Privacy Policy
Last updated: July 3, 2026
1. Information We Collect
Account information (name, email, firm details), usage and device information (logs, browser type, pages viewed), and Customer Data your firm submits in the course of using the service (cases, contacts, messages, documents).
2. How We Use Information
To provide and secure the service, process transactions, communicate with you about the service, and improve reliability. We do not sell personal information, and we do not use your firm's Customer Data for advertising.
3. Client and Case Data (Processed on Your Firm's Behalf)
Law firms use CaseSpark to store case files that can include sensitive information about their clients — including health and medical information relevant to a matter (for example, injury and treatment details). CaseSpark processes this data on your firm's behalf and under its instructions. Sensitive fields are encrypted, access to health-related information is logged, and Business Associate Agreements (BAAs) are available for firms that require them — contact privacy@casespark.com. Your firm remains the controller of its clients' data; requests from your clients about their data should be directed to your firm.
4. Security
Customer Data is encrypted in transit (TLS) and at rest. We maintain role-based access controls, audit logging, and monitoring. No method of transmission or storage is 100% secure; we work to protect your data using industry-standard practices.
5. Sharing and Subprocessors
We share data only with service providers that help us run CaseSpark — such as cloud hosting and database providers, SMS and email delivery providers, payment processing, and error monitoring — under contracts restricting their use of the data to providing the service, and when required by law. A current subprocessor list is available on request at privacy@casespark.com.
6. Data Retention
Account data is retained while your organization is active. Customer Data is retained per your firm's configuration and legal obligations; after termination, data is deleted following the export window described in the Terms of Service.
7. Your Rights and Choices
You may access, correct, or delete your account information, and request export or deletion of your organization's data, by contacting us. Where local law grants additional rights (such as California residents' rights), we honor verified requests.
8. Changes to This Policy
We may update this policy; material changes will be notified via the service or email before taking effect.