Privacy Policy

1. Scope

This Privacy Policy applies to personal information that we collect about (a) visitors to our website, (b) authorized users of the Service acting on behalf of our customers, and (c) prospective customers and other individuals who interact with us. When CaseFrame AI processes documents and other content uploaded to the Service on behalf of a customer, CaseFrame AI does so as a service provider / data processor under the customer’s instructions, and the customer’s privacy practices and notices govern that processing. Our Data Processing Agreement describes those obligations in detail.

2. Information we collect

Information you provide directly

• Account information, including your name, work email address, and the customer organization on whose behalf you are authorized to use the Service.
• Communications you send to us, including support requests, sales inquiries, and feedback.
• Content you upload to the Service. This content (“Customer Content”) is processed under customer instructions and is governed by the Data Processing Agreement; the controller of any personal data within Customer Content is the customer.

Information collected automatically

• Service usage information, including the actions you take in the Service and timestamps of those actions.
• Device and connection information, such as IP address, browser type, and operating system.
• Authentication metadata received from our identity provider (Auth0 / Okta) when you sign in.

3. How we use information

We use personal information to:

• Provide, maintain, and improve the Service.
• Authenticate users and secure the Service.
• Respond to inquiries and provide support.
• Send transactional communications about the Service (for example, account notices, security alerts, and material changes).
• Comply with legal obligations and enforce our agreements.

We do not use Customer Content to train publicly available foundation models. We do not sell personal information.

4. How we share information

We share personal information only as described below:

• Subprocessors. We engage service providers (“subprocessors”) to support the Service. The current list of subprocessors is published on the Subprocessors page on our website.
• Legal and safety. We may disclose information when required by law, in response to valid legal process, or to protect the rights, property, or safety of CaseFrame AI, our customers, or others.
• Business transfers. If CaseFrame AI is involved in a merger, acquisition, or sale of substantially all of its assets, personal information may be transferred as part of that transaction; we will provide notice before personal information becomes subject to a different privacy policy.

5. Data retention

We retain personal information for as long as needed to provide the Service and to fulfill the purposes described in this Policy, unless a longer retention period is required or permitted by law. Customer Content is retained and deleted according to the terms of the applicable Data Processing Agreement and customer instructions.

6. Security

We maintain commercially reasonable administrative, technical, and physical safeguards designed to protect personal information, consistent with the controls described in our SOC 2 evidence package. These include encryption in transit (TLS 1.2 or greater) and at rest, role-based access controls, and monitoring.

7. Your choices and rights

Depending on where you live, you may have rights to access, correct, delete, or restrict our processing of your personal information, to receive a copy of your personal information in a portable format, or to object to processing. To exercise any of these rights, contact us using the details in Section 11. If you are using the Service on behalf of a customer organization, please direct rights requests concerning Customer Content to that organization.

8. International transfers

CaseFrame AI operates the Service primarily within the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States. Where required by applicable law, we put in place appropriate safeguards for international transfers, including under the European Union and United Kingdom transfer regimes.

9. Cookies

Our website uses a limited set of cookies and similar technologies to operate the Service, to remember sign-in state, and to measure usage. Where required by law, we present a cookie banner allowing you to consent to non-essential cookies.

10. Children

The Service is not directed to children under 13 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal information from children.

11. Contact us

If you have questions about this Privacy Policy or our privacy practices, contact us at: ViewIQ, LLC (DBA CaseFrame AI), via the contact channel published at caseframeai.com/contact.

12. Changes to this Policy

We may update this Privacy Policy from time to time. Material changes will be communicated to the primary contact on the customer’s account and posted on the website at least thirty (30) days before they take effect, except where a shorter period is required for security or legal reasons.