Privacy Policy

This policy explains what personal data CaseCaddy collects, why we collect it, and how we use it. We have written it in plain English because we think you deserve to understand it. If anything is unclear, please contact us at hello@casecaddy.app.

1. Who we are

CaseCaddy is a product operated by CaseCaddy Ltd, registered in England and Wales (Company No. [in progress]). Our registered address is [in progress].

For the purposes of UK data protection law, CaseCaddy Ltd is the data controller in respect of broker account data and platform operation data, and acts as data processor in respect of client and case data entered by brokers (see Section 2 below).

2. Our roles — controller and processor

UK data protection law distinguishes between a data controller (who decides why and how personal data is used) and a data processor (who processes data on the controller's behalf). Our role differs depending on whose data is involved:

3. What data we hold

Your broker account data (we are controller)

• –Your name and company or trading name
• –Your email address, used for account login and notifications
• –A reply-to email address used when recipients respond to automated reminders
• –Account preferences and settings you configure in the platform
• –Billing information — we do not store payment card details directly; card processing is handled by our payment provider

Client and case data (you are controller; we are processor)

• –Client full name and email address
• –Client postal address
• –Client phone number (if provided)
• –Names of outstanding documents — for example "Payslips" or "Bank statements"
• –Case reference, property address, and relevant dates
• –Solicitor, estate agent, lender, and other party contact details where entered
• –Email reminder logs and delivery status

Technical and usage data (we are controller)

• –Browser type, operating system, and device type
• –Pages visited within the application and actions taken
• –Login timestamps and session data
• –Error logs used to diagnose and fix issues
• –For client upload pages: a hashed (unreadable) IP address for security logging, access timestamps, and whether upload events occurred

What we never collect

• –Mortgage documents, payslips, bank statements, or any financial files — we never receive or store these
• –Passport scans or copies of identity documents
• –The content of email replies from clients
• –Payment card numbers or full payment details
• –Special category personal data (health data, biometric data, etc.) — you should not enter this into CaseCaddy

4. Why we use it and our lawful basis

For processing where we are the data controller, we rely on the following lawful bases under UK GDPR:

Where we process client and case data on your behalf, our lawful basis is your instruction as data controller. You are responsible for having an appropriate lawful basis for contacting your clients and other parties through CaseCaddy.

5. AI-assisted email drafting

CaseCaddy includes an optional feature that uses artificial intelligence to help draft reminder emails. This feature is powered by Anthropic's Claude AI. The following applies whenever you use it:

• –A limited amount of case context — such as party type, outstanding items, and case stage — may be sent to Anthropic's API to generate a draft
• –Personal data sent to the AI is limited to the minimum necessary for the drafting task
• –Anthropic does not use CaseCaddy customer data to train its AI models, in accordance with our agreement with Anthropic
• –AI-generated drafts are suggestions only. You should review and approve every email before it is sent
• –You should not enter special category personal data (such as health conditions or financial vulnerability information) into case fields used by the AI drafting feature
• –CaseCaddy does not provide legal, financial, mortgage, or compliance advice. AI-generated content is not professional advice of any kind

If you do not use the AI drafting feature, no case data is sent to Anthropic.

6. Payment processing

Subscription payments are processed by a third-party payment provider. We share your billing contact details and subscription information with them for this purpose. The payment provider processes card data directly and in accordance with PCI-DSS requirements. We do not store your full payment card number, CVV, or full card details on our systems. Please refer to your payment provider's privacy policy for information on how they process your payment data.

7. Cookies and tracking

We use essential session cookies only. These are set by Clerk, our authentication provider, to manage your login session. Without them, the service cannot function.

We do not use advertising cookies, tracking cookies, or third-party analytics cookies. We do not use Google Analytics or any similar analytics service that tracks your behaviour across websites. No cookie consent banner is required for essential-only cookies under PECR and UK GDPR.

8. International transfers and sub-processors

Some of our sub-processors are based in or operate infrastructure in the United States. Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place, primarily UK International Data Transfer Agreements (IDTAs) or the UK Addendum to EU Standard Contractual Clauses. We share data only with the following sub-processors and only for the purpose stated:

We never sell your data or your clients' data. We never share data for advertising or marketing purposes on behalf of third parties.

9. How long we keep data

10. Deleting your account and exporting your data

Data export

You can export your case data, reminder logs, and related information at any time from within the CaseCaddy application. We recommend exporting your data before cancelling your account.

Account deletion

You can cancel your account at any time. On cancellation, your data is retained for 30 days to give you an opportunity to export it, after which it is permanently and irreversibly deleted. Billing records are retained for the statutory period described above. To request immediate deletion of your data, contact hello@casecaddy.app.

11. Your rights under UK GDPR

In respect of personal data for which we are the data controller, you have the right to:

• –Access a copy of the personal data we hold about you (Subject Access Request)
• –Correct inaccurate or incomplete personal data
• –Request erasure of your personal data ("right to be forgotten"), where no legal obligation requires us to retain it
• –Restrict the way we process your personal data in certain circumstances
• –Receive your data in a portable, machine-readable format
• –Object to processing based on our legitimate interests
• –Withdraw any consent you have given at any time, without affecting the lawfulness of processing before withdrawal

To exercise any of these rights, email us at hello@casecaddy.app. We will acknowledge your request within 5 working days and respond in full within one calendar month, as required by UK GDPR.

12. Changes to this policy

If we make material changes to how we collect or use personal data, we will notify you by email at least 14 days before the changes take effect. For minor or clarificatory changes, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically.

13. Contact and complaints

For any questions about this policy or how we handle personal data:
hello@casecaddy.app

If you are not satisfied with our response, or believe we are processing your personal data unlawfully, you have the right to complain to the UK Information Commissioner's Office: