Data processing addendum
Processor terms for paid Casey workspaces.
Casey processes enquiry and account data as a processor for the instructing firm. This page is a working draft for solicitor review and is not a substitute for a signed DPA.
Roles
Controller, processor, and how data leaves the workspace.
Roles
The firm is the controller. Casey is the processor. People giving an account interact only through the firm's instructions and private links.
International transfers
Subprocessors may process data in the UK, EEA, or United States. Standard contractual clauses or equivalent safeguards apply where a restricted transfer is required.
Deletion
After an organisation is archived, Casey permanently deletes the tenant record when the organisation's retention period expires. Live matters are not auto-purged.
Schedule
Categories, subprocessors, and processor duties
Have your solicitor confirm this schedule before Casey marks a DPA as signed on the organisation.
Data categories
- Identity, contact details, and interview transcripts from an enquiry or account
- Case metadata, statement drafts, exhibits, and signed documents
- Firm user accounts, roles, audit logs, and signature certificates
Subprocessors
- Supabase — authentication, PostgreSQL, object storage
- Cloudflare Workers — application hosting and scheduled jobs
- Cloudflare AI Gateway — model inference for interview, formalization, analysis, and Jev decision scoring
- Resend — transactional email
- Stripe — subscription and extra accepted-lead payments
- Self-hosted DocuSeal — certified electronic signature when enabled
Processor duties
- Process personal data only on the firm's documented instructions
- Apply technical and organisational measures described on the security page
- Assist with subject access, deletion, and retention after archive
- Delete or return tenant data when a soft-deleted organisation reaches its purge date
Ready to map Casey to your intake process?
Have your solicitor review this draft before countersigning. It should be read with the UK GDPR notice and terms of service.