Privacy Policy

Who We Are

Surface is an AI-powered document vault built specifically for Ontario lawyers and legal professionals. Surface is operated by Surface AI Inc., a company operating in Toronto, Ontario, Canada.

We are committed to protecting your privacy and the confidentiality of your clients' information. This Privacy Policy explains what data we collect, how we use it, where it is stored, and your rights under applicable Canadian privacy law.

If you have questions or concerns about this policy, contact us at contact.moosakhan@gmail.com.

Data We Collect

We collect only the minimum data necessary to provide the Surface service:

• Account information — your name, email address, and practice name when you create an account
• Documents you upload — legal files, contracts, court filings, correspondence, and other documents you add to Surface for AI-powered search and analysis
• Usage and audit data — a log of actions taken within the application, including document uploads, AI queries, logins, and settings changes, for security and LSO compliance purposes
• Billing information — payment details processed securely through Stripe. We never store raw card numbers. Only a Stripe customer token is retained on our servers.
• Authentication tokens — if you sign in with Google or Microsoft OAuth, we store your authentication session securely on your device using your operating system's encrypted keychain (macOS Keychain or Windows Credential Vault). These tokens never leave your machine.
• Connected account tokens — if you connect Gmail, Outlook, Google Drive, or OneDrive for document sync, the OAuth access tokens for those services are stored encrypted on your device and in your Surface account. You can disconnect any service at any time from Settings.

Where Your Data Lives

Specifically:

• Documents and database — stored in Supabase Postgres hosted on AWS ca-central-1
• Document files — stored in Supabase Storage backed by AWS S3 ca-central-1
• Document embeddings — mathematical vector representations of your documents used for AI search, stored in your Canadian database using pgvector
• Authentication sessions — encrypted and stored locally on your device using your operating system's secure keychain, never on our servers

How We Use AI — and What Leaves Canada

Surface uses two AI providers to power its document intelligence features. This is the only circumstance under which any portion of your data leaves Canadian servers:

• Cohere (a Canadian AI company headquartered in Toronto, Ontario) — creates mathematical embeddings (vector representations) of your document text for semantic search. The text content of your documents is sent to Cohere's API for embedding processing.
• Anthropic Claude API — generates natural language answers to your questions. Only the relevant paragraph excerpts (typically 2–5 short passages, not full documents) needed to answer a specific query are sent to the Claude API along with your question.

We disclose these third-party AI providers in this policy and in our Data Processing Agreement in compliance with PIPEDA Principle 1 (Accountability) and to support your compliance obligations under LSO Rule 3.3-1.

LSO Compliance and Your Professional Obligations

Surface is designed to help Ontario lawyers meet their obligations under the Law Society of Ontario Rules of Professional Conduct:

• LSO Rule 3.1-2 (Competence) — Surface helps lawyers work efficiently and accurately with their client documents
• LSO Rule 3.3-1 (Confidentiality) — Surface implements reasonable measures to protect client confidentiality, including: Canadian data storage, encryption at rest and in transit, per-matter data isolation at the database level, immutable audit logging, and a Data Processing Agreement available on request

A Data Processing Agreement (DPA) is available on request for firms that require one. The DPA establishes Surface as the data processor and you as the data controller, documents our Canadian data residency commitment, confirms zero AI training on your data, and serves as documented evidence of reasonable measures if you are ever asked by the Law Society of Ontario to demonstrate compliance. To request a DPA, contact contact.moosakhan@gmail.com.

Per-Matter Data Isolation

Each client matter in Surface is isolated at the database level using Row Level Security (RLS) enforced by the database engine itself — not just application-level controls. Documents, conversations, and data in one client matter cannot be accessed when working in another matter. Your data cannot be accessed by any other Surface user under any circumstances.

Audit Logs

All significant actions within Surface are recorded in an immutable audit log, including logins, document uploads, document deletions, AI queries made, and settings changes. Audit logs are stored in your Canadian database. They are accessible to you for your own records and to Surface AI Inc. for security monitoring and support purposes only. Audit logs are never shared with third parties except as required by law.

Data Retention and Deletion

We retain your data for as long as your Surface account is active. Upon cancellation of your subscription:

• Your documents, chat history, and personal account data are permanently and irreversibly deleted within 30 days of your subscription ending
• Audit logs may be retained for up to 7 years as required by applicable legal and professional record-keeping standards, unless you specifically request earlier deletion
• Billing records are retained as required by applicable Canadian tax and financial law

You can request deletion of your data at any time by contacting us at contact.moosakhan@gmail.com, even before your subscription ends.

Third-Party Services

Surface integrates with the following third-party services. Each has its own privacy policy governing how they handle data:

• Stripe — payment processing (PCI-DSS compliant). Stripe Privacy Policy
• Anthropic — AI inference via Claude API. Anthropic Privacy Policy
• Cohere — document embedding via API (Canadian company). Cohere Privacy Policy
• Google — optional Google sign-in, Gmail sync, and Google Drive integration. Google Privacy Policy
• Microsoft — optional Microsoft sign-in, Outlook sync, and OneDrive integration. Microsoft Privacy Policy
• Supabase — database and file storage infrastructure (hosted on AWS ca-central-1). Supabase Privacy Policy

Your Rights Under PIPEDA

Under the Personal Information Protection and Electronic Documents Act (PIPEDA), you have the following rights regarding your personal information:

• Right to access — you may request a copy of the personal information we hold about you
• Right to correction — you may request correction of inaccurate or incomplete information
• Right to withdraw consent — you may withdraw consent for certain uses of your data, subject to legal and contractual restrictions
• Right to deletion — you may request deletion of your personal information
• Right to complain — you may file a complaint with the Office of the Privacy Commissioner of Canada at www.priv.gc.ca if you believe your privacy rights have been violated

To exercise any of these rights, contact us at contact.moosakhan@gmail.com. We will respond to all requests within 30 days.

Security Measures

We implement the following security measures to protect your data:

• Encryption in transit using TLS 1.2+ for all data transfers between your device and our servers
• Encryption at rest for all documents and personal data stored on our servers
• Row-level security enforced at the database engine level — not just application logic
• Authentication session tokens stored only in your device's operating system encrypted keychain — never on our servers
• Immutable audit logging of all data access and actions
• Strict separation between administrative (service role) and user-level database access
• Regular security reviews of our infrastructure and code

In the event of a data breach affecting your personal information, we will notify you and the Office of the Privacy Commissioner of Canada as required by PIPEDA's breach notification requirements.

Children's Privacy

Surface is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from minors. If you believe a minor has provided us with personal information, contact us immediately at contact.moosakhan@gmail.com.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our service, applicable law, or business practices. We will notify you of material changes by email at least 14 days before the changes take effect. Continued use of Surface after changes take effect constitutes your acceptance of the updated policy. The date at the top of this page always reflects when the policy was last updated.