Privacy policy

What the Service does

Crito gives your AI client access to Canadian court decisions, statutes, and regulations over the Model Context Protocol (MCP). Your AI client, for example Claude or ChatGPT, decides when to call a Crito tool and what to send. Crito returns source text. Your AI client writes the answer.

We do not see your conversation with your AI client. We receive only the tool calls your client sends to us, such as search text, a citation, or a paragraph range. Your AI provider's own privacy policy applies to your conversation.

Information we collect

• Account information: your email address and sign-in data. Our authentication provider keeps your password as a secure hash. We do not see it.
• Billing information: your plan, subscription status, renewal date, and billing address. Our payment provider collects your card details. We do not store card numbers.
• Usage records: for each tool call, the tool name, the time, the duration, whether the call succeeded, and the ID of the AI client that made it. Usage records do not contain your search text or the results.
• Connection data: when you connect an AI client, we record which client you approved, so that it can call the Service for you.
• Technical data: our hosting providers can keep standard request logs, such as IP address, time, and browser type.

Your queries

A query is the content of a tool call: search text, a case name or citation, or the name of a statute. We use a query only to return results to your AI client.

• We do not write query text to our database or to our logs.
• We do not use queries to train AI models.
• To find cases by meaning, we send search text to an embedding provider, which turns it into numbers. To find legislation, we can send the name of a statute to a web search provider and to official government legislation websites.

Your AI client can put facts from your conversation into search text. If your work is confidential, tell your AI client not to include names or identifying facts in its searches.

How we use personal information

We use personal information only to:

1. Provide, operate, secure, and improve the Service;
2. Sign you in and protect your account;
3. Check if you can get free access, from your email address;
4. Bill you and collect payment;
5. Find abuse, such as automated bulk downloads;
6. Give support, and tell you about changes to the Service or to this policy; and
7. Obey the law, court orders, and other legal process.

We do not use personal information for other purposes without your consent. We do not sell your personal information or your queries.

If the law or a court orders us to disclose your information, we will tell you before we disclose it, if the law lets us. This gives you time to ask a court for protection.

Service providers

We use these service providers (“subprocessors”) to operate the Service:

• Supabase: authentication and account database.
• Stripe: payments and billing.
• Render: hosting for the MCP server.
• Voyage AI: embeddings for search text.
• Pinecone: vector search.
• MongoDB: storage for court decisions.
• Firecrawl: web search for legislation.

Each provider gets only the data it needs to do its task.

Cookies

The website uses cookies only to keep you signed in. We do not use analytics or advertising cookies. If you block cookies, you cannot sign in.

How long we keep data

We keep account information, billing records, and usage records while your account is open. When you close your account, we delete or de-identify your personal information within 90 days. We keep some billing records for longer when tax or accounting law requires it.

We do not keep query text.

Access and correction

You can ask to see, correct, or delete your personal information at any time. You can also ask for a list of the parties that have access to it. Send your request to hi@crito.fyi.

You are responsible for keeping your account information correct and current.

Safeguards

We use reasonable security measures to protect personal information from unauthorized access, use, disclosure, change, or destruction. All connections to the Service use encryption. Each account can read only its own records. But no system is fully secure, and we cannot guarantee the security of data sent over the internet. See Security for more information.

This policy does not apply to other websites that the Service links to, such as court websites.

Where data is processed

Crito operates from Canada. Our service providers can process and store data outside Canada, mainly in the United States. The law of those countries can let their authorities access the data. When you use the Service, you agree to this processing.

Changes to this policy

We can change this policy. We will put the date of the last change at the top. If a change is important, we will tell you by email or on the website before it starts. If you continue to use the Service after a change, you accept the new policy.

Questions and complaints

Send questions or complaints to our Privacy Officer at hi@crito.fyi. The Privacy Officer is responsible for our compliance with this policy and with privacy law.

If we cannot resolve your concern, you can contact the Office of the Privacy Commissioner of Canada.