Privacy Policy

Introduction

CaseClock Inc. ("CaseClock," "we," "our," or "us") is committed to protecting your privacy. This Privacy Policy describes how we collect, use, share, and protect personal information when you visit our website at https://caseclock.ai (the "Site"), use our products and services (the "Services"), or otherwise interact with us.

By creating a CaseClock account, you agree to our Terms and Conditions and to this Privacy Policy. This includes your consent to the collection, storage, and AI-assisted processing of your audio recordings, transcripts, and matter details by CaseClock and its service providers, including Microsoft Azure and Azure OpenAI, as described in this policy. If you do not agree, you should not create an account or use the Services.

Scope

This Privacy Policy applies to visitors of the Site and users of our Services. Please note that our Terms of Service and associated Data Protection Addendum govern the extent to which we process personal information as a processor on behalf of our business customers. When we process Customer Data (defined below) on behalf of our business customers, our use of that information is governed by our agreements with those customers, not solely by this Privacy Policy.

Information We Collect

Information You Provide

We collect information you voluntarily provide when you interact with the Site or Services, including when you:

• Register for an account or request a demo
• Use our voice capture, time entry, or billing features
• Contact customer support or communicate with us
• Subscribe to marketing communications
• Apply for employment with CaseClock

The categories of information we may collect include:

• Contact Information: Name, email address, phone number, firm or organization name, job title
• Account Credentials: Username, password, and account settings
• Professional Information: Practice area, organization size, jurisdiction, bar affiliation
• Payment Information: Billing contact details, subscription and transaction history. Payment card details are processed by our third-party payment processor and we do not store full card numbers
• Customer Content: Time entries, billing narratives, voice recordings, transcriptions, client and matter information, work descriptions, files and attachments you upload, and configuration settings
• Communications: Messages you send to us, feedback, survey responses, event registrations
• Job Applicant Information: Resume, employment history, education, references, and other application materials

Information Collected Automatically

When you visit the Site or use the Services, we automatically collect certain information about your device and usage, including:

• Usage Data: Features used, pages viewed, actions taken, dates and times of access, referring and exit pages
• Device and Technical Information: IP address, browser type and version, device identifiers, operating system, network and connection details

We use cookies, web beacons, log files, and similar tracking technologies to collect this information. Most browsers allow you to manage cookie preferences through their settings. Please note that disabling cookies may limit certain features of the Site or Services.

How We Use Information

We use personal information to:

• Provide and operate the Services: Create and manage accounts, process transactions, provide features, deliver customer support
• Process Customer Data as a service provider: Handle time entries, billing data, voice transcription, validation, and reporting as directed by business customers
• Improve the Services: Monitor performance, conduct research and analytics, develop new features, debug and troubleshoot
• Analyze usage patterns and improve product quality: We retain transcript data to understand how CaseClock is being used and to inform product improvements. This data is used in aggregate and is not shared with third parties for this purpose.
• Communicate with you: Send service-related messages, security alerts, administrative notices, respond to inquiries, provide support
• Marketing: Send newsletters, product updates, and promotional communications where permitted by law (you may opt out at any time)
• Business operations: Evaluate job applications, manage vendor relationships, conduct business planning
• Legal compliance and protection: Comply with applicable laws, enforce agreements, protect rights and property, detect and prevent fraud and security incidents

How We Share Information

We do not sell your personal information. We may share personal information in the following circumstances:

• Service Providers: We share information with service providers that process data on our behalf for hosting, data storage, analytics, email delivery, payment processing, and customer support. These providers are contractually required to protect your information and use it only for authorized purposes
• Business Customers and Account Administrators: When you use the Services under an account provisioned by a business customer, that customer and its authorized users may access information about your use of the Services
• Professional Advisors and Partners: We may share information with lawyers, auditors, accountants, and business partners where necessary for the purposes described in this Privacy Policy
• Business Transfers: In connection with a merger, acquisition, reorganization, or sale of assets, personal information may be disclosed or transferred, subject to appropriate confidentiality protections
• Legal and Safety Purposes: We may disclose information to comply with laws, legal processes, governmental requests, enforce our agreements, or protect rights, property, safety, or the public
• With Your Consent: We may share information when you authorize or direct us to do so, or when you integrate the Services with third-party products

We may share aggregated or de-identified information that does not reasonably identify you for any lawful purpose.

Data Security and Infrastructure

We implement administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, loss, alteration, or disclosure. Our security measures include:

• Hosting, storage, and AI processing on Microsoft Azure cloud infrastructure, including Azure OpenAI for voice transcription and time-entry generation, with enterprise-grade security controls
• Encryption of data in transit using industry-standard protocols (TLS/SSL)
• Encryption of data at rest where appropriate
• Access controls, authentication, and role-based permissions
• Logging and monitoring of systems and access events
• Regular security assessments and updates
• Secure development practices and change management procedures
• Business continuity and disaster recovery planning

Data Residency: For US customers, data is stored on Azure's US-based servers. While we work continuously to protect your information, no method of transmission or storage is completely secure. You are responsible for keeping your account credentials confidential and promptly notifying us of any unauthorized access to your account.

AI Processing, Cloud Hosting, and Third-Party Services

Cloud Infrastructure

CaseClock uses Microsoft Azure for cloud hosting, data storage, and data processing. For US customers, data is stored and processed on Azure's US-based servers. Audio recordings submitted by US users are processed for transcription within Microsoft Azure's US region.

AI-Assisted Features

Some CaseClock features use artificial intelligence to help you create billing and time entries. When you record audio using the CaseClock app, we use OpenAI language models hosted through Microsoft Azure (Azure OpenAI) to transcribe your recording and generate a draft time entry. This processing occurs within Microsoft's Azure environment, not through OpenAI's consumer-facing services.

Based on Microsoft's published documentation, prompts, completions, and customer data processed through Azure OpenAI are not made available to OpenAI and are not used to train or improve OpenAI's foundation models without customer permission.

What Is Transmitted When You Record Audio

When you use the recording feature, the following information is transmitted to Azure OpenAI for transcription and time-entry generation:

• Your audio recording, as an M4A audio file, sent after recording is complete
• Your account identifier, included in the audio filename
• The date of the recording
• Your matter and client details, including client name, matter name, practice area, jurisdiction, and billing rate, used to generate an accurate draft time entry

The transcript generated from your audio is returned to CaseClock's servers and used to produce a draft billing entry in your account. Your professional profile data is used to personalize the content of that entry.

Audio Recordings and Transcripts

Audio recordings and transcripts are retained by CaseClock indefinitely. There is currently no automated deletion schedule. You may request deletion of your audio recordings or transcripts at any time by contacting us at legal@caseclock.ai.

Your client information, billing data, and time entries are never used to train AI models. AI features in CaseClock process your data only to deliver the services you request.

We share data with third-party service providers, including Microsoft Azure, only to the extent necessary to provide the CaseClock service. These providers are contractually required to protect your information. We do not sell your personal information to third parties.

Data Retention

We retain personal information for as long as reasonably necessary to provide the Services, comply with legal obligations, enforce our agreements, and resolve disputes. Specific retention practices are as follows.

• Audio recordings: Retained indefinitely. No automated deletion is currently configured. You may request deletion at any time by contacting legal@caseclock.ai.
• Transcripts and billing entries: Retained in your workspace account indefinitely. You may request deletion at any time by contacting legal@caseclock.ai.
• Account and profile data: Retained for the duration of your account and for any period required by applicable law following account closure.

We may anonymize or aggregate personal information so that it no longer identifies you, in which case we may retain and use that information for any lawful purpose.

Your Rights and Choices

You may have certain rights regarding your personal information, including:

• Access: Request confirmation of whether we process your personal information and obtain a copy
• Correction: Request correction of inaccurate or incomplete personal information
• Deletion: Request deletion of personal information in certain circumstances, subject to legal and contractual obligations
• Objection: Object to certain processing, including for direct marketing purposes

To exercise these rights, contact us at legal@caseclock.ai.

US Jurisdiction-Specific Disclosures

California Residents — CCPA

California Consumer Privacy Act (CCPA): California residents may have rights to know what personal information we collect, the purposes for which we use it, and the categories of third parties with whom we share it. You may also have the right to request deletion of your personal information, subject to certain exceptions.

CaseClock does not sell personal information as the term "sell" is defined under the CCPA.

To exercise your rights under California law, contact us at legal@caseclock.ai.

Shine the Light: California residents may request a list of categories of personal information disclosed to third parties for their direct marketing purposes during the preceding calendar year. To make such a request, please contact us at legal@caseclock.ai with "California Shine the Light Request" in the subject line.

Nevada Residents

Nevada residents may submit a request directing us not to sell certain personal information. We do not sell personal information as defined under Nevada law. If you are a Nevada resident and wish to submit such a request, please contact us at legal@caseclock.ai.

Other US Jurisdictions

If you are located in Colorado, Connecticut, Virginia, Utah, or other jurisdictions with specific privacy laws, you may have additional rights regarding your personal information. Please contact us at legal@caseclock.ai for information about exercising your rights.

Marketing Communications

You can opt out of receiving marketing emails from us at any time by clicking the unsubscribe link in our emails or by contacting us at legal@caseclock.ai.

Even if you opt out of marketing communications, we may still send you non-promotional communications related to your account, transactions, or use of the Services.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the effective date at the top of this page and may provide additional notice where required by law.

Your continued use of the Site or Services after changes become effective indicates acceptance of the updated Privacy Policy.

Contact Us

If you have questions, concerns, or complaints about this Privacy Policy or our privacy practices, or if you wish to exercise your rights, please contact us at:

Email: legal@caseclock.ai

Canadian users? View our Canadian Privacy Policy (PIPEDA).