In short: we collect what we need to run Casey and to talk to firms interested in it. We do not sell personal data, we do not use advertising or analytics cookies, and we do not use case data to train AI. If you are a client of a law firm that uses Casey, your firm controls your case data and is your first point of contact (see section 3).
1. Who is responsible for your data
The controller of the personal data described in this policy is Piotr Messerszmidt, an entrepreneur running a sole proprietorship under the business name Piotr Messerszmidt Business Services, entered in the Polish Central Register and Information on Economic Activity (CEIDG), NIP 9512516616, REGON 388507310, with its principal place of business at ul. Bernarda Filarskiego 5 lok. 38, 80-536 Gdańsk, Poland ("Casey", "we", "us").
For any privacy question or request, write to team@hicasey.com or to the postal address above. We have not appointed a data protection officer, as we are not required to; the founder handles privacy matters personally.
2. What this policy covers
This policy explains how we handle personal data when you:
- visit our website at hicasey.com;
- contact us, book a demo, or otherwise talk to us about Casey;
- start a free trial;
- use Casey as a member of a law firm's team (an "Authorized User"), or act as a firm's contact for its subscription and billing.
3. If you are a law firm's client
Law firms use Casey to collect information and documents from their clients and to prepare their cases. For that data, including everything you enter or upload in your firm's client portal, the law firm is the controller and decides why and how it is used. We act only as the firm's processor, on its instructions and under a data processing agreement with it.
The firm's own privacy notice applies to that data. If you want to access, correct or delete your case information, or have questions about how it is used, please contact your firm. If you contact us, we will pass your request on to the firm.
4. What we collect and why
| Situation | Data | Purpose | Legal basis (GDPR) |
|---|---|---|---|
| Website visit | IP address, browser and device information, pages requested, time of request (in server logs) | Delivering the website, keeping it secure, diagnosing errors | Legitimate interests, Art. 6(1)(f) |
| Contact form or email | Name, email address, firm, message, and anything else you choose to tell us | Answering you and following up on your enquiry | Steps at your request before a contract, Art. 6(1)(b); legitimate interests, Art. 6(1)(f) |
| Booking a demo | Name, email address, chosen time, and answers you give in the booking form (collected through Calendly) | Scheduling and holding the demo | Steps at your request before a contract, Art. 6(1)(b) |
| Free trial sign-up | Name, work email address, firm name, password (stored only as a hash), IP address, results of automated checks on the email domain and of the bot-protection check | Creating the trial account; preventing fake, automated or abusive sign-ups | Contract, Art. 6(1)(b); legitimate interests in preventing abuse, Art. 6(1)(f) |
| Using Casey as a team member | Name, email address, role, profile photo (optional), firm, notification preferences, two-factor settings, sign-in records (time, IP address, failed attempts), audit log entries of your actions | Providing your account, keeping it secure, enforcing access rights, and giving your firm an audit trail | Contract with the firm, Art. 6(1)(b); legitimate interests of us and your firm in security and accountability, Art. 6(1)(f) |
| Subscription and billing | Name and contact details of the billing contact, firm details, tax ID, invoices and payment records | Invoicing, collecting payment, accounting and tax compliance | Contract, Art. 6(1)(b); legal obligation, Art. 6(1)(c) |
| Service and product emails | Name and email address of account owners and team members | Notifications you set up, security alerts, important changes to the Service or these policies | Contract, Art. 6(1)(b); legitimate interests, Art. 6(1)(f) |
| Sales outreach and product news | Business contact details, such as name, firm, role, work email and public professional information | Telling firms about Casey and keeping in touch with customers | Legitimate interests, Art. 6(1)(f), or your consent where the law requires it, Art. 6(1)(a) |
| Legal claims and compliance | Any of the above, as needed | Establishing, exercising or defending legal claims; responding to lawful requests from authorities | Legitimate interests, Art. 6(1)(f); legal obligation, Art. 6(1)(c) |
Where we rely on legitimate interests, those interests are running and securing our business, preventing fraud, and communicating with businesses about our product. You can object to this at any time (see section 10).
Giving us your data is voluntary, but without your name and email address we cannot answer your enquiry or create an account, and without billing details we cannot provide a paid subscription.
5. Where the data comes from
Mostly from you. If your firm invited you to Casey, your firm gave us your name, email address and role. For sales outreach, we may collect business contact details from public sources, such as firm websites, bar directories and professional networks. If we contact you this way, we will tell you where we found your details in our first message.
6. Automated checks
To protect the free trial from abuse, sign-ups go through automated checks: whether the email domain can receive mail, whether it belongs to a disposable or personal email service, how many sign-ups were made recently, and a bot-protection challenge. These checks can hold a sign-up for review, but a person decides whether to approve or decline it. We do not make decisions based solely on automated processing that have legal or similarly significant effects on you.
7. Who we share data with
We do not sell personal data or share it for advertising. We share it only with:
- Service providers who host and run Casey and our business on our behalf, under contracts that require them to protect the data and use it only for our instructions:
Provider Role Location Render Services, Inc. Hosting of the website, application, database and files United States Cloudflare, Inc. File storage and bot protection (Turnstile) on sign-up and sign-in United States and global network Resend (Plus Five Five, Inc.) Sending and receiving email United States Calendly LLC Demo scheduling United States Google LLC (Google Fonts) Delivering the fonts used on the website, which involves your browser sending your IP address to Google United States Google Cloud EMEA Limited (Google Workspace) Our business mailbox, where contact-form messages and emails to team@hicasey.com arrive European Union, United States and other countries - Professional advisers, such as our accounting office, tax advisers and lawyers, who are bound by professional secrecy.
- Authorities, when we are legally required to disclose data, for example to tax authorities or under a court order.
- A successor business. We currently run Casey as a sole proprietorship and may transfer it to a company, for example one established by the founder in Poland, Spain or the United States, or as part of a sale or reorganization. The successor would continue to handle your data under this policy, and we will tell you before that happens.
Law firms that use Casey can see the data of their own team members (for example, names, roles and audit log entries) through the Service.
8. International transfers
We are based in the European Union, but our hosting and some of our service providers are in the United States. When personal data is transferred outside the European Economic Area, we rely on the recipient's certification under the EU-U.S. Data Privacy Framework where available, and otherwise on the European Commission's Standard Contractual Clauses, together with additional safeguards such as encryption in transit. You can ask us for a copy of the relevant safeguards at team@hicasey.com.
9. How long we keep it
| Data | How long |
|---|---|
| Website server logs | Up to 30 days, as set by our hosting provider |
| Enquiries and demo bookings that do not lead to a subscription | Up to 2 years after our last contact |
| Trial sign-up requests that were not completed or were declined | Up to 90 days |
| Trial accounts | Deleted 30 days after the trial ends, unless a subscription starts or you ask us to keep it while we talk |
| Team member accounts and audit logs | While the firm's subscription is active, then deleted together with the firm's data (within 90 days after the subscription ends) |
| Invoices and accounting records | 5 years from the end of the calendar year in which the tax obligation arose, as required by Polish tax law |
| Data needed for a legal claim | Until the claim is resolved or time-barred |
Deleted data may remain in backups for a short time until they are overwritten on their normal rotation.
10. Your rights
Under the GDPR you have the right to:
- access your personal data and receive a copy of it;
- have inaccurate data corrected;
- have your data deleted, or its use restricted, in the cases set out in the law;
- receive data you gave us in a portable format, where processing is based on contract or consent;
- object at any time to processing based on our legitimate interests, and always to direct marketing;
- withdraw consent at any time, where we rely on it, without affecting earlier processing;
- lodge a complaint with a supervisory authority. Our lead authority is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl). You may also complain to the authority in the country where you live or work, such as the Spanish Agencia Española de Protección de Datos.
To use your rights, email team@hicasey.com. We will reply within one month and may ask you to confirm your identity. Team members can also update their profile and notification settings directly in Casey.
11. Cookies and similar technologies
Website. Our website does not set cookies and does not use analytics, advertising or tracking tools. Fonts are loaded from Google Fonts, and the "Book a demo" button opens Calendly, which applies its own cookie policy.
Casey application. The application uses only cookies and browser storage that are strictly necessary: a session cookie to keep you signed in, short-lived cookies used during sign-in and two-factor verification, and browser storage for display preferences such as table column layout. Cloudflare Turnstile may process technical signals from your browser to tell people from bots. Because these are necessary to provide the service you asked for, they do not require consent. You can clear them in your browser settings, but you will then be signed out.
12. Security
We protect personal data with measures appropriate to its sensitivity, including encryption in transit, encryption of sensitive fields, hashed passwords, two-factor sign-in, per-firm separation of data, role-based access and audit logging. Read more on our Security page. No system is perfectly secure; if a breach affects your data and poses a risk to you, we will tell you and the authorities as the law requires.
13. U.S. residents
Casey serves businesses, and we handle personal data of their staff and contacts in that business context. We do not sell personal information or share it for cross-context behavioral advertising, and we do not use or disclose sensitive personal information for purposes other than providing the Service. Wherever you live, you can ask us to access, correct or delete your personal data using the contact details above, and we will not treat you differently for doing so.
14. Children
Casey is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 16 for our own purposes. Case data about minors (for example, a beneficiary's dependent children) is entered and controlled by the law firm, as described in section 3.
15. Changes to this policy
We will update this policy when our services, providers or legal obligations change, and show the date of the latest version at the top. If changes are significant, for example a transfer of Casey to a new company, we will tell account owners by email in advance.