Privacy policy

Last updated 22 October 2026 · Version 2026-10h

1. Who we are

Casey is provided by HR AI Pro Ltd ("we", "us"), a company registered in England and Wales with company number 06717074, whose registered office is at Europa House, Barcroft Street, Bury, BL9 5BT. We are the controller of the personal data this policy describes.

For any question about your personal data, or to use your rights, email support@casey-hr.com.

2. What this policy covers

Casey is a self-service AI tool that helps employees understand and organise their own situation at work. This policy explains what personal data Casey holds about you and about the other people in your case, why we hold it, who we share it with, how long we keep it, and your rights. It applies to casey-hr.com and everything you do in Casey.

3. The information we hold

Your account: your email address and your password.
Your case: what you tell Casey about your situation, such as your employer, your job, your pay, the dates of what happened, the people involved and what you would like to happen, including your answers on Let's get started.
Your messages: your conversation with Casey.
Your documents: the emails, letters, contracts, fit notes, reports and other files you upload, and the text we read from them.
What Casey produces: your Timeline, My case (the problems Casey found in what you told her, your key papers and what is missing), the legal tests you open in Test my case, summaries of your documents, the facts and people Casey takes from them, and the drafts Casey writes for you.
Your subscription: your plan, whether your payments have gone through, and your payment history. Square handles your card details, and we never see your full card number.
Technical records: our servers and our network provider keep logs for security and troubleshooting, which include your IP address, browser and device details, and the pages you ask for. We also keep a record of each AI request Casey makes for your case: which AI model ran, how much text it handled, what it cost and when. That record does not include what you or Casey wrote.
Emails with us: when you write to us, we keep your email and our reply.

4. Sensitive information and other people

Employment cases often involve sensitive information. You may tell Casey about, or upload documents that show, your health, a disability, sickness absence, occupational health reports or fit notes, a grievance, or your race, religion or beliefs, sex life or sexual orientation, or trade union membership. UK data protection law calls this special category data and gives it extra protection. Allegations of criminal offences are protected in a similar way.

We use this information only to run Casey for you, because that is what you ask Casey to do. We never use it for marketing. We don't share it with your employer or anyone else, apart from the providers who help us run Casey and for the legal reasons at the end of section 7.

Your messages and documents will often include information about other people, such as your managers, colleagues and HR staff. We use it only as part of your case. Please include only what your case needs.

[Pending Jude: the legal basis for using health information and other sensitive information, in Jude's exact words. The choice is between your consent and the legal-claims condition]

5. Why we use your information

UK data protection law requires a lawful basis for each use. Ours are:

To provide Casey to you, which means organising your documents and timeline, answering you and preparing drafts: performance of our contract with you, for information about you.
To take payment and manage your subscription: performance of our contract with you.
To send you emails about your account, such as sign-in and password links and the confirmation of your first payment: performance of our contract with you. [Pending Jude: the legal basis for the confirmation of your first payment email, in Jude's exact words. The basis named above, performance of our contract, is draft wording and has not been checked]
To send you a reminder 14 days and 7 days before a date to act by, which you can switch off in Account: [Pending Jude: the legal basis for the reminder emails, in Jude's exact words]
To keep Casey secure, prevent misuse and fix problems: our legitimate interests in running a safe and reliable service.
To keep tax and accounting records and meet our other legal duties: legal obligation.

We don't send you marketing emails unless you have agreed to receive them.

You need to give us your email address and a password to open an account, and card details to subscribe. What you tell Casey about your case is up to you, but Casey can only help with what it knows.

6. How Casey uses AI

Casey uses AI models made by Anthropic (Claude) to read your documents, to read what you wrote when you confirm Let's get started, to reply to you and to write drafts. What is sent, and when:

When you add a document: we read its text on our own server where we can, and the AI reads the document once, to work out what it is, which problem it belongs to, its key facts and the people it names. The text goes to Anthropic for that read, and a scan or photo goes as an image.
When you confirm Let's get started: your answers, what you wrote and anything you had already added go to Anthropic once, to place things on your problems, find dates, suggest which legal tests may fit, list what is missing and write Casey's first message.
When you ask Casey something: a short summary of your case, your recent messages and any passages of your documents Casey looks up to answer you go to Anthropic. Your documents as a whole are not sent with each message.

All of it is sent over an encrypted connection to Anthropic, which processes it in the United States. Anthropic's terms for business use of its AI models do not allow it to use this content to train its models.

To find the right parts of your documents when Casey needs them, we turn their text into search data on our own server. That step doesn't send your documents to anyone else.

We don't use your content to train AI models.

My case, your Timeline and any test you open in Test my case are produced automatically, to help you see where your information stands. They are not decisions about you, and we don't make any decision about you by automated means that has a legal or similarly significant effect on you.

We don't sell your personal data. We use these providers to run Casey, and they act on our instructions:

Supabase: our database, sign-in system and file storage. Your account, case, messages and documents are stored in London, UK (Amazon Web Services, eu-west-2).
IONOS: the server that runs Casey, in London, UK.
Anthropic: AI processing in the United States, as section 6 explains.
Cloudflare: our network and security layer. Everything sent between you and Casey passes through Cloudflare's network.
Resend: sends our emails, such as sign-in and password links, from the EU (Ireland).
Square: takes card payments and manages your subscription payments.

[Pending Jude: who can read your case, in Jude's exact words. What it must say: nobody at Casey reads a person's case, and the page our owners use shows counts only, never names, titles or document text]

We may also share information where the law requires it, or where it is needed to establish, exercise or defend legal claims.

8. Data outside the UK

Your account, case and documents are stored in the UK. Anthropic processes content in the United States. Cloudflare handles traffic between you and Casey, usually at the data centre nearest to you, which may be outside the UK. Resend and Square may process limited data outside the UK. When personal data leaves the UK, UK data protection law requires it to be protected, for example by adequacy regulations or by standard data protection clauses in our contracts. You can ask us which safeguard applies to each provider.

9. How long we keep it

Your case, messages and documents: nothing is deleted while you pay for Casey. If you delete your account and your case in Account, or ask us to, we delete them.
After your subscription ends: [Pending Jude: how long a case is kept after a subscription ends, in Jude's exact words. What it must say: 12 months after the subscription ends, with an email warning 30 days before the case is deleted]
Payment records: for as long as tax and accounting law requires.
Server and network logs: for a limited period, for security and troubleshooting.
Emails with us: for as long as we need them to deal with what you asked and anything that follows from it.

Our providers may keep backup copies for a limited time after we delete something, until the backups are replaced. Anthropic also keeps what Casey sends it for a limited time under its own terms, and can keep content its safety checks flag for longer.

10. Your rights

You have the right to see the personal data we hold about you and get a copy, to correct it, to have it deleted, to restrict or object to how we use it, and to receive the data you gave us in a format you can take elsewhere. Where we rely on your consent, you can withdraw it at any time.

You can download your case (your documents, your drafts and your Timeline) and delete your account and your case yourself in Account. To use any of your other rights, or if you would rather ask us, email support@casey-hr.com from the email address on your account. We will reply within one month.

11. Complaints

If you are unhappy with how we have handled your personal data, please tell us first at support@casey-hr.com so we can put it right. We will acknowledge your complaint within 30 days, look into it and tell you the outcome. You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk.

12. Keeping your data safe

Casey is served only over HTTPS, so what you send and receive is encrypted on the way.
Our database and file storage provider encrypts stored data.
Your documents are kept in private storage, and each account can reach only its own case.

Casey is not end-to-end encrypted. To answer you, Casey and its AI provider have to read what you send. No system is completely secure, but we work to protect your data and keep access to it limited.

13. Cookies

Casey uses only the cookies it needs to keep you signed in, keep the service secure and take your payment. Our Cookie policy lists them.

14. Age

Casey is for people aged 18 and over.

15. Changes to this policy

We may update this policy. The version and date at the top show when it last changed. If a change significantly affects how we use your data, we will tell you by email before it applies.

16. Contact

HR AI Pro Ltd, registered in England and Wales, company number 06717074. Registered office: Europa House, Barcroft Street, Bury, BL9 5BT. Email support@casey-hr.com. See also our Terms of service and Cookie policy.