Privacy Policy

1. Who we are

The data controller is CaseTrackr LTD, a company registered in England and Wales.

Privacy questions: [email protected] or [email protected].

2. Data we collect

• Account data: name, email, phone, company name and address, role, authentication and 2FA settings.
• Billing data: processed by Stripe. Card details are not stored on our servers. We store Stripe customer and subscription identifiers and a billing email.
• Case data you enter: matter names, references, family names, key dates, contact logs, adults and children details, notes, and related files.
• Usage data: login times, IP address, browser user-agent, and activity-log events needed to secure the service.
• Optional audio: if you use recordings, audio files, transcripts, and AI summaries.
• Contact form: name, email, subject, and message.

3. How we use data

We use data to provide CaseTrackr (contract), to bill subscriptions, to keep accounts secure (including 2FA), to send operational email (invites, reminders, password reset), and to respond to enquiries. We do not sell personal data.

4. Third parties

• Stripe -payment processing.
• SMTP2Go -transactional email.
• Microsoft Graph -only if you connect Microsoft 365, for SharePoint files, Outlook mail, and calendar. Tokens are stored encrypted.
• OpenAI -only if you use audio transcription or summaries.
• Cloudflare -TLS, CDN, and Turnstile bot protection on the contact form.
• Hosting -application and database hosting for the service.

5. Lawful basis

Account and billing: contract. Security logs: legitimate interests (keeping the service safe). Special-category data that may appear in case records (for example health, religion, or children's data you enter) is processed because you, as the professional customer, instruct us to host it for your work. You remain responsible for your own lawful basis with the families you work with.

6. Retention

We keep account and case data for as long as your subscription is active. After you close an account or request deletion, we aim to erase or anonymise personal data within 30 days, except where we must keep records for tax, dispute, or legal obligation (typically up to 6 years for invoices).

7. Your rights

You can request access, correction, deletion, restriction, objection, or portability of your personal data. Email [email protected] and we will respond as soon as we reasonably can.

8. Security

Access is authenticated, passwords are hashed, optional 2FA is available, traffic is encrypted with TLS, and Microsoft Graph tokens are encrypted at rest. No method of transmission is 100% secure.

9. Cookies

We use essential cookies so you can sign in and stay signed in. We do not currently use optional analytics cookies.

10. Children

CaseTrackr is a professional tool. We do not offer accounts to children. Case records may include children's details that you enter in the course of independent social work. Those records are only visible to users in your organisation's tenant.

11. Contact

Privacy: [email protected]
General: [email protected]