These Terms are written for law firms and other businesses. Casey is not offered to consumers. If you are a client of a law firm that uses Casey, your firm's own engagement terms govern your matter; section 7 explains how these Terms apply to you.
1. Who we are and what these Terms cover
1.1. Casey (the "Service") is provided by Piotr Messerszmidt, an entrepreneur running a sole proprietorship under the business name Piotr Messerszmidt Business Services, entered in the Polish Central Register and Information on Economic Activity (CEIDG), tax identification number (NIP) 9512516616, statistical number (REGON) 388507310, with its principal place of business at ul. Bernarda Filarskiego 5 lok. 38, 80-536 Gdańsk, Poland ("we", "us", "our" or the "Provider"). You can reach us at team@hicasey.com.
1.2. These Terms of Service (the "Terms") govern access to and use of the Casey web application (including firm subdomains of hicasey.com and app.hicasey.com), the client portal, and the website at hicasey.com. They form a binding agreement between us and the business that signs up for or subscribes to the Service (the "Customer" or "you").
1.3. You accept these Terms by ticking the acceptance box when you start a free trial, by signing an order form or quote that refers to them (an "Order"), or by using the Service. If you accept on behalf of a firm or other organization, you confirm that you are authorized to bind it, and "Customer" means that organization.
1.4. These Terms are also the rules for providing services by electronic means within the meaning of the Polish Act of 18 July 2002 on Providing Services by Electronic Means.
1.5. If an Order conflicts with these Terms, the Order prevails only where it expressly says which provision it changes. The Data Processing Agreement in the Annex prevails over the rest of these Terms on data protection matters.
2. Definitions
- Authorized User
- An employee, partner or contractor of the Customer whom the Customer allows to use the Service under its account, such as attorneys, paralegals and case managers.
- Client User
- A person whom the Customer invites to the client portal, typically a beneficiary, petitioner or other client of the Customer, or someone acting on their behalf.
- Customer Data
- All data, documents and content that the Customer, its Authorized Users or its Client Users upload to or create in the Service, including questionnaire answers, evidence, drafts and generated documents.
- Seat
- One named Authorized User account. Client Users do not count as Seats.
- Subscription
- The paid plan, number of Seats and billing period chosen by the Customer, as shown in the Service, on the pricing page or in an Order.
3. The Service
3.1. Casey is case-management software for business immigration practices. Depending on the plan, it lets a firm collect client information and documents through a branded portal, organize evidence, manage its team and deadlines, track case status, and prepare letters, forms and filing packages.
3.2. During the Subscription we grant the Customer a non-exclusive, non-transferable, non-sublicensable right for its Authorized Users and Client Users to use the Service for the Customer's internal business purposes, in line with these Terms.
3.3. We develop the Service continuously. We may add, change or remove features, provided that we do not materially reduce the core functionality of a paid plan during a paid billing period. If we do, the Customer may terminate the affected Subscription and receive a pro rata refund of prepaid fees for the remaining period.
3.4. Technical requirements: a current version of Chrome, Edge, Firefox or Safari with JavaScript and cookies enabled, an internet connection, and an email address. Using two-factor sign-in requires an authenticator app.
4. Free trial
4.1. We may offer a free trial of limited length and scope (currently 7 days, sample cases and up to five cases of your own, without client or team invitations). Trial limits are shown in the Service. We may review a trial request before activating it, and we may decline or end a trial at our discretion, for example where we suspect abuse or the sign-up does not appear to come from a business.
4.2. A trial is free and does not turn into a paid Subscription automatically. To continue after the trial, the Customer must agree a Subscription with us.
4.3. We delete a trial account and its data 30 days after the trial ends unless a Subscription has started or you have asked us to keep it while we discuss one.
4.4. The trial is provided "as is". Please do not upload real client data you are not prepared to have deleted at the end of the trial.
5. Accounts and security
5.1. The Customer is responsible for its account, for the accuracy of its account information, and for all activity of its Authorized Users. Each Seat is for one named person; login credentials may not be shared.
5.2. The Customer must keep credentials confidential, should require two-factor sign-in for its team (the Service offers a firm-wide setting for this), and must tell us without delay at team@hicasey.com if it suspects unauthorized access.
5.3. The Customer controls who has access to which matters, including assigning roles, inviting and removing Authorized Users and Client Users, and should remove access promptly when a person leaves the firm or a matter ends.
6. Acceptable use
The Customer and its users must not:
- use the Service in breach of any law, professional conduct rule or third-party right, or to submit false or fraudulent information to any authority;
- upload malware, or content the Customer has no right to process;
- try to access data of another firm or user, probe or bypass security or access controls, or test the Service's vulnerability without our written consent;
- scrape, overload or disrupt the Service, or use it to send spam;
- copy, resell, sublicense or provide the Service to third parties as a service bureau, or reverse engineer it except where the law expressly allows this;
- use the Service to build a competing product.
7. Client Users
7.1. The Customer decides whom to invite to the client portal and what each Client User can see and do. The Customer's relationship with its clients, including fees, advice and the handling of their matters, is solely between the Customer and its clients.
7.2. The Customer is responsible for having a valid basis to share its clients' information through the Service and for giving its clients any notices the law or its professional rules require.
7.3. Client Users may use the portal only for their own matter and must follow section 6. A Client User who has questions about their case, or about how their personal data is used, should contact the firm that invited them. We act on the firm's instructions and do not give Client Users legal or immigration advice.
8. Not legal advice
8.1. Casey is software. We are not a law firm, we do not provide legal advice, and we are not affiliated with U.S. Citizenship and Immigration Services, the U.S. Department of State or any other government body. Use of the Service does not create an attorney-client relationship with us.
8.2. Questionnaires, templates, criteria guides, form mappings, checklists and other content in the Service are general tools that help a firm work. They may not fit a particular case and may not reflect the latest changes in law, policy, fees or form editions. The Customer remains fully responsible for its professional judgment and for reviewing every document, form and filing before it is signed or submitted.
8.3. Case status information shown in the Service (for example, from receipt notices or forwarded emails) is provided for convenience. The official record held by the relevant agency prevails.
8.4. If we offer features that use artificial intelligence to suggest, summarize or draft content, their output may be incomplete or wrong and must be reviewed by a qualified person before use. We will name any AI provider involved in our sub-processor list before such features process Customer Data.
9. Fees and payment
9.1. Fees are charged per Seat according to the plan and billing period selected (annual or monthly), at the prices on our pricing page or in the Order. Unless stated otherwise, prices are in U.S. dollars and billed in advance for each billing period.
9.2. Invoices are payable within 14 days of issue. Prices exclude VAT and other taxes. Where the reverse-charge mechanism applies, the Customer accounts for VAT itself. The Customer bears its own bank and transfer costs.
9.3. Seats added during a billing period are charged pro rata for the rest of that period. Seats removed take effect from the next billing period.
9.4. We may change prices for future billing periods by giving at least 30 days' notice before the renewal date. The new price applies from the next renewal unless the Customer cancels before it.
9.5. If an invoice is more than 14 days overdue, we may, after a reminder giving at least 7 more days to pay, suspend access until payment is received. The Customer's data is kept during the suspension. We may also charge statutory interest for late payment in commercial transactions under Polish law.
9.6. Fees paid are non-refundable, except where these Terms expressly provide for a refund.
10. Term, renewal and termination
10.1. A Subscription runs for the billing period chosen and renews automatically for the same period unless either party cancels before the end of the current period. The Customer may cancel at any time by writing to team@hicasey.com, with effect at the end of the paid period.
10.2. Either party may terminate the agreement with immediate effect by written notice if the other party materially breaches these Terms and does not cure the breach within 30 days of being notified of it.
10.3. We may suspend access of a specific user or account immediately if it is needed to stop a security threat, a serious breach of section 6, or unlawful activity, or if a court or authority requires it. We will tell the Customer the reason and restore access as soon as the cause is removed.
10.4. If we decide to discontinue the Service, we will give at least 90 days' notice and refund prepaid fees for the period after the end date.
11. Your data
11.1. The Customer (or its clients) owns all Customer Data. We obtain no rights in it other than the right to host, process, transmit and display it as needed to provide, secure and support the Service, in line with the Customer's instructions and the Data Processing Agreement.
11.2. We do not sell Customer Data, use it for advertising, or use it to train artificial intelligence models. We may use aggregated technical and usage metrics (for example, page load times or how often a feature is used) that do not identify the Customer, any person or any case, to operate and improve the Service.
11.3. The Customer can export its cases, documents and filing packages at any time while its account is active. After the agreement ends, we keep Customer Data available for export for 30 days on request, then delete it within a further 60 days, including from backups on their normal rotation, unless the law requires us to keep it.
11.4. The Customer is responsible for the lawfulness, accuracy and content of Customer Data and for keeping its own copies of anything it is required to retain under its professional or record-keeping rules.
12. Our intellectual property
12.1. We and our licensors own the Service, including its software, design, templates, questionnaires, guides, and the Casey name and logo. Except for the rights expressly granted in these Terms, no rights are transferred to the Customer.
12.2. Documents the Customer generates from its own Customer Data using our templates belong to the Customer, and it may use them freely for its matters.
12.3. If the Customer sends us feedback or suggestions, we may use them without restriction or payment. We will not identify the Customer as their source without consent.
12.4. We may name the Customer as a user of Casey (name and logo) in customer lists only with the Customer's prior consent, which it may withdraw at any time.
13. Confidentiality
13.1. Each party will keep the other's non-public business, technical and financial information, and in our case all Customer Data, confidential, use it only to perform the agreement, and share it only with personnel, contractors and advisers who need it and are bound by equivalent confidentiality duties.
13.2. These duties do not apply to information that is or becomes public without fault of the receiving party, was lawfully known to it before, or is independently developed. A party may disclose information where required by law or a court, after notifying the other party where legally allowed so that it can seek protection.
13.3. We will not access Customer Data except as needed to provide or secure the Service, to provide support the Customer has asked for, or to comply with the law. We understand that Customer Data may be subject to attorney-client privilege or work-product protection, and nothing in our handling of it is intended to waive those protections.
13.4. These duties last for the term of the agreement and 5 years after it, and for Customer Data for as long as we hold it.
14. Data protection
14.1. For personal data in Customer Data, the Customer is the controller and we are its processor. The Data Processing Agreement in the Annex applies and forms part of these Terms.
14.2. For account, billing and communication data about the Customer's contact persons and Authorized Users, we act as an independent controller as described in our Privacy Policy.
15. Availability and support
15.1. We use reasonable efforts to keep the Service available and secure, but we do not guarantee uninterrupted or error-free operation. We carry out planned maintenance outside U.S. business hours where possible and announce longer planned downtime in advance.
15.2. Support is available by email at team@hicasey.com on Polish and Spanish business days. We aim to reply within one business day.
15.3. Complaints about the Service may be sent to the same address. Please describe the problem and the account concerned. We will respond within 14 days.
16. Warranties and disclaimers
16.1. We warrant that we will provide the Service with professional care and in substantial accordance with its description on our website, and that we will not knowingly introduce malicious code into it. If the Service does not conform, the Customer's remedy is for us to fix the problem within a reasonable time or, if we cannot, for the Customer to terminate the affected Subscription and receive a refund of prepaid fees for the remaining period.
16.2. Except as stated in these Terms and to the extent permitted by law, the Service is provided "as is" and "as available". We exclude all other warranties, whether express or implied, including fitness for a particular purpose. The parties exclude the statutory warranty for defects (rękojmia) to the extent the law allows.
16.3. We are not responsible for the outcome of any petition, application or filing, for decisions of any authority, or for missed deadlines that result from the Customer's own data, settings or decisions.
17. Limitation of liability
17.1. Neither party is liable for lost profits, lost revenue, loss of goodwill, or indirect or consequential damage.
17.2. Each party's total liability arising out of or in connection with the agreement is limited to the fees paid and payable by the Customer for the 12 months before the event giving rise to the claim. For a free trial, our total liability is limited to EUR 100.
17.3. The limits in this section do not apply to damage caused intentionally, to the Customer's obligation to pay fees, to a party's indemnity obligations under section 18, or to any other liability that cannot be limited under applicable law.
18. Indemnities
18.1. We will defend the Customer against any third-party claim alleging that the Service, as provided by us, infringes that party's intellectual property rights, and pay the damages and costs finally awarded or agreed in settlement. If such a claim is made or likely, we may obtain the right for the Customer to continue using the Service, modify it to be non-infringing, or end the Subscription and refund prepaid fees for the remaining period. This does not apply to claims caused by Customer Data or by use of the Service in breach of these Terms.
18.2. The Customer will defend us against any third-party claim arising from Customer Data, from the Customer's use of the Service in breach of these Terms or the law, or from the Customer's relationship with its clients, and pay the damages and costs finally awarded or agreed in settlement.
18.3. The indemnified party must promptly notify the other of the claim, let it control the defense and settlement, and cooperate reasonably at its expense. No settlement may impose obligations on the indemnified party without its consent.
19. Changes to these Terms
19.1. We may change these Terms for valid reasons, such as changes in the law, in the Service or in our business, including a transfer of the Service to a company under section 21.2. We will publish the new version on this page and email the Customer's account owner at least 30 days before material changes take effect.
19.2. If the Customer does not accept a material change, it may terminate the agreement before the change takes effect and receive a pro rata refund of prepaid fees for the remaining period. Otherwise, the changed Terms apply from their effective date.
20. Governing law and disputes
20.1. These Terms and any dispute arising out of or in connection with them are governed by the laws of Poland, excluding its conflict-of-law rules and the UN Convention on Contracts for the International Sale of Goods.
20.2. The parties will first try to resolve any dispute in good faith by contacting each other in writing. If it is not resolved within 30 days, the dispute will be decided by the common court competent for Gdańsk, Poland.
21. General
21.1. Business use only. The Customer confirms that it enters into the agreement in direct connection with its business or professional activity and that the agreement is of a professional nature for it.
21.2. Assignment. The Customer may not transfer the agreement without our written consent. We may transfer the agreement, with all our rights and obligations, to a company that takes over the Service, including a company established or controlled by Piotr Messerszmidt, by notifying the Customer at least 30 days in advance. The Customer may terminate the agreement before the transfer takes effect if it objects to it on reasonable grounds.
21.3. Subcontractors. We may use subcontractors and service providers to deliver the Service. We remain responsible for them as for our own acts.
21.4. Force majeure. Neither party is liable for delay or failure caused by events beyond its reasonable control, such as natural disasters, war, epidemics, actions of authorities, or large-scale failures of internet, power or hosting infrastructure. Payment obligations are not suspended.
21.5. Notices. Notices are given by email: to us at team@hicasey.com, and to the Customer at the email address of its account owner, or as stated in an Order. Operational notices may also be shown in the Service.
21.6. Entire agreement. These Terms, any Order and the Data Processing Agreement are the entire agreement between the parties about the Service and replace any prior arrangements about it. Terms in the Customer's purchase orders or other documents do not apply.
21.7. Severability and waiver. If any provision is invalid, the rest remains in force and the invalid provision is replaced by a valid one closest to its purpose. Not enforcing a right is not a waiver of it.
21.8. Language. These Terms are drawn up in English. Translations are for convenience only.
Data Processing Agreement
This Data Processing Agreement ("DPA") forms part of the Terms between the Customer (as controller) and the Provider (as processor). It sets out the terms required by Article 28 of the General Data Protection Regulation (EU) 2016/679 ("GDPR") and applies equally where the Customer is subject to other data protection laws, including U.S. state privacy laws, to the extent they apply to the processing.
A. Subject matter and details of processing
- Subject matter and duration
- Hosting and processing of Customer Data to provide the Service, for the term of the agreement and until deletion under clause H.
- Nature and purpose
- Storage, organization, retrieval, display, transmission (including email notifications), generation of documents and forms, and deletion, solely to provide, secure and support the Service.
- Data subjects
- The Customer's clients (beneficiaries, petitioners, investors and employers' representatives), their family members and dependents, recommenders and other people named in case files, and the Customer's Authorized Users.
- Categories of personal data
- Identification and contact data; dates and places of birth; passport, visa, travel and immigration history; Social Security and other government identification numbers; education, employment, compensation and professional achievement records; company, ownership and investment information; family and relationship details; signatures; and any other data the Customer chooses to upload, such as documents in evidence.
- Special categories
- The Customer decides whether to upload special category data (for example, health information in a waiver request) or data relating to criminal convictions and offences. Where it does, the Customer is responsible for having a lawful basis, and the security measures in clause D apply.
B. Instructions
B.1. We process Customer personal data only on the Customer's documented instructions. The Terms, the Customer's configuration and use of the Service, and any further written instructions are the Customer's complete instructions, unless EU or Member State law requires otherwise, in which case we will inform the Customer before processing unless the law prohibits it.
B.2. We will inform the Customer immediately if, in our opinion, an instruction infringes data protection law.
B.3. We do not sell or share Customer personal data within the meaning of the California Consumer Privacy Act or similar laws, and do not retain, use or disclose it outside our direct business relationship with the Customer.
C. Confidentiality
We ensure that every person authorized to process Customer personal data is bound by confidentiality and accesses it only as needed for the purposes in clause A.
D. Security
We implement appropriate technical and organizational measures under Article 32 GDPR, including:
- encryption of all traffic in transit (TLS), and application-level encryption of sensitive fields such as Social Security numbers, which are also masked on screen and kept out of logs;
- passwords stored only as salted hashes, optional and firm-enforceable two-factor authentication, and rate limiting of sign-in attempts;
- logical separation of each firm's data, sessions pinned to the firm's own address, and role- and matter-based access control for team members and Client Users;
- files served only after an access check, with protections against executing uploaded content in the browser;
- a per-firm audit log of views of sensitive documents and of security-relevant changes;
- managed hosting with automated database backups, and restricted administrative access to production systems;
- regular review of these measures as the Service evolves.
E. Sub-processors
E.1. The Customer gives general authorization for us to engage sub-processors. Our current sub-processors are:
| Sub-processor | Purpose | Location |
|---|---|---|
| Render Services, Inc. | Application hosting, database and file storage | United States (Oregon) |
| Cloudflare, Inc. | File storage and bot protection on sign-up forms | United States and global network |
| Resend (Plus Five Five, Inc.) | Sending and receiving email notifications | United States |
E.2. We will notify the Customer by email at least 14 days before adding or replacing a sub-processor. The Customer may object on reasonable data protection grounds within that period. If we cannot address the objection, the Customer may terminate the affected Subscription and receive a pro rata refund of prepaid fees.
E.3. We impose on each sub-processor, by written contract, data protection obligations that offer at least the same level of protection as this DPA, and we remain liable to the Customer for their performance.
F. International transfers
F.1. We are established in the European Union. Customer personal data is hosted in the United States with the sub-processors listed above. For such transfers we rely on the recipient's certification under the EU-U.S. Data Privacy Framework where available, and otherwise on the European Commission's Standard Contractual Clauses (Module Three, processor to processor) with appropriate supplementary measures.
F.2. Where the Customer is established outside the European Economic Area in a country without an adequacy decision, the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, Module Four (processor to controller), are incorporated into this DPA by reference for transfers of Customer personal data from us to the Customer. For that purpose, we are the data exporter, the Customer is the data importer, clause 17 is governed by the law of Poland, and disputes are resolved by the courts of Poland. The information in clause A completes Annex I, and clause D completes Annex II.
G. Assistance
G.1. Taking into account the nature of the processing, we assist the Customer by appropriate technical and organizational measures in responding to data subject requests (access, rectification, erasure, restriction, portability and objection). Most requests can be handled directly in the Service. If a data subject contacts us directly, we will refer them to the Customer and will not respond on the Customer's behalf without its instruction.
G.2. We assist the Customer, at its reasonable request, with data protection impact assessments and prior consultations with supervisory authorities concerning the Service.
G.3. Personal data breaches. We will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer personal data. The notice will describe, as far as then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, likely consequences, and the measures taken or proposed. We will update the Customer as more information becomes available and take reasonable steps to contain and remedy the breach.
G.4. Requests from authorities. If a public authority requests access to Customer personal data, we will refer it to the Customer where possible, notify the Customer unless legally prohibited, and disclose only what we are legally compelled to disclose after assessing the lawfulness of the request.
H. Return and deletion
At the end of the agreement, the Customer can export its data as described in section 11.3 of the Terms. We then delete Customer personal data, including copies held by sub-processors, within the period stated there, unless EU or Member State law requires us to keep it. We will confirm deletion in writing on request.
I. Audits
I.1. We make available to the Customer the information necessary to demonstrate compliance with this DPA, including answers to reasonable security questionnaires and documentation of our measures.
I.2. Where that information is not sufficient, or where a supervisory authority requires it, the Customer may carry out an audit, itself or through an independent auditor bound by confidentiality, no more than once a year, on at least 30 days' written notice, during business hours, without access to other customers' data, and at its own cost.
J. Liability and precedence
Each party's liability under this DPA is subject to section 17 of the Terms, except where the law does not allow it to be limited. In case of conflict, the Standard Contractual Clauses (where they apply) prevail over this DPA, and this DPA prevails over the rest of the Terms.