Privacy policy

1. Who we are

DirectFile is a process-serving business based in Toronto, Ontario. We serve court documents on behalf of law firms, businesses and individuals, and provide proof of service. This policy explains how we handle personal information in line with the Personal Information Protection and Electronic Documents Act (PIPEDA).

Our Privacy Officer is responsible for our compliance with this policy and can be reached at info@directfile.ca.

2. What we collect

We only collect what we need to provide and prove service:

• Account details: your name, email address, optional phone number, your firm or organization, and your sign-in credentials. Passwords are stored only as a secure hash; for passkeys we store only the public key.
• Order details: your contact information, the court file and case information you give us, the names, addresses and descriptions of the people to be served, your instructions, and the documents you upload.
• Evidence of service: for each attempt, the date and time, GPS location, photos, the outcome and the process server’s notes, plus the affidavits of service we prepare.
• Payment information: card payments are processed by Stripe. We receive confirmation of payment and limited details such as the amount and card brand; we never receive or store your full card number.
• Messages: what you send us through the contact form or by email.
• Technical information: IP address, browser details and session cookies, used to keep you signed in, protect the site against abuse and diagnose problems.

3. People we serve documents on

To serve documents we necessarily handle personal information about the people named in an order, such as their name, address and a description to help identify them. We collect and use it only to serve the documents, to record how service was made and to prepare the affidavit of service that the court requires.

Customers confirm, when they order, that they have a legitimate legal reason to have the documents served and the right to give us this information. If you believe we hold information about you because of an order, you can contact us at info@directfile.ca.

4. How we use information

• to accept, price, carry out and track your orders;
• to prepare affidavits of service and keep evidence of how service was made;
• to send order confirmations, status updates and account emails;
• to process payments, issue receipts and keep tax and accounting records;
• to answer your questions and provide support;
• to secure our services, prevent fraud and abuse, and fix problems;
• to meet legal obligations, such as responding to a court order.

We do not sell personal information, and we do not use it for advertising. We don’t use analytics or advertising trackers on this site.

5. Consent

By creating an account, placing an order or contacting us, you consent to the collection, use and disclosure of your information as described here. You may withdraw consent at any time, subject to legal and contractual limits. For example, we can’t delete evidence of a completed service while it may still be needed to prove that service, and withdrawing consent may mean we can no longer provide a service.

6. Who we share it with

Access is limited to the DirectFile staff and process servers who need it to do the job, and to the commissioner for taking affidavits who commissions an affidavit. We also use these service providers, who process information for us under contract and only for the purposes we set:

• Cloudflare: website hosting, uploaded file storage, security and bot protection (Turnstile).
• PlanetScale: our database, hosted in Canada.
• Stripe: card payments, receipts and refunds.
• Resend: sending our emails (order updates, receipts and account emails).
• Google Fonts: the typefaces on this website are loaded from Google, which receives your IP address when the page loads.

Affidavits and evidence of service are given to you, the customer, for filing with the court. We may also disclose information where required or permitted by law, for example under a subpoena or court order, or as part of a sale or reorganization of our business, in which case the information would remain protected by this policy.

7. Where your information is stored

Our database is hosted in Canada. Some of our service providers, such as Cloudflare, Stripe and Amazon, may process or store information in other countries, including the United States, where it may be accessible to authorities under local law. We choose providers that protect information to a standard comparable to Canadian law.

8. How long we keep it

We keep personal information only as long as needed for the purposes above:

• Orders, uploaded documents, evidence of service and affidavits: for seven years after the job is completed, because the validity of service can be challenged long after the fact and this evidence may be needed to defend it.
• Invoices and payment records: for at least six years after the end of the tax year they relate to, as Canadian tax law requires.
• Account details: while your account is open. If you close your account, we delete or anonymize your profile, but keep order records for the periods above.
• Contact-form messages: for up to two years.
• Security and server logs: for short periods, typically a few weeks.

When these periods end, information is securely deleted or anonymized.

9. How we protect it

Information is encrypted in transit (HTTPS) and at rest. Documents and evidence can only be downloaded by authorized users through access-checked links. Staff access is limited by role, changes to jobs are recorded in an audit log, and attempt records cannot be edited after they are made. No system is perfectly secure; if a breach creates a real risk of significant harm, we will notify you and the Privacy Commissioner of Canada as PIPEDA requires.

10. Cookies

We use only cookies that are needed for the site to work: a session cookie that keeps you signed in and cookies set by Cloudflare to protect the site from automated abuse. We do not use advertising or analytics cookies.

11. Your rights

You can ask to see the personal information we hold about you, ask how it has been used and disclosed, and ask us to correct anything that is inaccurate. Many details can be updated directly in your account settings. Email info@directfile.ca with your request; we may need to confirm your identity first, and we will respond within 30 days.

If you’re not satisfied with our response, you can contact the Office of the Privacy Commissioner of Canada.

12. Children

Our services are intended for adults. We don’t knowingly collect information from children for the purpose of creating accounts or placing orders.

13. Changes to this policy

We may update this policy as our services change. We’ll post the new version here with a new “last updated” date and, for significant changes, tell account holders by email. See also our Terms of Service.

14. Contact

Privacy Officer, DirectFile, Toronto, Ontario. Email info@directfile.ca.