This Privacy Policy explains how The Casebook ("we", "us") handles personal data for which we are the controller — principally the account holders, billing contacts and website visitors who deal with The Casebook (the "Service").
1.Who we are
The Casebook, a sole trader based in England & Wales, is the controller of the personal data described in this Policy. For any privacy question, contact privacy@thecasebook.co.uk.
2.What we collect
- Account data — name, work email, phone number and the firm you represent, and your role and password (stored only as a secure hash).
- Billing data — subscription, seats, invoices and VAT details. Card payments are processed by Stripe; we do not store your full card number.
- Usage and log data — sign-in times, IP address, device/browser information, and an activity log of key actions, used for security and support.
- Support communications — messages you send us and our replies.
- Cookies — essential cookies that run the Service, plus analytics and bot-protection cookies on our public website (see below).
3.How we use it, and our lawful bases
| Provide and administer the Service | Performance of our contract with you |
| Take payment, invoice and manage renewals | Contract; and legal obligation (tax/accounting) |
| Secure the Service and prevent fraud/abuse | Our legitimate interests in a safe service |
| Provide support and respond to you | Contract; and our legitimate interests |
| Improve and develop the Service | Our legitimate interests (using minimal, mostly aggregated data) |
| Measure how our public website is used | Our legitimate interests in improving the site (analytics cookies — see Cookies) |
| Tell real visitors from automated bots on our public forms | Our legitimate interests in preventing abuse |
| Send occasional service or product updates | Legitimate interests, or consent where required |
| Meet legal and regulatory obligations | Legal obligation |
4.Cookies
We use three kinds of cookie, and it matters which pages they appear on:
- Essential — used across the Service to keep you signed in and protect your session. These are strictly necessary: blocking them may stop the Service working.
- Analytics — Google Analytics 4, on our public website only, so we can see which pages are useful and where people get stuck. These are not strictly necessary. They are not used inside your workspace: we do not track what you or your colleagues do with your matters.
- Security — Cloudflare Turnstile, on our sign-up and contact forms only, to tell real visitors from automated bots. It sets a cookie for that check and does not track you across other websites.
We do not use advertising or cross-site tracking cookies, and we do not sell your data. Because the analytics cookies are not strictly necessary, you can refuse or delete them in your browser settings — or use Google's opt-out browser add-on — and everything in the Service will carry on working normally.
5.Who we share it with
We do not sell your personal data. We share it only with service providers who help us run the Service, under contract and only as needed:
- Stripe — payment processing;
- IONOS — transactional email (verification, receipts, reminders) and application & database hosting (UK data centre);
- Google — analytics for our public website only (page views, approximate location, device and browser). Google does not receive anything from inside your workspace;
- Cloudflare — the bot check on our sign-up and contact forms, which processes your IP address and browser characteristics to decide whether you are a person.
We may also disclose data where required by law, to establish or defend legal claims, or in connection with a business sale or reorganisation.
6.International transfers
We aim to keep personal data within the UK or European Economic Area. Where a provider processes data outside the UK, we put appropriate safeguards in place (such as the UK International Data Transfer Agreement or an adequacy decision) so your data remains protected. In particular, Google and Cloudflare — which support our public website and forms — may process data outside the UK under those safeguards. Your firm's own client and matter data is not sent to either of them.
7.How long we keep it
We keep account and usage data for as long as your subscription is active and for a reasonable period afterwards to meet legal, accounting and security requirements; billing records are typically kept for six years. When data is no longer needed we delete or anonymise it.
8.How we protect it
We use appropriate technical and organisational measures, including encryption of data in transit, hashing of passwords in line with recognised (NCSC) guidance, least-privilege database access, and access controls. As noted above, we do not store full card details, and the Service is not used to store client case files.
9.Your rights
Under UK data protection law you have the right to access your personal data, to have it corrected or erased, to restrict or object to certain processing, and to data portability. To exercise any of these, contact privacy@thecasebook.co.uk. You also have the right to complain to the ICO (ico.org.uk), though we'd appreciate the chance to help first.
10.Children
The Service is a business tool intended for professional use and is not directed to children. We do not knowingly collect personal data from anyone under 18.
11.Changes to this Policy
We may update this Policy from time to time. Material changes will be notified by email or an in-app notice, and the "last updated" date above will change.
12.Contact
Questions or requests about your privacy: privacy@thecasebook.co.uk.