Privacy Policy

1. Information We Collect

Personal information you provide

We may collect personal information that you voluntarily provide when using our Service, including:

• Name and email address
• Company name and business contact details
• Account credentials and profile information
• Content you submit through the Service (prompts, case details, correspondence text, and generated letters you choose to save)

You should avoid entering unnecessary personal data about third parties into the Service. Where possible, we encourage you to redact or anonymise case documents before upload.

Usage data

We automatically collect certain information when you access the Service, including:

• IP address and browser type
• Pages visited and features used
• Date and time of access
• Device and technical information
• Log data relating to security and performance of the Service

Documents and PDFs

Where you upload or open a PDF within the Service, the document is processed in your browser using a local PDF library. The original file does not leave your device; only extracted text is sent securely to our backend for analysis and generation of responses. We do not store or further process the original file itself.

We recommend that you remove or redact any personal data that is not required for the purpose of using the Service before processing documents.

2. How We Use Your Information

We use the information we collect for the following purposes and lawful bases under UK GDPR:

• To provide, operate, and maintain the Service, including AI‑assisted drafting and document generation (performance of a contract).
• To manage your account, billing, and customer support (performance of a contract / legitimate interests).
• To improve and personalise your experience, including troubleshooting, analytics, and feature development (legitimate interests).
• To communicate with you about updates, security alerts, and administrative matters (performance of a contract / legitimate interests).
• To ensure security, prevent fraud and misuse, and protect our rights and those of other users (legitimate interests / legal obligations).
• To comply with legal and regulatory obligations, including responding to lawful requests from authorities (legal obligation).

We do not use your data to train AI models. Our AI provider processes text we send to it to generate responses and does not use that text to train or improve its models.

Before user inputs are transmitted to external AI providers, they are processed by an internal redaction layer that attempts to detect and replace common personal identifiers (such as person names preceded by a title, email addresses, phone numbers, National Insurance numbers, vehicle registration marks, UK postcodes, dates of birth, bank account details, policy or claim references, and street addresses) using pattern‑based rules.

3. Data Sharing and Disclosure

We do not sell your personal information. We may share your information with:

• Service providers and sub‑processors: Third parties that help us operate the Service (hosting, database, AI model providers, monitoring, analytics, and email providers). These parties are only allowed to process personal data on our instructions and under appropriate data protection terms.
• Legal and regulatory requirements: Where required to do so by law or in response to valid legal processes, or to protect our rights, property, or safety or that of others.
• Business transfers: In connection with a merger, acquisition, or sale of all or part of our business, subject to appropriate safeguards.

If any service providers are located outside the UK or EEA, we will ensure that appropriate safeguards are in place for international data transfers (such as standard contractual clauses or equivalent measures).

4. Data Security

We implement appropriate technical and organisational measures to protect your personal information, including:

• Encryption of data in transit and at rest
• Logical separation and row‑level security to isolate each customer's data
• Access controls, authentication measures, and least‑privilege access
• Regular security assessments and monitoring

No method of transmission or storage is completely secure, but we work to maintain security in line with industry standards and legal requirements.

5. Data Retention

We retain your personal information for as long as necessary to fulfil the purposes outlined in this Privacy Policy, including providing the Service and complying with legal, accounting, or reporting requirements.

When data is no longer needed, we will securely delete, anonymise, or aggregate it so that it can no longer be linked to an identifiable individual.

You may request deletion of your account or specific records, subject to any legal obligations that require us to retain certain information.

6. Your Rights (Australian Privacy Act)

Where the Service is used by Australian-based organisations or in relation to personal information of individuals located in Australia, we comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

Under the APPs, you have the following rights:

• APP 12 — Access: You may request access to the personal information we hold about you.
• APP 13 — Correction: You may request correction of personal information that is inaccurate, out of date, or incomplete.
• APP 8 — Cross-border disclosure: Where data is transferred outside Australia (including to our UK-based servers and AI providers), we take reasonable steps to ensure the overseas recipient complies with the APPs.

To exercise any of these rights, please contact us at info@caseflowautomation.co.uk.

Complaints about handling of personal information under Australian law may be directed to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

6A. Your Rights (UK GDPR)

CaseFlow Automation Ltd is a UK-registered company and also complies with the UK General Data Protection Regulation (UK GDPR). Under the UK GDPR, you have the following additional rights in relation to your personal data:

• Right of access
• Right to rectification
• Right to erasure
• Right to restrict processing
• Right to data portability
• Right to object

You also have the right to lodge a complaint with the ICO at www.ico.org.uk.

7. Cookies

We use essential cookies to ensure the proper functioning of the Service, for example to keep you signed in and secure your session. These cookies are necessary for authentication and security purposes and cannot be switched off in our systems.

We do not currently use cookies for advertising purposes. If we introduce analytics or other non‑essential cookies in future, we will update this policy and, where required, request your consent.

8. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will post the updated version on this page and update the "Last updated" date above. If we make material changes, we may also notify you by email or through the Service.

9. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us: