Legal

Privacy Policy

Effective Date: December 10, 2025
Last Updated: October 2, 2026

Introduction

CaseMark, Inc. ("case.dev," "we," "us," or "our") operates the case.dev platform, including our API services, Console dashboard, Documentation site, and Orbit Compute platform (collectively, the "Services").

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Services. We are committed to protecting the privacy of our users, particularly given the sensitive nature of legal data our platform processes.

Please read this Privacy Policy carefully. By accessing or using our Services, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy.

Information We Collect

Information You Provide Directly

Account Information

• Name and email address
• Organization name and details
• Password (stored in hashed form)
• Profile information
• Communication preferences

Payment Information

• Billing address
• Payment method details (processed securely via Stripe)
• Transaction history
• For Payments Platform users: IOLTA account information, trust account details, and settlement data

Content and Documents

• Documents uploaded to our Vault API (PDFs, DOCX, images, and other file formats)
• Audio and video files submitted for transcription
• Text content submitted for AI processing
• Files deployed through Orbit Compute

Communications

• Support requests and correspondence
• Feedback and survey responses
• Any other information you choose to provide

Information Collected Automatically

Usage Data

• API calls and endpoints accessed
• Features used and actions taken
• Token usage and model selections
• Processing times and performance metrics
• Error logs and debugging information

Device and Connection Information

• IP address
• Browser type and version
• Operating system
• Device identifiers
• Referring URLs and exit pages

Authentication Data

• Login timestamps
• Session information
• OAuth tokens (encrypted) for GitHub and other integrations

Information from Third Parties

OAuth Providers

When you connect an OAuth provider, we receive account information, authorized content, and access tokens necessary to provide the integration features you request.

Google Workspace: Google Drive, Gmail, and Google Calendar

When you connect a Google Account, Case.dev may access the following Google user data, depending on the permissions you grant and the features you use:

• Your Google Account email address and basic profile information
• OAuth access and refresh tokens and the scopes you granted
• Google Drive file and folder names, identifiers, types, parent relationships, modification times, versions, and sync status
• The contents of Google Drive files and folders that you link to Case.dev or otherwise direct Case.dev to process
• Requested Gmail message and thread identifiers, headers, bodies, attachments, labels, draft and send results, and mailbox change information
• Requested Google Calendar identifiers, event details, timezone and attendee information, availability, event-change results, and synchronization information

Case.dev uses Google Drive access to let you browse and select a folder and to synchronize additions and updates in both directions between that folder and a linked Vault. Although the permission can provide broader visibility and modification capability across your Drive, Case.dev uses it only for actions you initiate: browsing for a folder, importing and keeping current the folder you select, and creating or overwriting corresponding Drive files when the linked Vault changes. Synchronization is limited to the selected folder. Under the default preservation policy, deleting linked content on one side does not delete its counterpart on the other side.

Gmail and Google Calendar connections provide separately authorized read-only and assist access to your authenticated application. Read-only access does not send email or change calendar events. Assist access allows supported actions only when your application explicitly requests them: creating a Gmail draft, sending a specified existing draft as a separate action, or creating, updating, or cancelling a specified calendar event. Available features depend on the permissions you grant and the supported operations of the connector; these integrations are currently in a private pilot, not generally available.

How We Use Google Workspace Data

• Authenticate and maintain the Google Drive, Gmail, or Google Calendar connections you authorize
• Let you browse and select Google Drive folders and files
• Synchronize changes in both directions between linked Google Drive content and your organization's Case.dev Vault
• Process linked content through user-facing Vault features that you request, such as text extraction, indexing, search, and retrieval
• Detect additions, updates, moves, and deletions and reconcile linked content according to the configured preservation settings
• Search and retrieve the Gmail messages, threads, and attachments your application requests
• Create a requested Gmail draft and, upon a separate explicit request, send a specified existing draft
• List requested calendars, retrieve events within a bounded time window, and check availability
• Perform supported, explicitly requested calendar event creation, update, and cancellation
• Use mailbox history and calendar synchronization cursors to detect changes; provider notifications are synchronization signals, not message or event content

Storage, Retention, and Deletion of Google Workspace Data

• Google OAuth credentials are protected using KMS-backed envelope encryption and are retained only while needed to maintain the connection
• Imported Google Drive content and derived data are stored in your organization-isolated Case.dev Vault and follow the Vault retention and deletion terms in this policy
• Disconnecting Google Drive revokes the connection and deletes stored OAuth credentials; imported Vault copies remain until you delete or purge them
• Under the default preservation policy, deleting imported content from Case.dev does not delete the original content from Google Drive; a Drive deletion requires a separate authorized action that you direct Case.dev to perform
• Gmail and Google Calendar connector records include account and connection identifiers, granted permissions, synchronization cursors, provider resource identifiers, action receipts, and version evidence. These records remain after ordinary disconnect. The action ledger does not store full message bodies, attachments, or event bodies
• Requested Gmail and Calendar content is returned to the authorized calling application. A connection alone does not import your mailbox or calendar into Vault or submit it to an AI model. If you direct content into another Case.dev feature or CaseMark-operated application, any stored copies and derived data remain subject to the applicable CaseMark service terms. Copies retained by an independently operated application are controlled by that application
• Disconnecting a Gmail or Calendar connection disables further access through that connection and clears OAuth credentials from its live database record. This is not a statement that backups, caches, or already-dispatched requests are erased. Disconnect does not delete Google mailbox or calendar content, copies already transferred to another application or feature, or retained operational and audit records. You may request deletion of retained Case.dev records through the contact methods below, subject to applicable retention obligations and exceptions
• Per-connection Gmail and Calendar disconnect does not revoke the Google project's shared authorization. To remove Google-side access, follow the steps below. Removing that access can interrupt other Case.dev Google integrations using the same project. Disconnect cannot retract a request already sent to Google

Disconnect is not a deletion request for retained records or copies. To request access, export, or deletion of retained Case.dev records, email privacy@case.dev. Applicable contractual deletion and return obligations are set out in our Data Processing Agreement, Section 4.8. Ordinary disconnect does not complete that process or impose a new deletion deadline.

Remove Google-side access

1. Sign in to the Google Account used for the connection and open your Google Account's third-party connections.
2. Select the Case.dev app associated with the connection, then select See details under its access to your Google Account. If multiple Case.dev or preview apps are listed, check the app name and permissions before selecting one.
3. Review the permissions, select Remove access, and confirm. This stops access through that Google authorization, not just one Case.dev connection, and may interrupt other integrations using it.
4. Disconnect the affected Case.dev connection separately to clear credentials from its live database record. Removing Google-side access does not itself erase copies or operational records already held by Case.dev or another application; use the deletion-request contact methods in this policy for retained Case.dev data.

See Google's instructions for managing linked apps for the current controls. These steps remove access to Google data; they do not delete your Google Account.

Sharing and Human Access to Google Workspace Data

We do not sell Google Workspace data or use it for advertising, retargeting, creditworthiness, or lending purposes. We do not use Google Workspace data to train generalized or non-personalized artificial intelligence or machine learning models. We transfer Google Workspace data only to service providers when necessary to provide a user-facing feature you request, for security purposes, to comply with law, or as otherwise permitted with your consent. Humans do not read Google Workspace data except with your affirmative consent, when necessary for security or abuse investigation, when required by law, or when the data has been aggregated and anonymized for permitted internal operations.

For Gmail and Calendar connections, Vercel processes connector API requests and responses on its application infrastructure. Neon hosts encrypted OAuth credentials, connection and synchronization metadata, and non-content action records in the platform database. AWS provides key management and operational telemetry infrastructure. Google provides the Gmail and Calendar APIs and notification delivery. Clerk provides Case.dev account authentication. These providers perform their respective service functions; connecting Gmail or Calendar does not send mailbox or event bodies to Clerk for account authentication.

If you explicitly submit Google Workspace content to Vault, OCR, embeddings, or an LLM feature, that content is processed by the infrastructure and model providers used for the requested feature. Vault uses AWS storage; LLM requests use the selected model provider, such as OpenAI, Anthropic, or Google, and applicable routing infrastructure, such as Vercel. Stored copies follow the applicable feature terms in this policy. Connecting Gmail or Calendar alone does not send your mailbox or calendar to every listed provider or authorize unrelated processing. The Google Workspace Limited Use restrictions above also apply to downstream processing we arrange. See our Data Processing Agreement and Trust Center for further provider information.

Google API Limited Use

Case.dev's use and transfer of information received from Google Workspace APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. If another provision of this Privacy Policy conflicts with this section, this section controls for data received from Google Workspace APIs.

Payment Processors

Stripe provides transaction confirmation and payment status information

AI Model Providers

When using BYOK (Bring Your Own Key), we route requests through your provider accounts

How We Use Your Information

Providing and Improving Services

• Process documents through our OCR, transcription, and AI services
• Store and index documents in Vault for semantic search
• Execute workflows and automations you configure
• Deploy applications through Orbit
• Process payments and manage trust accounts through our Payments Platform
• Provide customer support and respond to inquiries
• Analyze usage patterns to improve our Services
• Detect, prevent, and address technical issues

Communication

• Send transactional emails (API notifications, billing receipts)
• Provide service updates and announcements
• Respond to support requests
• Send marketing communications (with your consent)

Legal and Security

• Comply with legal obligations
• Enforce our Terms of Service
• Protect against fraudulent, unauthorized, or illegal activity
• Maintain audit logs for compliance purposes

Aggregate and Anonymized Data

We may create aggregate or anonymized data from your information that cannot reasonably be used to identify you. We may use such data for any purpose, including research, analytics, and service improvement.

Document and Content Processing

How We Handle Your Documents

Vault API

• Documents are stored in encrypted S3 buckets with KMS encryption
• Each vault has organization-level isolation
• Semantic embeddings are generated for search functionality
• Metadata you provide is stored alongside documents

OCR/Vision API

• Documents are processed to extract text
• Processed files are stored temporarily (7 days by default)
• Extracted text may be retained for your subsequent use

Voice API

• Audio files are processed for transcription
• PII redaction is available and performed upon request
• Transcripts are stored according to your configuration

LLM API

• Prompts and responses are processed through AI models
• We do not train AI models on your data
• BYOK requests are routed directly to your provider

Data We Do Not Use

• We do not train AI models on your documents, code, or content
• We do not share your documents with other customers
• We do not access your documents except as necessary to provide the Services or as required by law

Data Storage and Security

Security Measures

We implement industry-standard security measures including:

• Encryption at Rest: All data encrypted using AWS KMS
• Encryption in Transit: TLS 1.3 for all API communications
• Access Controls: Role-based access control (RBAC) with organization-level isolation
• Authentication: Secure API key management with hashed storage
• Audit Logging: Comprehensive activity logs with IP and user agent tracking
• Infrastructure: Multi-tenant architecture with isolated resources

Payments Platform Security

For users of our Payments Platform:

• PCI-DSS Level 1 compliance (via Stripe Connect)
• Double-entry ledger with immutable transaction history
• IOLTA compliance features for trust accounting
• Complete audit trails for regulatory requirements

Data Location

Our Services are hosted on Amazon Web Services (AWS) infrastructure located in the United States. By using our Services, you consent to the transfer and processing of your data in the United States.

Data Retention

Retention Periods

Deletion

You may delete your content at any time through the Console or API. When you delete content:

• Documents are removed from storage
• Vector embeddings are deleted
• Cached data is purged
• Some metadata may be retained in backup systems for up to 30 days

When you close your account, we will delete your data within 30 days, except where retention is required by law or for legitimate business purposes (such as fraud prevention or compliance).

Sharing and Disclosure

Service Providers

We share information with third-party service providers who perform services on our behalf:

Legal Requirements

We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., court orders, subpoenas, government agencies).

Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred. We will provide notice before your information becomes subject to a different privacy policy.

With Your Consent

We may share your information for other purposes with your explicit consent.

What We Do Not Sell

We do not sell your personal information to third parties for their marketing purposes.

Your Rights and Choices

Access and Portability

You have the right to:

• Access the personal information we hold about you
• Request a copy of your data in a portable format
• Review usage and billing information through the Console

Correction

You may update or correct your account information at any time through the Console or by contacting support.

Deletion

You may:

• Delete specific documents, vaults, or content at any time
• Request deletion of your account and associated data
• Exercise your right to be forgotten (subject to legal retention requirements)

Objection and Restriction

You may object to or request restriction of certain processing activities. Note that some objections may limit your ability to use the Services.

Data Protection Rights by Jurisdiction

California Residents (CCPA/CPRA)

• Right to know what personal information is collected
• Right to delete personal information
• Right to opt-out of sale of personal information (we do not sell data)
• Right to non-discrimination for exercising privacy rights
• Right to correct inaccurate personal information
• Right to limit use of sensitive personal information

European Economic Area Residents (GDPR)

• Right of access (Article 15)
• Right to rectification (Article 16)
• Right to erasure (Article 17)
• Right to restriction of processing (Article 18)
• Right to data portability (Article 20)
• Right to object (Article 21)
• Rights related to automated decision-making (Article 22)

To Exercise Your Rights: Contact us at privacy@case.dev or through the Console.

Cookies and Tracking

Cookies We Use

Managing Cookies

You can control cookies through your browser settings. Note that disabling certain cookies may affect the functionality of our Services.

Do Not Track

We currently do not respond to "Do Not Track" browser signals, as there is no industry standard for such signals.

Third-Party Services

Our Services integrate with third-party services that have their own privacy policies:

• Stripe: https://stripe.com/privacy
• GitHub: https://docs.github.com/en/site-policy/privacy-policies
• Clerk: https://clerk.com/privacy
• OpenAI: https://openai.com/privacy
• Anthropic: https://www.anthropic.com/privacy
• Google Cloud: https://cloud.google.com/privacy
• AWS: https://aws.amazon.com/privacy

We encourage you to review the privacy policies of any third-party services you connect to through our platform.

Children's Privacy

Our Services are not directed to children under 16 years of age. We do not knowingly collect personal information from children under 16. If we learn that we have collected personal information from a child under 16, we will take steps to delete that information promptly.

If you believe we have inadvertently collected information from a child under 16, please contact us at privacy@case.dev.

International Data Transfers

If you are located outside the United States, please be aware that your information will be transferred to, stored, and processed in the United States where our servers are located.

For transfers from the European Economic Area, we rely on:

• Standard Contractual Clauses approved by the European Commission
• Your explicit consent where applicable
• Necessity for the performance of a contract

Legal Basis for Processing (GDPR)

If you are in the European Economic Area, our legal basis for collecting and using your information includes:

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the "Last Updated" date at the top of this policy
• Notify you by email (for material changes)
• Post a notice on our website or Console

We encourage you to review this Privacy Policy periodically for any changes. Your continued use of our Services after any modifications indicates your acceptance of the updated Privacy Policy.

Contact Us

If you have questions about this Privacy Policy or our privacy practices, please contact us:

Email: privacy@case.dev

Mail:
CaseMark, Inc.
Attn: Privacy Team
[Address]

Data Protection Officer: dpo@case.dev

For support inquiries: support@case.dev

Additional Information for Specific Services

Vault API Users

Documents stored in Vault are:

• Encrypted at rest with KMS
• Isolated at the organization level
• Retained until you delete them
• Searchable via vector embeddings stored securely

You are responsible for ensuring you have the right to upload documents and that they are handled in compliance with applicable laws (including attorney-client privilege considerations).

Transcription Users

When using our Voice API:

• PII redaction is available upon request
• Audio files can be automatically deleted after processing
• Speaker labels and timestamps do not identify individuals without additional context

Payments Platform Users

For users of our IOLTA-compliant Payments Platform:

• All financial data is encrypted and access-controlled
• Transaction history is maintained for regulatory compliance
• We comply with applicable financial regulations
• Data may be retained for 7 years per legal requirements

Orbit Users

When using Orbit Compute:

• Deployment artifacts are stored for the duration of your deployment
• Logs are retained for 30 days
• Environment variables are encrypted
• You are responsible for the content of deployed applications

This Privacy Policy is effective as of December 10, 2025.