Data processing agreement

This agreement is between 1602637 BC Ltd., operating as Fylely ("we"), and each firm or organization that has a Fylely account ("your firm"). It covers the personal information about clients and other people that your firm puts into the Service, by typing it, importing it, uploading documents or connecting other accounts ("client information").

It adds to our Terms of Service, Privacy Policy and Cookie Policy, which the Terms call the entire agreement: by publishing it, we agree to it for every firm's account, in addition to them, with nothing to sign. Where it and those documents differ about client information, this agreement governs. If your firm wants a signed copy for its file, print this page, sign it and email it to help@fylely.com, and we will return it countersigned.

1. Who decides, and who acts for whom

Your firm decides what client information goes into Fylely and why, and stays responsible for it under the privacy law and professional rules that apply to your firm. We handle it on your firm's behalf, as its service provider, to provide the Service.

In Canada, PIPEDA keeps an organization responsible for personal information it transfers to a third party for processing, and asks it to use contractual or other means to protect that information meanwhile (Schedule 1, principle 4.1.3); British Columbia's PIPA, where it applies, asks for reasonable security arrangements for personal information in an organization's custody or under its control (section 34). In the United States, a lawyer must make reasonable efforts to prevent unauthorized access to client information (ABA Model Rule 1.6(c)). This agreement is meant to be part of those means and efforts. Whether it is enough for your firm is for your firm to judge.

2. What we do with client information

• Only to provide the Service to your firm, on its instructions. Your firm's instructions are what the people at your firm do in the Service, the settings your firm's owner chooses, and anything else your firm asks of us in writing that the Service can do.
• That means storing it, showing it to the people your firm gives access to, sending it where someone at your firm asks (an email, a connected account such as Outlook or QuickBooks, or Claude if your firm's owner switches Claude on), and keeping it secure.
• People at Fylely look at a firm's records only when the firm asks us to, to keep the service secure, or when the law requires it.
• We never sell it.
• Two settings that send something to us are off unless someone at your firm turns them on. "Help improve Ask" sends a question Ask could not answer, after removing the names and numbers it recognises, and we use those questions to write examples, with made-up names, that Ask is trained and tested on. "Help improve search" sends counts that are not linked to any account or firm. Your firm's owner can turn either off for everyone. The Privacy Policy sets out exactly what each sends and how long we keep it.

3. People at Fylely

Fylely's operator console has no page that shows a matter. It needs each operator's own account, password and authenticator code, and administrative changes are logged under that person's name. Our servers also hold a key that can read the whole database, for scheduled work such as reminders; today one person, Fylely's founder, has access to the accounts that hold it. Anyone else we give access to client information will first be bound in writing to keep it confidential and to use it only as this agreement allows.

4. Security

We protect client information with the safeguards on our Security page: each firm's records separated by row-level security in the database itself, private document storage, encryption in transit and at rest, two- and three-step sign-in, and a security log your firm's owner can read. That page describes them as they are today, including what is not yet in place: section 11 says plainly what is and is not backed up. No system is perfectly secure, and we do not promise absolute security.

5. Other companies that handle it

The companies that host, run or support the Service for us are listed on the Sub-processors page, with what each one receives. Each is contractually restricted to using personal information only to provide its service to us. If we add or replace one that handles information you have entered, we will update that page, and if a change materially affects how that information is handled, we will also tell account owners by email. If your firm objects to a change, it can export everything and close its account, as section 9 describes.

Services your firm connects itself, such as Outlook, Gmail, Google Calendar, Clio, QuickBooks Online, Xero or its own Twilio account, are your firm's or its people's own accounts, held under their own agreements with those companies. We send them only what the connection is for, as the Sub-processors page describes.

6. Where it is kept

The database and uploaded files are held by Supabase in the United States (US East, Northern Virginia), for every firm: there is no choice of region. Client information may therefore be reached by courts, law enforcement or regulators under the laws of the United States, which may differ from Canadian law. If your firm's rules or engagement terms require you to tell clients where their information is stored, this is the answer.

7. Demands from courts and authorities

If we receive a subpoena, warrant, court order or other legal demand for your firm's client information, we will tell your firm's account owner before we disclose anything, so your firm can assert privilege or object, unless the law forbids us to. We will disclose only what the demand legally requires.

8. Requests from individuals

If a client or anyone else asks us to see, correct or delete information about them that your firm holds in Fylely, we will refer them to your firm and tell your firm, rather than act on it ourselves. Your firm can export, correct and delete records in the Service at any time, and we will help where it cannot.

9. Breaches

If we find that someone without permission got into your firm's records, we will email your firm's account owner within 72 hours of confirming it. The email will say what we know at that point: what was reached, when, and what we have done about it. We will keep you updated as we learn more, so you can meet your own duties to your clients and your regulator.

10. Information for your review

Fylely holds no security certification and has not had an independent audit or penetration test. For your firm's review we offer instead: the Security page, with the latest daily check against the live service; the vendor review answers, including the independent audits our main providers hold of their own systems; the due-diligence record your firm's owner can print from Settings; and written answers to your firm's reasonable questions about how we handle client information, sent to help@fylely.com.

11. When your firm leaves

• Your firm's owner can download every record as spreadsheets or as one file, and every uploaded document as a ZIP, from Settings, at any time and without a paid plan.
• Closing the account deletes the firm, its records and its uploaded files. The deletion process sets out the exceptions: backups, retained security logs, legal obligations and copies other people have already received. Encrypted backups of the Service, where they exist, are kept for no more than 30 days, and security log entries for 400 days.
• If we end your firm's account, the Terms give it at least 30 days to export before we delete, unless that would be unlawful or put others at risk; if we ever shut Fylely down, we will email every account owner at least 30 days before it is switched off, with export available throughout.

12. Liability, law and changes

The limitation of liability in section 10 of the Terms applies to this agreement, and it is governed by the laws of British Columbia, as section 13 of the Terms provides. If we change this agreement in a way that reduces its protection of client information, we will email account owners before the change takes effect. A firm with a countersigned copy keeps the version it signed unless it agrees in writing to a later one. The date at the top of this page is the version.

Signatures

For a signed copy, print this page and complete both parts.