Privacy Policy

1. Who we are

Case Buddy is operated by BrandOps Limited (company number 11224451), registered office at 85 Great Portland Street, First Floor, London, England, W1W 7LT. We (“we”, “us”, “our”) operate the Case Buddy website and application (“the Service”).

For all privacy-related enquiries, please contact us at admin@casebuddy.co.uk. We are the data controller for the personal data you provide to us.

2. What data we collect

We collect the following categories of personal data when you use the Service:

• •Account information — your name and email address, provided when you register.
• •Legal queries — the chat messages and questions you submit to our AI assistant.
• •Uploaded documents — tenancy agreements, dismissal letters, and any other documents you choose to upload for analysis.
• •Payment information — processed securely by Stripe. We do not store your card details on our systems.
• •Usage analytics — anonymised data about how you interact with the Service, such as pages visited and features used.

3. How we use your data

• •Providing the Service — to answer your legal queries, analyse your documents, and manage your account.
• •Solicitor matching — to prepare and share an AI-generated case summary with the solicitor you choose to connect with.
• •Improving AI responses — to review query patterns and improve the accuracy of our service (we use aggregated, anonymised data only for this purpose).
• •Billing — to process your payments via Stripe.

4. Legal basis for processing

We process your personal data on the following legal bases under UK GDPR:

• •Contract performance — processing your queries, documents, and account data is necessary to deliver the Service you have signed up for.
• •Legitimate interests — fraud prevention, security monitoring, and improving service reliability.
• •Consent — marketing communications, where you have opted in. You may withdraw consent at any time.

5. AI processing

Case Buddy uses the Anthropic Claude API to power its AI assistant. When you submit a legal query or upload a document, that content is transmitted to Anthropic’s servers for processing and a response is returned to you.

Your data is not used to train AI models.Anthropic’s API usage terms prohibit the use of API inputs and outputs to train their models without explicit consent. We have not granted such consent, and you have not been asked to do so.

Anthropic processes data in accordance with their own privacy policy and acts as a sub-processor on our behalf. For more information, please see Anthropic’s Privacy Policy.

6. Data sharing

We share your data only with trusted third-party providers necessary to operate the Service:

• •Anthropic — AI query and document processing.
• •Stripe — payment processing. Card data is handled entirely by Stripe and is not accessible to us.
• •Resend — transactional email delivery (account confirmations, notifications).
• •Supabase — database hosting and file storage, with row-level security enforced.
• •Vetted solicitors — only an AI-prepared case summary is shared when you choose to request a solicitor match. Your full conversation history is never shared with solicitors.

We do not sell your personal data to any third party, ever.

7. Sub-processors

The following third-party service providers (sub-processors) process personal data on our behalf:

All transfers to the United States are protected by Standard Contractual Clauses (SCCs) and/or the EU-US Data Privacy Framework. For details, see each provider’s privacy policy.

8. Data retention

• •Chat history — retained for 2 years from the date of each message, then permanently deleted.
• •Uploaded documents — automatically and permanently deleted after 90 days.
• •Account data — retained until you submit a deletion request. Following deletion, your data is purged within 30 days.

9. Your rights under UK GDPR

Under UK GDPR, you have the following rights in relation to your personal data:

• •Right of access — to request a copy of the personal data we hold about you.
• •Right to rectification — to ask us to correct inaccurate or incomplete data.
• •Right to erasure — to request deletion of your personal data (“the right to be forgotten”).
• •Right to data portability — to receive your data in a structured, machine-readable format.
• •Right to restriction — to ask us to restrict processing of your data in certain circumstances.
• •Right to object — to object to processing based on legitimate interests.
• •Right to withdraw consent — where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, contact us at admin@casebuddy.co.uk. We will respond within one calendar month.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO).

10. Cookies

We use essential cookies to keep you signed in and analytics cookies (PostHog) to understand how the Service is used. Analytics cookies are only set if you give consent via our cookie banner.

For full details on the cookies we use, their purposes, and how to manage your preferences, see our Cookie Policy.

11. Children

The Service is not intended for use by anyone under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from someone under 18, please contact us immediately at admin@casebuddy.co.uk and we will delete it promptly.

12. Changes to this policy

We may update this Privacy Policy from time to time. For material changes — those that significantly affect your rights or how we use your data — we will notify you by email at least 14 days before the change takes effect. The “last updated” date at the top of this page will always reflect the most recent revision.

13. Contact us

For any questions, concerns, or requests relating to this Privacy Policy or your personal data, please write to us at admin@casebuddy.co.uk. We aim to respond to all enquiries within 5 working days.