Privacy

CaseTask is software a law chamber uses to run its practice. This page says what information it holds, where, who can see it, and what you can do about it. It is written to meet India's Digital Personal Data Protection Act, 2023.

Who is responsible for what

The chamber decides what is recorded about its matters and its clients, and why. Under the Act the chamber is the data fiduciary for that information, and a client with a question about their data should ask the chamber first. CaseTask processes it on the chamber's behalf and only to provide the service - we do not sell it, advertise with it, or use it for anything else.

For the chamber's own account (who signed up, who pays), CaseTask is responsible directly.

What is held

• Staff accounts: name, email, role, and a salted hash of the password (never the password itself).
• Matters, hearings, notes, tasks, documents and messages the chamber enters or receives.
• Clients: name, phone, email, preferred channel and language, as the chamber records them.
• Fees, invoices and payments the chamber records, and UPI references a client reports.
• An activity log of who did what, kept so a chamber can always answer "who changed this?".

Where it is kept

The database and every document are stored in Mumbai, India (Supabase, on Amazon Web Services), and the application runs in Mumbai (Vercel). Documents sit in a private store that cannot be opened without passing through CaseTask's own permission checks.

When information leaves CaseTask, and why

• AI features (research, summaries, suggested replies, voice intake, and reading the text of scanned pages and photographs) send the relevant text or image to Anthropic, which processes it in the United States to produce the answer. Anthropic does not use this data to train its models. Nothing is sent unless someone in the chamber uses one of these features.
• Messages to clients go out on the channel the chamber chooses. With "Send on WhatsApp" the lawyer sends it from their own phone; if the chamber connects a messaging provider, the message passes through that provider and Meta's WhatsApp service.
• Email (sign-up, password resets, the morning summary) is sent through our email provider (Brevo or Resend).
• Services a chamber or a staff member chooses to connect: signing in with Google or Microsoft, Google Calendar or Outlook (to show hearings in their own calendar), Google Drive (to import its own files), and messaging or calling providers (Twilio, Zernio). Each receives only what is needed for what the chamber asked it to do.
• Court lists and judgments are public records read from the courts' own sites and public datasets; nothing about a chamber is sent to a court.

Visitors to this website

CaseTask has no advertising or tracking cookies, and no Facebook, Google Ads or similar trackers. The only cookie is the one that keeps you signed in. Page visits are counted without cookies (Vercel Web Analytics), forms are protected from bots by Cloudflare Turnstile, and when something breaks the technical error is reported to Sentry without your IP address, location or what you typed.

Who inside a chamber sees what

Admins see the whole chamber. Other staff see only the matters they own or are added to. A client sees only what the chamber has chosen to share with them, through a private link.

Keeping and deleting

Information is kept while the chamber uses CaseTask. A chamber can export its records at any time (Settings → Your records). When a chamber asks us to close its account, its information is deleted within 30 days, except what the law requires us to keep, such as invoices and payment records.

Your rights

You can ask to see, correct or erase personal information, to withdraw your consent (which closes the account, as the service cannot run without it), to nominate someone to act for you, and to have a grievance heard. A client should ask their chamber; a chamber or its staff can ask us through the form on the home page, which reaches the person at CaseTask who handles privacy and grievances. We respond within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India.

Security

Connections are encrypted; passwords are hashed; client portal links are long and unguessable; repeated wrong passwords lock an address for a while; and every change is logged. If personal data is ever breached, we will tell the affected chambers and the Board as the Act requires.