Privacy notice

How Casebound handles your data

Last updated: 24 October 2026 · Notice under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR)

1. Who is responsible

The data controller is Kiyan Martinon, a private individual based in Italy who runs Casebound (case-bound.com). Contact: admin@case-bound.com.

No data protection officer has been appointed because the law does not require one for a service of this kind. Write to the address above for anything about this notice.

2. What stays in your browser

Everything you enter into Casebound is kept in your browser's local storage on your own device. That includes case facts, claims, files you add and saved cases. Files are read inside your browser and are not uploaded anywhere.

The one exception is a case you choose to send to lawyers, described under Connecting with a lawyer. Otherwise this information never reaches us, so we do not process it as a controller. You can delete it at any time with Clear all in the Cases tab, or by clearing this site's data in your browser settings.

3. What reaches us or our providers

Accounts

Forgotten password. If you use Forgot your password?, we email a 6-digit code to your account's address, sent through our Google mailbox (admin@case-bound.com). We store only a scrambled version of the code, which expires after 15 minutes or once used, plus the times codes were sent (to limit requests). Resetting your password signs you out on every other device.

Your password is never stored as written: we keep only a one-way scrambled version (scrypt hash) that cannot be turned back into the password. Delete your account at any time under Your account → Delete my account. This erases your account data straight away. Billing records that must be kept by law (see below) are not affected.

Paid subscriptions

If you subscribe, checkout takes place on a secure page run by Stripe. Stripe collects your payment details directly. We receive only what we need to run your subscription: your name, email address, billing address, VAT or tax number (if you enter one), the plan and its status, payment dates and amounts, and limited card information such as brand, last four digits and expiry date. We never receive your full card number or security code.

The Plans page and checkout set no cookies on case-bound.com. Stripe's own pages may use cookies and fraud-prevention technology under Stripe's privacy policy.

Connecting with a lawyer (Pro)

If you choose Send to verified lawyers after a risk check, we store the case on our servers: the one-line summary, what happened, the type of problem, the key date, the amount, the evidence you ticked and your description of it, the other side (for example "my employer"), your region and city, the result of your risk check and evidence analysis, the outcome you want and any details you add later. We link it to your account so you can follow replies and withdraw it.

• Who sees it. Only lawyers whose name and register number we have checked on the official register of lawyers. They see the case without your name or email. Your name and email reach a lawyer only when you press Share my contact details for that lawyer. From then on that lawyer handles your data as an independent controller, bound by professional secrecy.
• Sensitive information. A case description may reveal health, criminal or other special-category data. Please include only what a lawyer needs. We process the case on the basis of your explicit consent, which you give with the tick box when you send it (Art. 6(1)(a) and 9(2)(a) GDPR).
• How long. Until you withdraw the case or delete your account, which erases it straight away. You can withdraw your consent at any time by withdrawing the case.
• Lawyer profiles. If you sign up as a lawyer, we store your full name, bar association, register number, city, areas of practice and bio, and check them against the public register (Art. 6(1)(b) and (f)). Clients see your name, bar association, city, areas, bio and message when you mark interest in their case, and your email once they share theirs with you. Clients never see your rating of their case.

“Can I…?” questions

When you ask a question on the “Can I…?” page, we send its text, the country you chose and your language (and, for a follow-up, your earlier question and the short answer you got) to Anthropic, whose AI model writes the answer, and pass the answer straight back to your browser. Casebound does not store your question or the answer on its servers. To apply the daily limit we keep a count of questions per day, linked to your account if you are signed in or otherwise to a code made from your IP address with a key that changes every day; the counts are deleted after two days. Your recent questions and answers are kept only in your browser (local storage), where you can clear them. Please leave out names and other details that identify you or anyone else. We rely on our legitimate interest in answering the question you asked and preventing abuse (Art. 6(1)(f)). Anthropic processes the question on our behalf, keeps it only for a limited period for safety and abuse monitoring, and does not use it to train its models.

How answers get more accurate. When you rate a “Can I…?” answer Right or Wrong, we store only your vote and the countries you flag, added to running totals for that legal issue. The issue is filed under a short, neutral description written by the AI (for example “recording a phone call without the other party’s consent”), never your own words, and we remove anything in it that looks like an email, phone number or web address. We also count which verdict was given for each country, so we can see when answers disagree. Verified lawyers can correct a country’s verdict; the correction, their note and the date are stored without their name. New answers to the same issue are written with these notes. To stop one visitor flooding the ratings, a one-way code made from your IP address with a key that changes every day counts ratings per day; the code and key are deleted after two days. When a verified lawyer rates the strength of a case a client sent to lawyers, that rating and the four risk-check factor codes (time limit, evidence, detail, amount — no text) train the risk check; if the case is deleted, they are kept only as anonymous rows with no link to the case, client or lawyer. We rely on our legitimate interest in giving accurate answers (Art. 6(1)(f)).

Third-party resources your browser loads

To display the site's typefaces, your browser connects to Google Fonts (Google Ireland Ltd / Google LLC). When you add a PDF or Word file, it downloads the reader software from cdnjs (Cloudflare, Inc.). These providers receive your IP address as part of that connection, under their own privacy policies. We rely on our legitimate interest in a readable site that can open common file formats (Art. 6(1)(f)).

4. The improvement programme (opt-in)

The checkbox “Help improve rankings” is unticked by default. Casebound sends nothing for this purpose unless you tick it.

If you tick it, each signal contains only:

• the type of action: “a result was opened” or “a result was rated relevant / not relevant”;
• the corpus ID of the document involved (for example IT-24), its position in the results, and the filters in use (jurisdiction and document type);
• the identifiers of the legal concepts Casebound recognised in your case, from its fixed list (for example dismissal, data_breach) — not the words you used;
• the date (day only) and the version of the consent you gave.

It never contains:

• the facts, claims or any other text you type, or any file you add;
• your name, email, account or any identifier that links one visit to another;
• your IP address. It is not stored with the signal. To stop one visitor flooding the system, a one-way fingerprint of the connection, made with a random key that changes every day, counts how many signals arrive per day; the fingerprint and the key are deleted after two days.

How Casebound learns from them. Signals are added up into running totals per document and concept (for example, “IT-24 was rated relevant 5 times for cases about notice of defects”). Only those totals are kept, and they are used to re-rank results for everyone. The totals contain no personal data and are published to every visitor so their browser can use them.

Learning that stays in your browser. Whether or not you tick the box, your own ratings and your corrections to the recognised concepts (removing a wrong one, adding a missed one) are saved in your browser's local storage so your results improve straight away. When you add a missed concept, Casebound remembers the ordinary words of that case — skipping capitalised words such as names — so it recognises the concept next time. This stays on your device and is never sent; you can erase it with “Forget what I've taught in this browser”.

Signals are used only to improve how Casebound ranks and suggests sources. They are not used for advertising, profiling or any decision about you.

Withdrawing consent: untick the box at any time. Signals stop immediately. Withdrawing does not affect signals already sent.

5. Cookies and local storage

Casebound sets one cookie, cb_session, and only when you sign in. It keeps you signed in for up to 30 days and is deleted when you sign out. It is not used for tracking. Casebound also uses your browser's local storage for five things:

• to make the tool work, by keeping your saved cases;
• to remember your choice on the improvement checkbox;
• to keep your own result ratings and concept corrections, so results adapt to them (see section 4; never sent to us);
• to count how many analyses you have run today, for the free plan's daily limit (a date and a number, never sent to us);
• to remember your appearance setting (light, dark or automatic), your language and, for lawyer accounts, which view (client or lawyer) to open.

The cookie and local storage are strictly necessary to provide the service you asked for. Under Article 122 of the Italian Personal Data Protection Code they do not require consent.

6. Who receives data, and international transfers

• Netlify, Inc. (United States) hosts the website, processes connection data and stores account data on our behalf under its Data Processing Agreement. Transfers to the US rely on Netlify's certification under the EU-U.S. Data Privacy Framework, backed by Standard Contractual Clauses.
• If you opt in to the improvement programme, Netlify, Inc. also receives the signals and stores the running totals described in section 4, under the same Data Processing Agreement and transfer safeguards.
• Verified lawyers receive cases you send to them, as described under Connecting with a lawyer, and your name and email only if you share them.
• Stripe Payments Europe, Ltd. (Dublin, Ireland) processes subscription payments. For fraud prevention and its own legal duties (such as anti-money-laundering rules), Stripe acts as an independent controller under its own privacy policy. Stripe may transfer data to Stripe, Inc. in the United States under the EU-U.S. Data Privacy Framework and Standard Contractual Clauses.
• Anthropic (Anthropic Ireland, Limited and Anthropic, PBC, United States) receives the text of “Can I…?” questions to write the answers, as a processor under its Data Processing Addendum. Transfers to the US rely on Standard Contractual Clauses.
• Google and Cloudflare receive connection data when your browser loads fonts or file readers, as described in section 3. Both participate in the EU-U.S. Data Privacy Framework.

We do not sell or rent data to anyone.

7. No automated decisions about you

Casebound ranks legal sources by text similarity to help you research. It makes no decision about you that has legal or similarly significant effects within the meaning of Article 22 GDPR. Its results are a research aid, not legal advice.

8. Your rights

You have the right to:

• access your personal data;
• have it corrected or erased;
• restrict its processing;
• receive it in a portable format;
• object to processing based on legitimate interest;
• withdraw consent at any time (Articles 15–22 and 7(3) GDPR).

If you have an account, you can view and correct your details, download a copy of your data and delete your account yourself on the account page. For anything else, write to admin@case-bound.com. We will reply within one month.

Improvement signals carry no identifier, so we usually cannot tell which signals came from you. In that case we cannot single them out for access or deletion (Article 11 GDPR). Unticking the box stops all future signals.

You can also lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali (Piazza Venezia 11, 00187 Rome, garanteprivacy.it), or with the authority in the EU country where you live or work.

9. Age

Casebound is intended for adults (18+), such as law students and legal professionals.

10. Changes to this notice

If we change how data is handled, we will update this page and its date. If the improvement programme changes in a way that needs fresh consent, the checkbox will reset and ask you again.