Zásady ochrany osobních údajů

1. Who we are

CasePilot is operated by Adam Mrabeti, a sole trader registered in France, trading under the commercial name CasePilot.

• Registered address: 50 Avenue des Champs-Élysées, 75008 Paris, France
• Registration: SIREN 933981425, RCS Paris
• Contact: support@casepilot.cz

Where this policy says "we", "us" or "CasePilot", it means that person.

2. What this policy covers, and where it stops

CasePilot is a marketplace. Clients use it to find and contact lawyers; lawyers use it to be found, to manage requests and to arrange consultations. Which of us is responsible for your data depends on what is happening.

We are the controller — we decide why and how the data is used — for:

• your account and how you use the site;
• the inquiry you send before a lawyer accepts a booking, including the text you write;
• matching, search and ranking;
• bookings, scheduling and reminders;
• payments and invoicing between us and lawyers;
• security, fraud prevention, and defending or bringing legal claims.

We are a processor — we only host and deliver, on the lawyer's instructions — for the content of messages exchanged between a client and a lawyer after that lawyer has accepted a booking. From that point the lawyer decides what happens to that content, and the lawyer's own confidentiality obligations apply to it. We remain the controller for the surrounding metadata (that a message was sent, when, and to whom), because we need that to run and secure the service.

This split is by purpose, not by system. If you want to exercise rights over the content of your communications with a lawyer after a booking was accepted, contact that lawyer. We will help them respond.

3. What we collect

Everyone who visits the site. Pages viewed and technical information your browser sends, including your IP address, needed to serve the site and keep it secure. We use no advertising or analytics trackers of any kind.

Clients. Your name, email address and, if you provide it, your phone number. The content of any inquiry you send. Details of bookings you make. Reviews you write. Messages you exchange with a lawyer through the platform.

Lawyers. Your name and professional title, Bar registration number, practice areas and specialisations, languages, locations and office details, hourly rate and consultation pricing, biography and headline, education, memberships, certifications and awards, profile photo, contact details, and the documents you submit for verification. Billing details — legal name, IČO, DIČ where given, and address. Records of your subscription, payments and invoices.

Practice managers. Name, email address, the firm you belong to, and a record of actions you take on behalf of a lawyer.

Everyone with an account. Email address for sign-in, and a record of sign-in codes we have issued. We do not store passwords, because we do not use them.

4. Why we use it, and on what basis

What we do	Why	Legal basis
Create and run your account	To give you the service you asked for	Contract, Art. 6(1)(b)
Deliver an inquiry to a lawyer	To do the thing you used the site for	Contract, Art. 6(1)(b)
Show lawyer profiles publicly	To operate a directory lawyers signed up to appear in	Contract with the lawyer, Art. 6(1)(b)
Arrange and confirm bookings	To provide the booking service	Contract, Art. 6(1)(b)
Take payment and issue invoices	To charge for paid plans	Contract, Art. 6(1)(b); legal obligation for the invoice itself, Art. 6(1)(c)
Send service emails	To tell you what is happening with your account, inquiries and bookings	Contract, Art. 6(1)(b)
Keep the platform secure and prevent abuse	So the service is not misused	Legitimate interests, Art. 6(1)(f)
Verify a lawyer's professional standing	So clients are not misled about who they are contacting	Legitimate interests, Art. 6(1)(f)
Defend or bring legal claims	To protect our position	Legitimate interests, Art. 6(1)(f)
Send error reports to our monitoring provider	To find and fix faults	Consent, Art. 6(1)(a) — off unless you switch it on

Where we rely on legitimate interests, we have weighed them against your rights. You can object; see section 10.

5. Sensitive information — please read this before you write

An inquiry is free text, and legal problems are personal. Anything you type is stored on our systems until the lawyer reads it.

Do not include in an inquiry: details of criminal proceedings against you or anyone else, health information, information about your sex life or sexual orientation, religious or political beliefs, or trade union membership. Describe the situation in general terms and leave the details for the lawyer once you are speaking to them directly.

If you do provide such information anyway, we process it only to pass it to the lawyer you chose, on the basis of Art. 9(2)(f) GDPR — establishment, exercise or defence of legal claims — and we delete it under the retention rules in section 8.

We do not want, and ask you not to send, information relating to criminal convictions or offences. We have no basis to hold it and will remove it if it reaches us.

6. Who else sees your data

We do not sell data and we do not share it for advertising. We use the following providers, each under a contract that limits them to acting on our instructions:

Provider	What they do	Where
Supabase	Database and file storage	Ireland
Vercel	Hosting the application	Frankfurt, Germany
Stripe	Card payments for paid plans	EU / global, under an approved transfer mechanism
Resend	Sending emails, including invoices	See "International transfers" below
Sentry	Error monitoring — only if you consent	EU region
Google Maps	Maps of law firm offices	EU / United States
Google, Microsoft	Calendar sync, only for lawyers who connect an account	EU / United States

Lawyers see the inquiries and bookings addressed to them. On a Free plan, a lawyer sees the text of your inquiry but not your name, email address or phone number unless they pay to unlock it. Where a lawyer belongs to a firm, other members of that firm and any practice manager the lawyer has authorised may see the same material; the lawyer chooses whether to authorise that.

We will disclose data to a public authority where we are legally required to, and no further.

7. International transfers

Our database, our application and our error monitoring are in the European Union. Some providers may process data outside the EU. Where that happens, the transfer is covered by an adequacy decision or by Standard Contractual Clauses adopted by the European Commission, together with the additional measures we consider necessary. You can ask us for details.

8. How long we keep it

Data	How long
Account and profile	Until you delete your account
Inquiries that never led to a booking	90 days, then the message and the sender's name, email and phone are erased automatically
Inquiries that led to a booking, and messages	Until you delete your account, subject to the lawyer's own retention decisions
Bookings	Until you delete your account
Reviews	Until you delete your account or ask us to remove the review
Invoices, payments and billing details	Ten years from the end of the accounting year, because tax law requires it
Verification documents	Until the account is deleted
Error reports	As set by our monitoring provider, currently 90 days

An inquiry can be exempted from the 90-day erasure where it is needed for a legal claim. We record the reason when we do that.

9. What happens when you delete your account

You can delete your account from your dashboard. When you do:

• any active subscription is cancelled with our payment provider before anything is deleted, so nothing continues to be charged;
• your profile, inquiries, bookings, messages, reviews and uploaded files are deleted;
• calendar connections are withdrawn where we are able to; where we cannot, we tell you and give you a link to withdraw them yourself;
• invoices, payment records and the billing details recorded on them are kept, because tax law requires it. The link between those records and your login is severed; the invoice keeps the legal identity it was issued to, as the law requires.

10. Your rights

You can ask us to give you a copy of your data, correct it, delete it, restrict what we do with it, or send it to you in a portable format. You can object to processing we base on legitimate interests. Where we rely on your consent, you can withdraw it at any time; that does not affect what we did before.

You can download a copy of everything we hold about you from your account page, at any time, without asking.

Write to support@casepilot.cz. We answer within one month.

If you think we have got this wrong, you can complain to the French data protection authority, the CNIL (www.cnil.fr), which is our lead supervisory authority, or to the authority where you live — in the Czech Republic, the Úřad pro ochranu osobních údajů (www.uoou.cz).

11. Security

Passwords do not exist on CasePilot; you sign in with a code sent to your email address. Everything travels over an encrypted connection.

On top of the encryption our database provider applies, we encrypt the following at the application layer with AES-256-GCM, using keys held outside the database: the text of inquiries, the body of messages, the subject and message of bookings, and attachment filenames. This protects the content against someone who obtains a copy of the database. It is not end-to-end encryption: we can decrypt this content, because the service has to display it to the people it is addressed to.

Access to the administrative interface is restricted and every access to message or inquiry content by an administrator is logged with a stated reason.

12. Cookies

See our Cookie Policy. In short: we store your sign-in session, your choice about error reporting, and a few interface preferences. There are no advertising or analytics cookies.

13. Changes

If we change this policy we will post the new version here and update the date at the top. If the change materially affects you, we will tell you by email before it takes effect.