Privacy notice

Last updated 21 October 2026

Beta draft. This page is being reviewed by a solicitor before CaseReader takes paying customers.

This notice explains how CaseReader handles personal data under the UK GDPR and the Data Protection Act 2018.

Who is responsible

The data controller is Beyond HNGT Ltd (company number 12787432), which trades as CaseReader. Registered office and trading address: Greenside House, 50 Station Rd, London N22 7DE. Registered with the Information Commissioner's Office, reference ZC087233.

To ask about your data, send us a message.

What we collect

• Account details: your email address (and your name, if you sign in with Google), held by our sign-in provider. You sign in with an email code or Google; we don't hold passwords.
• Your documents and notes: the files you upload, their names and page counts, and anything you tell us about them. Documents often contain other people's personal data, such as names and addresses, and in employment, family, housing or court papers, details of their lives.
• The conversation, if you use it: your messages, the assistant's replies, the brief made from them, and the text read from your documents on your own device so the assistant can see the wording.
• Messages and waitlist sign-ups: see below.
• Payment records: amount, date and status. Card details are handled by Stripe and never reach us.
• Technical data: basic logs needed to run the site securely, and a shortened hash of your IP address, used to limit how many messages one connection can send and kept with our usage analytics. The hash isn't anonymous, so we treat it as personal data.
• Usage analytics: how the site and your pack are used. See Usage analytics.
• Access records: which of our team downloaded which of your files, and when.

Before you sign up, the price estimator counts your pages on your own device. Nothing is uploaded at that stage. Files you add are kept in this browser for up to 7 days from when you first add them, then discarded (they're cleared the next time you open the page after that). You can clear them at any time.

Sensitive information in documents

Documents can contain special category data about you or other people, such as health information, or details of family life, religion or trade union membership that often appear in family and employment papers, as well as criminal-offence information. Family papers can include information about children. We process this information only to provide the reading you asked for, and never for anything else. Our solicitor is confirming the legal condition we rely on, and we'll name it here before we take paying customers. Please remove details we don't need before you upload.

Why we use it (lawful basis)

• To prepare and deliver your pack, take payment and support you: performance of a contract, or steps you ask us to take before one (such as pricing a request).
• To keep accounting records: legal obligation.
• To keep the service secure and improve it: legitimate interests.

We do not sell your data or use your documents for advertising.

Usage analytics

To improve the service, we keep our own record of how the site is used: which pages and sections are viewed and for how long, which buttons and options are chosen, and, in a delivered pack, which tabs and notes are opened. It records ids, counts and times. It never records the text of your documents or messages, your file names, or anything you type. If you're signed in, it's linked to your account, and we may get an alert when you sign up, come back, open your pack or start a conversation. It stays on our own systems: no analytics or advertising companies, and no cookies. We keep it for 13 months, or 90 days for visits when you aren't signed in. Our lawful basis is legitimate interests (improving the service).

To switch it off, press "Analytics: on" at the foot of any page. It stays off in that browser. If your browser sends a Global Privacy Control signal, it's off already.

Messages and waitlist

When you send us a message, ask whether we cover a document, or join the waitlist, we keep your email address, your name if you give it, your message, and the page count and kind of document if you were pricing one. We use them to reply, or to tell you when accounts open. We keep them for up to 12 months. Our lawful basis is legitimate interests (answering people who contact us), or steps before a contract when you're asking about an order.

Who sees it and who processes it for us

The AI providers we use, and what each does with data, are listed below.

• People who prepare and check packs: the operator and, where we use them, independent professionals (for example solicitors or surveyors) who check packs for us. They work under a written contract that requires confidentiality and lets them use your documents only to prepare and check your pack. They see your documents, notes and brief in our operator console, which needs a separate sign-in, and each download is recorded.
• Cloudflare hosts the site and runs the conversation. Uploads and packs are stored, encrypted, in a storage bucket held in the EU. Order records, messages, and the conversation and brief are held in Cloudflare's database service, whose primary copy runs in Western Europe but which isn't restricted to the EU. Cloudflare's network may handle your requests in other countries on the way.
• Clerk provides sign-in.
• Stripe processes payments, once card payments are switched on.
• Anthropic (the Claude API) writes the assistant's replies and the brief in the conversation, using your messages and the text read from your documents, under Anthropic's commercial terms for its API, which don't allow it to train models on what we send. Anthropic models also help prepare packs.
• OpenAI models help prepare packs.
• Our email provider holds the emails we exchange with you, such as price confirmations and replies, and the alerts we receive when you send a request or message (these contain your page count and the start of your message, never document text) or about account activity (your email address and what happened, such as opening your pack).
• Telegram delivers short alerts to the operator's phone: the kind of request and page count, and for account activity your email address and what happened. Never document text or messages.

Local working copies

To prepare and check your pack, the people listed above download your files to their own encrypted computers. They delete those copies, including anything in their downloads folder, within 7 days of delivering your pack, or of your request being cancelled.

International transfers

Anthropic, OpenAI, Clerk, Cloudflare and Stripe are based in, or may process data in, the United States. Telegram may process alerts outside the UK. Our solicitor is confirming the safeguard we rely on for each of them; we'll name it here before we take paying customers, and you can ask us about it at any time.

How long we keep it

• Uploaded documents: 90 days after upload, enforced by our storage rules. Local working copies: within 7 days of delivery or cancellation.
• Unfinished uploads: deleted after 48 hours.
• Packs: 12 months after delivery.
• Notes and file names are cleared from order records 90 days after the order.
• The conversation and brief: deleted 90 days after the conversation if you don't send an order. If you do, they're kept with the order and deleted when you remove it, or 90 days after the order, whichever is sooner.
• Messages and waitlist sign-ups: 12 months.
• Access records: 12 months.
• Usage analytics: 13 months; 90 days for visits when you aren't signed in.
• Payment records: six years, for tax purposes.

You can ask us to delete any of these sooner.

Your rights

You can ask to see, correct, delete or export your data, or object to how we use it: send us a message, choosing "A data protection request". We'll reply within one month. You can also complain to the Information Commissioner's Office at ico.org.uk.