CaseFirst is legal technology, not a law firm. It helps you organise and present information but does not provide legal advice or assess the legal merits of your case.
CaseFirst

Privacy Policy

Last updated: 31 August 2026

This Privacy Policy explains how CaseFirst ("we", "us", "our") collects, uses, and protects information when you use our website and services.

Information we collect

When you use our service, we may collect:

  • Information you provide about your dispute, including descriptions, amounts, and desired outcomes
  • Details about parties, events, and evidence you add to your case file
  • Session data, including a case access token stored in your browser session
  • Email address, only if you opt in to “Save this case” / request a secure continue link
  • A non-personal referral source code (for example from a partner link such as ?source=sb), if present — used for analytics only; do not put personal data in the source parameter
  • Technical data such as IP address, browser type, and access times (via server logs). Magic-link request logs may store a hashed IP and case id — never the raw email link token

How we use your information

We use the information you provide to:

  • Create and maintain your case file
  • Generate informational content about missing details and organisational next steps
  • Send optional short-lived case access links by email when you request them (links expire in about 45 minutes; you can request a new one anytime)
  • Understand referral sources for analytics (where a source code was provided)
  • Improve and operate our service
  • Comply with legal obligations where applicable

Data storage and security

Your case data is stored on secure servers. We use industry-standard measures including encrypted connections (HTTPS — required in production), prepared database statements, and access controls. Case access is protected by a unique token rather than sequential identifiers. Optional continue links use one-time tokens stored only as cryptographic hashes; the raw token is never saved.

Emails for case access links contain only the product name, an expiry notice, and the link — not case descriptions, party names, or amounts.

Data retention

Case data is retained for as long as necessary to provide the service. You may request deletion of your case data by contacting us. Uploaded files are stored in a protected directory with script execution disabled.

Email addresses collected for save/continue are retained while linked to an active case or until you request deletion. Unused magic-link records expire quickly (minutes) and used tokens are marked so they cannot be reused. Exact retention periods for closed cases will be published when a formal retention schedule is finalised; until then, contact us to request erasure.

Your rights

Under UK data protection law, you may have rights to access, rectify, erase, restrict processing, and object to processing of your personal data. To exercise these rights, please contact us.

Contact

For privacy-related enquiries, please contact us via the details provided on our website.