How Casebook handles personal data

There are two kinds of personal data in Casebook, and they are handled differently.

• Account data about the people who sign in: name, work email, role, firm, sign-in activity and support messages. Mango62 is the data controller for this.
• Client data that a firm puts into Casebook: client names, contact details, case notes, documents and anything else the firm records about the people it advises. The firm is the data controller for this. Mango62 is the data processor and acts only on the firm's instructions.

If you are a client of an advice firm that uses Casebook, the firm's own privacy notice explains why it holds your information. Please contact the firm first with any question about your data.

• Creating and securing your account, including sign-in links and password resets.
• Running the service: showing you the right firm, cases and permissions.
• Support, service notices and important changes to Casebook.
• Keeping an audit trail of who changed what, which regulated firms need.
• Diagnosing errors and keeping the service reliable.

Our lawful bases are performance of a contract with your firm, our legitimate interest in running a secure and reliable service, and where relevant our legal obligations. We do not sell personal data and we do not use it for advertising.

Casebook's database and file storage run on Supabase in AWS region eu-west-2 (London). The application is served by Vercel. Data stays in the UK at rest. Some processing, such as serving web pages and reading documents with AI, may take place outside the UK under contracts that include the UK International Data Transfer Addendum or equivalent safeguards.

We use a small number of trusted suppliers to run Casebook. Each is bound by a written data processing agreement.

• Supabase: database, authentication and file storage (AWS eu-west-2, London).
• Vercel: hosting, application delivery and runtime logs.
• Anthropic: AI reading of documents, only when a firm chooses to use that feature. Content sent for reading is not used to train Anthropic's models.

We will tell firms before adding or changing a subprocessor.

Data is encrypted in transit and at rest. Access is restricted by firm and by role, enforced at the database level. Mango62 staff only access a firm's client data to provide support the firm has asked for, or to fix a fault, and that access is logged. If we become aware of a personal data breach affecting a firm's data, we will tell the firm without undue delay so it can meet its own reporting duties.

• Client data: for as long as the firm's subscription or pilot runs. The firm can export it at any time. We delete or return it within 30 days of the agreement ending, unless the firm asks us to keep it longer or the law requires otherwise.
• Account data: for the life of the account and up to 12 months after it closes, to deal with any follow-up.
• Audit logs and backups: up to 12 months, then deleted on a rolling basis.

Under UK GDPR and the Data Protection Act 2018 you can ask to:

• See the personal data we hold about you and get a copy.
• Correct anything that is wrong or incomplete.
• Have your data deleted, where there is no good reason for us to keep it.
• Restrict or object to how we use it.
• Receive your data in a portable format.

For account data, email us at privacy@chronicle-ai.uk and we will respond within one month. For client data, contact the firm that advises you. If a firm asks us to help with a request, we will.

If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.

We will update this notice as Casebook develops and will show the date of the latest version at the top. Where a change matters, we will tell firms directly.

Mango62, Rosewood House, Duffield Park, Stoke Poges, SL2 4HY. Email privacy@chronicle-ai.uk.

Privacy lead: Scott Mackey, Managing Principal. ICO registration: [ICO registration number].