Privacy Notice

Last updated: 4 September 2026

This notice explains how ClauseCast Ltd handles personal information when you visit our website, contact us, use or administer the ClauseCast service, appear in material submitted to the service, or receive relevant business-to-business communications from us.

1. Who we are

ClauseCast Ltd ("ClauseCast", "we", "us" or "our") is a company registered in England and Wales under company number 17289539.

Registered office: 124 City Road, London, United Kingdom, EC1V 2NX
Privacy contact: admin@clausecast.com

For the personal information we use for our own website, account administration, security, business administration, enquiries, professional outreach and legal compliance, ClauseCast is generally the controller.

Where a customer submits case narratives, documents or other case material to ClauseCast for an assessment, the customer is generally the controller of personal information contained in that material and ClauseCast acts as its processor. The Data Processing Schedule in our Terms of Service governs that processing.

2. Scope of this notice

This notice covers personal information relating to:

visitors to our website;
people who request a demonstration, pilot or other information;
authorised customer users and customer administrators;
business, supplier, adviser and contractual contacts;
professional contacts and prospective customers we contact for relevant B2B business development, pilot recruitment, validation or research discussions; and
people mentioned in case material submitted by customers, to the extent ClauseCast processes that material as a service provider.

The ClauseCast service is intended for business and professional users aged 18 or over. It is not designed for use by children.

3. Personal information we collect or receive

3.1 Website, device and security information

When our website or service is accessed, we and our infrastructure providers may process technical and security information such as IP address, browser or device information, request metadata, timestamps, authentication events, error information and security or operational logs. We use this information to deliver, secure, troubleshoot and protect the service.

3.2 Account and customer-user information

For authorised users we may process professional contact details and account information, including name or email address, organisation, authentication identifiers and events, access status, credit balance, limited evaluation timestamps, short-lived reservation metadata and one-time refinement-token metadata.

Passwordless authentication is provided through Kinde. ClauseCast's current Kinde business is configured in Kinde's UK—London region. Further provider information is available on our Subprocessors page.

3.3 Enquiries, demonstrations and pilots

If you contact us, request a demonstration, discuss a pilot or correspond with us, we may process your name, professional contact details, organisation, role, the content of your enquiry and our correspondence with you.

3.4 Business and professional outreach

For carefully targeted B2B business development, pilot recruitment and professional research or validation discussions, we may process:

your name and professional email address;
your employer or professional organisation;
your job title, seniority, department or professional role;
publicly described practice areas, responsibilities or professional interests relevant to ClauseCast;
the public source from which we obtained the information;
our correspondence with you and the status of the outreach; and
an opt-out or suppression record where you ask us not to contact you for direct marketing.

We do not need or seek private-life information or special-category information for B2B prospecting. Our prospecting is intended to be based on professional relevance.

3.5 Customer case material

Customers may submit case narratives and documents concerning English contract disputes. Depending on what a customer chooses and is authorised to submit, this material may contain information about customer users, parties to disputes, witnesses, employees, officers, advisers and other individuals.

Possible data types include identity and contact information, employment or professional information, contractual and financial information, correspondence, allegations, evidence and, where the customer chooses and is legally authorised to submit it, special-category or criminal-offence information.

Data minimisation. ClauseCast asks professional users to submit anonymised or appropriately pseudonymised material where practicable and to avoid unnecessary personal information, privileged communications, raw client matter files and sensitive information unless identifiable use has been appropriately assessed and authorised.

4. Where we obtain personal information

We may obtain personal information:

directly from you when you contact us, authenticate, use the service or correspond with us;
from your employer, firm or organisation where it arranges access, a demonstration, pilot or commercial relationship;
from customer-submitted case material where ClauseCast acts as processor;
from publicly available professional and business sources for relevant B2B outreach, including law-firm and company websites, Companies House, the Solicitors Regulation Authority register, professional directories such as The Legal 500 and Chambers, public professional profiles such as LinkedIn, and other publicly available business sources; and
from service providers where necessary to operate, secure or administer the service.

5. Why we use personal information and our lawful bases

Activity	Purpose	Typical lawful basis
Public website and technical operation	Deliver pages, maintain availability, diagnose faults and protect the website and service.	Our legitimate interests in operating and securing our service; legal obligation where applicable.
Accounts and authentication	Create and administer professional access, authenticate users, maintain credits and access controls, and support customers.	Performance of a contract or steps requested before entering a contract; our legitimate interests in secure account administration.
Enquiries, demonstrations and pilots	Respond to requests, arrange demonstrations, discuss pilots and evaluate a potential commercial relationship.	Steps requested before entering a contract and/or our legitimate interests in developing and operating our business.
Customer and supplier administration	Manage contracts, service communications, invoices, suppliers, advisers and business records.	Performance of a contract; legal obligation; and our legitimate interests in business administration and protecting our legal rights.
B2B business development and professional outreach	Identify and contact professionals whose work appears reasonably relevant to ClauseCast, including for demonstrations, pilots, validation, feedback and business development.	Our legitimate interests in developing ClauseCast and identifying relevant professional users, subject to applicable direct-marketing rules. Where consent is legally required for a particular electronic marketing communication, we will rely on consent instead.
Security, abuse prevention and incident response	Protect accounts, systems, customers and ClauseCast; detect misuse; investigate incidents; maintain proportionate records.	Our legitimate interests in security and fraud/abuse prevention; legal obligation where applicable.
Rights requests, complaints and legal compliance	Respond to data-protection requests and complaints, meet regulatory duties, establish or defend legal claims and cooperate with authorities where required.	Legal obligation and our legitimate interests in compliance and protecting legal rights.

Where ClauseCast acts as a processor for personal information contained in Customer Input Data, we process that information on the customer's documented instructions rather than selecting an independent lawful basis for the customer's underlying case-data processing. Customers remain responsible for having the rights, authority, lawful basis and, where relevant, special-category or criminal-offence condition required to submit that information.

6. Our legitimate interests

Where we rely on legitimate interests, those interests may include:

operating, securing, maintaining and improving a professional B2B technology service;
responding to business enquiries and developing customer relationships;
identifying professionals and organisations for whom ClauseCast is reasonably likely to be relevant;
recruiting appropriate professional users for pilots, validation and feedback;
maintaining appropriate business, security and compliance records; and
establishing, exercising or defending legal rights.

For B2B outreach, we seek to limit processing to public professional information, contact people in a business capacity about a subject relevant to their role, limit follow-up, provide an easy means to object and maintain a suppression record when someone opts out.

7. Direct marketing and B2B outreach

We may contact relevant professional users at their business contact details where permitted by applicable law. We treat product, pilot and validation outreach as direct marketing for compliance purposes even where participation is free of charge.

You may object to the use of your personal information for direct marketing at any time. If you do, we will stop using your information for that purpose. We may keep the minimum information needed on a suppression list so that we can respect your preference in future.

To opt out, simply reply to the relevant message or email admin@clausecast.com. You do not need to give a reason.

Where professional information was obtained from a public source rather than directly from you, this notice identifies the categories and typical sources of that information.

8. Use of AI and automation

ClauseCast is an AI-enabled service. Customer case material may be processed through the paid Google Gemini Developer API as described below and in our Security and Subprocessors disclosures.

We may also use limited automation or AI assistance for administrative work, security, or B2B outreach, for example to summarise public professional information or draft a relevant opening sentence. For outreach, we intend to provide only limited professional information needed for that purpose and not private or sensitive personal information.

ClauseCast does not make solely automated decisions about individuals that itself produce legal or similarly significant effects. ClauseCast's case outputs are professional decision-support and must not be used as the sole basis for a litigation, funding, underwriting or comparable professional decision.

9. How the ClauseCast service handles case material

Submitted case narratives, documents and related legal facts are used to generate clarification questions and the requested probabilistic assessment.

Application storage: the current application is designed to process case content and uploaded files transiently and does not deliberately save case narratives, uploaded files, extracted text, document evidence ledgers, proprietary model features or outputs to Firestore or application object storage.
Browser context: during an active evaluation or clarification flow, conversation history, compact evidence context and temporary file references may be held in page memory. The application does not intentionally write that active case context to localStorage, IndexedDB or another persistent browser store. Refreshing or resetting the page, signing out or closing the browser process clears those page-held references.
Targeted document retrieval: if additional evidence is requested during a session, files may be re-sent to an authenticated retrieval endpoint for transient extraction and search. Only bounded matching passages are returned for reassessment rather than sending the complete files to Gemini for that search.
Gemini processing: the paid Gemini Developer API processes submitted narratives, extracted text, evidence notes, clarification context, prompts and responses. ClauseCast does not claim that Gemini processing is confined to the UK.
No ClauseCast training without agreement: ClauseCast does not use Customer Input Data to train or fine-tune ClauseCast's proprietary model without the customer's separate written agreement.

10. Service providers and other recipients

We disclose personal information only where reasonably necessary for the purposes described in this notice. Recipients may include:

Kinde Australia Pty Ltd, for passwordless authentication, account identifiers, authentication events, sessions and token management;
ClauseCast's contracted email-delivery provider, for authentication and service emails;
Google Cloud, for Cloud Run hosting, Firestore account/credit records, infrastructure, security and operational logging;
Google Gemini Developer API, for AI processing of case material and related context;
providers of email, CRM, workflow automation, professional-contact verification or AI-assisted business administration where we use them for B2B outreach or operations;
professional advisers such as lawyers, accountants, insurers and security advisers where reasonably necessary;
our customers or their authorised administrators where relevant to their account or service relationship; and
courts, regulators, law-enforcement bodies or other authorities where disclosure is required or lawfully necessary.

Our current principal service providers and data-location information are described on the Subprocessors page.

11. International transfers

Some providers, support functions, security operations, telemetry or AI processing may involve access to personal information from, or processing in, countries outside the United Kingdom.

Cloud Run and Firestore are currently configured in europe-west2 (London), and ClauseCast's Kinde business is configured in Kinde's UK—London region. Cloud Logging includes globally located log buckets. ClauseCast does not represent that Gemini processing or all provider support and security operations are UK-confined.

Where ClauseCast is responsible for a restricted transfer, we use an applicable lawful transfer mechanism. Depending on the circumstances, this may include UK adequacy regulations or appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to approved standard contractual clauses, together with any assessment required by applicable law.

You can request further information about relevant transfer safeguards by emailing admin@clausecast.com.

12. Retention

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting, security and dispute-resolution requirements. Current retention arrangements include:

Information	Current retention approach
Active page case context and temporary file references	Held in page memory during the active session and cleared when the relevant page state is reset, refreshed, signed out or the browser process is closed.
ClauseCast Gemini project logs containing input/output material	Configured for 7 days.
Google Gemini abuse-monitoring records	Google separately states that prompts, contextual information and outputs may be retained for 55 days for abuse monitoring, policy enforcement and required legal or regulatory disclosures under its current published policy.
Google Cloud `_Default` request/container/system logs	Configured for 30 days. ClauseCast does not intend these logs to contain case bodies or document text.
Mandatory Google Cloud `_Required` administrative/system audit records	Retained for 400 days.
Account, access, credit and customer-administration records	For the customer relationship and afterwards where reasonably necessary for security, accounting, contractual or legal requirements.
Unsuccessful B2B prospecting records	Normally reviewed for deletion within 12 months after the last outreach or substantive interaction if no relationship develops, unless a shorter or longer period is justified.
Suppression / do-not-contact records	The minimum information necessary is retained for as long as reasonably needed to ensure that a direct-marketing objection or opt-out continues to be respected.
Enquiries and pilot discussions that do not become customers	Normally retained for up to 24 months after the enquiry or discussion ends, unless needed for a continuing relationship, legal issue or earlier deletion is appropriate.
Contracts and core commercial records	For applicable statutory, tax, accounting and limitation periods; where relevant, this may be up to 6 years after the relationship ends.

Provider-controlled retention may continue for the periods described above even after data is no longer in ordinary ClauseCast application use.

13. Security

ClauseCast uses technical and organisational measures proportionate to the current service and its risks. Current measures include HTTPS/TLS transport, cryptographically verified authentication, server-side access controls, request validation, rate limiting, file-size and file-signature controls, transient document processing, restricted database storage and data-minimised logging.

More detail, including current limitations, appears in our Security and data-handling summary.

No internet or cloud service can guarantee absolute security. If you believe information has been disclosed to us or accessed in error, contact admin@clausecast.com.

14. Cookies and similar technologies

ClauseCast and its authentication or infrastructure providers may use cookies or similar technologies where necessary for authentication, session management, security and service operation. Where non-essential technologies require consent under applicable law, we will seek consent before using them.

See our Cookies and similar technologies notice for current details.

15. Your data-protection rights

Depending on the circumstances and applicable law, you may have the right to:

ask for access to your personal information and associated information about how it is used;
ask us to correct inaccurate or incomplete personal information;
ask us to erase personal information in certain circumstances;
ask us to restrict processing in certain circumstances;
receive or transfer certain personal information where the right to data portability applies;
object to processing based on legitimate interests; and
withdraw consent at any time where we rely on consent, without affecting processing already carried out lawfully before withdrawal.

Direct marketing: you have an absolute right to object at any time to the processing of your personal information for direct marketing, including related profiling. We will stop using your information for that purpose if you object.

Some rights are subject to legal conditions, exemptions and the role ClauseCast is performing. If your request relates to personal information contained in case material supplied by one of our customers, we may need to refer the request to that customer because it is normally the controller.

To exercise a right, email admin@clausecast.com. We may need to take proportionate steps to verify identity before acting on a request.

16. Data-protection complaints

If you believe ClauseCast has handled your personal information improperly, you can make a data-protection complaint to us by emailing admin@clausecast.com and making clear that your message is a data-protection complaint.

We will acknowledge a data-protection complaint within 30 days, investigate it without undue delay, keep you appropriately informed where an investigation takes time, and communicate the outcome and any action we take.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK data-protection regulator. We encourage you to raise the issue with us first so that we have an opportunity to address it.

Information Commissioner's Office — make a complaint

17. Changes to this notice

We may update this notice when our service, providers, processing activities or legal obligations change. We will publish the updated version on this page and change the "Last updated" date. Where a change materially affects existing customers or requires additional notice or consent, we will take appropriate additional steps.

18. Contact

Questions about this notice, privacy rights, direct-marketing objections or data-protection complaints can be sent to:

ClauseCast Ltd
124 City Road
London
United Kingdom
EC1V 2NX
admin@clausecast.com