of incorporation, where clients are located, and whether any provincial private-sector law displaces PIPEDA for our activities. Confirm whether a designated Privacy Officer must be named publicly.

02What we collect

We collect the information you choose to give us, and a limited amount of technical information generated when you visit the site.

Intake details: Your name, case type, email address, network, approximate amount lost or affected, transaction hash, the public wallet address or exchange account involved, approximate date, and what evidence you hold.
Your account of events: The free-text description you provide of what happened, including how you were contacted and what you have already tried.
Evidence you send us: Screenshots, chat logs, exchange statements, support tickets, and police or Canadian Anti-Fraud Centre report references, where you choose to provide them.
Correspondence: Emails and messages between you and us, and our notes about your case.
Public blockchain data: Transaction and address records that are already public on the relevant blockchain. This is not information we obtain from you, but it may become associated with you in our case file.
Billing information: Where you engage us for paid work, the details needed to invoice and take payment. [ confirm what the payment processor stores vs. what we store ]

You do not have to complete every field in the assessment form. Five fields are required; the rest are optional and a case is not disqualified by a gap.

03What we will never ask for

We will never ask you for, and you should never send us:

Your seed phrase, recovery phrase, or mnemonic.
Any private key, including keystore files and extended private keys.
Exchange, wallet, or email passwords.
Two-factor authentication codes or 2FA backup codes.

Nothing in our process requires them. Anyone who asks you for these can take your funds, including anyone claiming to be from NorthLedger. Our intake form screens for text that looks like a recovery phrase or private key and refuses to submit while it is present. The same check runs again on our server, so a submission carrying one is rejected outright rather than stored.

If you send us this information anyway, by any channel, we will not use it. We will tell you what happened, delete it from our systems as soon as we reasonably can, and advise you to move your funds to a newly generated wallet.

04Why we collect it

We collect personal information for these purposes and no others:

To carry out the free triage: to check whether the transaction exists on-chain, identify the first destination and any obvious service exposure, and score urgency, evidence quality and the likely recovery pathway.
To qualify a case and prepare a scope and quote for paid work.
To carry out paid investigation work and produce a forensic report and evidence bundle.
To coordinate escalation with an exchange, a licensed private investigator, or legal counsel, where you have asked us to and where it is appropriate.
To communicate with you about your case.
To invoice you and keep the business records we are required by law to keep.
To meet a legal, regulatory, or court obligation that applies to us.

We do not use your personal information for advertising, and we do not sell, rent, or trade it.

05Consent and withdrawal

By submitting the assessment form you consent to us collecting and using the information in it for the purposes set out in section 4. Where we later need to use your information for something outside those purposes, we will ask you first.

You can withdraw your consent at any time by contacting us. Withdrawal takes effect going forward. If you withdraw consent while work is in progress, we may be unable to continue that work, and we will tell you plainly what the consequences are before you decide.

Some information must be retained even after consent is withdrawn, where we are legally required to keep it. Section 8 explains this.

06Who we share it with

We share personal information only where it is necessary, and only with the following categories of recipient:

Licensed Canadian partners: Legal counsel, licensed private investigators, or other regulated professionals, where your case requires work we are not licensed to perform. We tell you who this is and obtain your agreement before we share anything.
Exchanges and hosted services: Where you ask us to escalate to a service that may hold or have received the funds, and only the information that escalation requires.
Law enforcement: Where you ask us to support a report you are making, or where we are compelled by a valid legal order. We will tell you if we receive such an order unless we are prohibited from doing so.
Service providers: Providers who host our systems or process payments on our behalf, bound by contract to protect the information and use it only for the services they supply to us. [ list actual processors once selected ]

We do not disclose your case details to anyone else. We do not publish case studies, testimonials, or examples drawn from your matter, whether identified or anonymised, unless you have given separate written permission.

07Storage and cross-border transfer

Personal information we hold is stored [ specify storage location(s) ]. Where a service provider stores or processes information outside Canada, that information may be accessible to the courts, law enforcement, and national security authorities of the country in question.

We will identify below any provider that holds personal information outside Canada, and the country involved:

To complete before publishing: [ list each processor, what it holds, and the country ]. PIPEDA requires that individuals be notified that their information may be processed in a foreign jurisdiction and may be accessible to that jurisdiction's authorities. Quebec's Law 25 imposes a further privacy impact assessment requirement for transfers outside Quebec — confirm applicability.

08How long we keep it

We keep personal information only as long as we need it for the purpose it was collected for, or as long as the law requires.

Assessments that do not proceed: [ retention period ] from the date we give you our triage answer, after which the file is deleted.
Engaged case files: [ retention period ] from the close of the matter, so that the file can support any later escalation or proceeding.
Financial and tax records: Retained for the period required by Canadian tax law. [ confirm period with accountant ]

When a retention period ends we delete the information or irreversibly anonymise it.

09How we protect it

We apply safeguards appropriate to the sensitivity of the information, including access controls limiting case files to the people working on the matter, encryption of data in transit, and encryption of data at rest where our providers support it.

No system is perfectly secure, and we do not claim otherwise. If a breach of security safeguards occurs that creates a real risk of significant harm to you, we will notify you and the Office of the Privacy Commissioner of Canada as PIPEDA requires, and we will keep a record of the breach.

To complete before publishing: describe the actual safeguards in place once infrastructure is chosen. Do not describe controls that are not implemented. [ security measures ]

10This website

The statements in this section describe the website as currently built.

No cookies. This site sets no cookies of its own.
No analytics or tracking. There is no analytics package, tag manager, advertising pixel, session recorder, or third-party tracking script on this site.
No third-party requests at all. Every asset on this site, including the typefaces, is served from our own domain. Your browser contacts no one but us when you load a page, so your IP address is not disclosed to any third party. The typefaces are IBM Plex, used under the SIL Open Font License.
The assessment form. When you press submit, the form sends what you typed directly to our intake service over an encrypted connection, and it is stored against a case reference. If that service cannot be reached, the form instead assembles a summary in your browser and opens it in your own email client, in which case nothing reaches us until you choose to send it.
Server logs and abuse prevention. Our web host may record standard request logs, including IP address, time, and pages requested. Separately, when you submit the assessment form we store a one-way cryptographic hash of your IP address, never the address itself, purely to limit how many submissions can come from one connection in an hour. The hash cannot be reversed and is used for nothing else. [ confirm host log retention ]

Keep this section true. The statements above are the reason the homepage can claim privacy by design without a caveat. If analytics, embedded media, a CDN, or a hosted form service is ever added, each one creates a third-party request and this section, section 5, and section 7 must be updated in the same change, with a consent mechanism considered.

11Access and correction

You have the right to ask us:

whether we hold personal information about you, and to be given access to it;
how it has been used and to whom it has been disclosed;
to correct it if it is inaccurate or incomplete;
to delete it, subject to any legal retention obligation.

Write to us at the address in section 15. We will respond within [ response period ] days. There is no charge for a routine request. We may need to verify your identity before releasing information, and we may have to withhold material that would reveal personal information about another person.

12Complaints

If you are unhappy with how we have handled your personal information, tell us first and we will investigate. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada, or to your provincial privacy regulator where one has jurisdiction.

To complete before publishing: insert the correct current contact route for the Office of the Privacy Commissioner of Canada, and for the applicable provincial regulator. Verify the address and telephone number at the time of publication rather than relying on this draft.

13Children

Our services are intended for adults. We do not knowingly collect personal information from anyone under the age of majority in their province of residence. If you believe a minor has submitted information to us, contact us and we will delete it.

14Changes to this policy

We may update this policy as our practices change. The effective date at the top of this page shows when the current version took effect. Where a change materially affects how we handle information we already hold, we will contact affected clients directly rather than relying on this page alone.

15How to contact us

For any privacy question, access request, or complaint:

Privacy contact: [ name or role of privacy officer ]
Email: [ privacy@ address ]
Postal address: [ registered business address ]
Legal entity: [ legal entity name and business number ]