Privacy Policy
Last updated: January 16, 2026
1. Welcome.
This notice explains what little personal data we collect, why, how long we keep it, and the choices you have when using TheMediator.AI mobile apps, website, and related services (“Services”).
Underlabs Inc.
1700-2001 Boulevard Robert-Bourassa, Montréal QC H3A 2A6, Canada
Email: [email protected]
We are the data controller and have appointed a Privacy Officer to oversee compliance with Québec Law 25, GDPR, and similar regulations.
2. Scope
This policy applies whenever you browse our site, open an account, start or join a dispute, or contact us. It does not cover third-party sites we merely link to.
3. What data we collect (and when)
Category What we store How we get it Account info • First name (or a chosen nickname)• Mobile number You enter it when you sign up Dispute content • Messages, attachments, AI summaries You provide it while mediating Payment info • Pseudonymous transaction ID issued by Apple / Google• Internal payer ID (hashed mobile or random string) Supplied by app store at checkout Service delivery • Device push-token and/or phone number for SMS Collected automatically from the app Marketing (opt-in) • Email address Only if you subscribe to updates
We do not knowingly collect data from children under 13. If we discover we have, we erase it promptly.
4. Why we use data and our legal bases
| Purpose | Legal basis |
|---|---|
| Run the mediation flow, store transcripts briefly | Contractual necessity |
| Identify users and prevent fraud | Legitimate interest |
| Process payments and issue in-app receipts | Contractual necessity |
| Send status updates via SMS or push notification | Contractual necessity |
| Improve AI models with anonymised, aggregated data | Legitimate interest / consent where needed |
| Send marketing emails (news, beta invites) | Consent (opt-in) |
| Meet legal duties (tax, audit, breach notices) | Legal obligation |
5. Automated processing & AI mediation
TheMediator.AI uses Large Language Models (LLMs) to support a structured mediation process.
The LLMs acts as a neutral facilitation tool that:
• Summarises each party’s statements,
• Asks clarifying and reflective questions,
• Suggests possible, non-binding resolution options.
The AI does not make binding decisions, issue judgments, or impose outcomes.
All resolutions require voluntary agreement by the parties.
Parties may:
• Correct or clarify LLM-generated summaries,
• Decline suggested questions or proposals,
• Pause or terminate the mediation at any time.
We maintain timestamped logs of LLM prompts and responses for audit, quality control, and dispute review purposes, subject to the retention limits described below.
6. Mediation boundaries & human escalation
TheMediator.AI is designed for early-stage and everyday disputes that do not require legal representation.
The Service:
• Is voluntary and non-binding,
• Does not replace legal advice or court processes,
• Does not prevent parties from seeking a human mediator, lawyer, or court remedy at any time.
In some cases, users may choose to export a mediation summary or certificate and continue the process with a human mediator or legal professional.
7. Sharing & disclosure
We share personal data only with:
- Cloud hosting & AI inference partners (e.g. AWS, OpenAI) under strict contracts,
- Payment processors (Apple, Google),
- SMS & push-notification gateways,
- Authorities when required by law.
We never sell or rent your information.
8. International transfers
Servers are in Canada and the United States. When data crosses borders, we rely on:
- Standard Contractual Clauses (for EU/UK users),
- Law 25 transfer assessments and safeguards (for Québec users), and
- other recognised mechanisms.
9. Retention
The retention periods below apply once the Service is live and operating in production.
| Data | Retention period |
|---|---|
| Dispute messages & files | Deleted 30 days after a resolution is attempted or when any party deletes sooner |
| Push tokens / SMS numbers | Until you delete your account (or token expires) |
| Marketing emails | Until you unsubscribe |
| Anonymised analytics | Up to 24 months |
10. Security
Data is encrypted in transit (TLS 1.2+) and at rest (AES-256). Access is role-based and logged. We run annual penetration tests and privacy impact assessments.
11. Your rights
Québec residents (Law 25)
You may access, correct, erase, restrict, or port your personal data. We reply within 30 days.
EU/UK residents (GDPR)
You also have rights to object and to avoid decisions based solely on automated processing.
California residents (CCPA)
You may request to know or delete data and opt out of “sales” (we do not sell data).
To exercise any right, email [email protected]
12. Cookies & tracking
We use only:
- Essential cookies (sign-in, security)
- Basic analytics (Google Analytics)
No third-party ad cookies.
13. Third-party links
Our blog may point to external sites with their own policies. Please read those when you visit them.
14. Changes to this policy
We post any material change here. Using the Services after that date means you accept the update.
15. Contact us
Questions or concerns?
Email [email protected]
Mail Privacy Officer, Underlabs Inc., 2001 Boulevard Robert-Bourassa Suite 1700, Montréal QC H3A 2A6, Canada
Quick reference
| Key point | Why it matters |
|---|---|
| We collect only first name (or nickname) and mobile number | Minimal personal data |
| Resolutions deleted after 30 days | Keeps disputes private |
| Status updates via SMS or push, not email | Avoids collecting extra info |
| Payment ID is pseudonymous | Protects your identity |
| No data sales, ever | No surprise ads or profiling |
| Law 25, GDPR, CCPA rights honoured | You stay in control of your data |
Thank you for trusting TheMediator.AI. We keep your data footprint tiny so you can focus on resolving conflict, not worrying about privacy.