Privacy Policy

1. Who we are

Case Buddy (“we”, “us”, “our”) is a legal information platform incorporated in England and Wales. We operate the Case Buddy website and application (“the Service”).

For all privacy-related enquiries, please contact us at admin@casebuddy.co.uk. We are the data controller for the personal data you provide to us.

2. What data we collect

We collect the following categories of personal data when you use the Service:

• •Account information — your name and email address, provided when you register.
• •Legal queries — the chat messages and questions you submit to our AI assistant.
• •Uploaded documents — tenancy agreements, dismissal letters, and any other documents you choose to upload for analysis.
• •Payment information — processed securely by Stripe. We do not store your card details on our systems.
• •Usage analytics — anonymised data about how you interact with the Service, such as pages visited and features used.

3. How we use your data

• •Providing the Service — to answer your legal queries, analyse your documents, and manage your account.
• •Solicitor matching — to prepare and share an AI-generated case summary with the solicitor you choose to connect with.
• •Improving AI responses — to review query patterns and improve the accuracy of our service (we use aggregated, anonymised data only for this purpose).
• •Billing — to manage your subscription and process payments via Stripe.

4. Legal basis for processing

We process your personal data on the following legal bases under UK GDPR:

• •Contract performance — processing your queries, documents, and account data is necessary to deliver the Service you have signed up for.
• •Legitimate interests — fraud prevention, security monitoring, and improving service reliability.
• •Consent — marketing communications, where you have opted in. You may withdraw consent at any time.

5. AI processing

Case Buddy uses the Anthropic Claude API to power its AI assistant. When you submit a legal query or upload a document, that content is transmitted to Anthropic’s servers for processing and a response is returned to you.

Your data is not used to train AI models.Anthropic’s API usage terms prohibit the use of API inputs and outputs to train their models without explicit consent. We have not granted such consent, and you have not been asked to do so.

Anthropic processes data in accordance with their own privacy policy and acts as a sub-processor on our behalf. For more information, please see Anthropic’s Privacy Policy.

6. Data sharing

We share your data only with trusted third-party providers necessary to operate the Service:

• •Anthropic — AI query and document processing.
• •Stripe — payment processing. Card data is handled entirely by Stripe and is not accessible to us.
• •Resend — transactional email delivery (account confirmations, notifications).
• •Supabase — database hosting and file storage, with row-level security enforced.
• •Vetted solicitors — only an AI-prepared case summary is shared when you choose to request a solicitor match. Your full conversation history is never shared with solicitors.

We do not sell your personal data to any third party, ever.

7. Data retention

• •Chat history — retained for 2 years from the date of each message, then permanently deleted.
• •Uploaded documents — automatically and permanently deleted after 90 days.
• •Account data — retained until you submit a deletion request. Following deletion, your data is purged within 30 days.

8. Your rights under UK GDPR

Under UK GDPR, you have the following rights in relation to your personal data:

• •Right of access — to request a copy of the personal data we hold about you.
• •Right to rectification — to ask us to correct inaccurate or incomplete data.
• •Right to erasure — to request deletion of your personal data (“the right to be forgotten”).
• •Right to data portability — to receive your data in a structured, machine-readable format.
• •Right to restriction — to ask us to restrict processing of your data in certain circumstances.
• •Right to object — to object to processing based on legitimate interests.
• •Right to withdraw consent — where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, contact us at admin@casebuddy.co.uk. We will respond within one calendar month.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO).

9. Cookies

We use only strictly necessary session cookies to authenticate you and maintain your session while you are logged in. These cookies are deleted when you close your browser or log out.

We do not use tracking cookies, advertising cookies, or any third-party analytics cookies that track you across other websites. You will not see a cookie consent banner because we only set cookies that are essential for the Service to function.

10. Children

The Service is not intended for use by anyone under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from someone under 18, please contact us immediately at admin@casebuddy.co.uk and we will delete it promptly.

11. Changes to this policy

We may update this Privacy Policy from time to time. For material changes — those that significantly affect your rights or how we use your data — we will notify you by email at least 14 days before the change takes effect. The “last updated” date at the top of this page will always reflect the most recent revision.

12. Contact us

For any questions, concerns, or requests relating to this Privacy Policy or your personal data, please write to us at admin@casebuddy.co.uk. We aim to respond to all enquiries within 5 working days.