Privacy policy

Last updated 4 October 2026 · Version 2026-10d

1. Who we are

Casey is provided by HR AI Pro Ltd ("we", "us"), a company registered in England and Wales with company number 06717074, whose registered office is at Europa House, Barcroft Street, Bury, BL9 5BT. We are the controller of the personal data this policy describes.

For any question about your personal data, or to use your rights, email [email protected].

2. What this policy covers

Casey is a self-service AI tool that helps employees understand and organise their own situation at work. This policy explains what personal data Casey holds about you and about the other people in your case, why we hold it, who we share it with, how long we keep it, and your rights. It applies to casey-hr.com and everything you do in Casey.

3. The information we hold

Your account: your email address and your password.
Your case: what you tell Casey about your situation, such as your employer, your job, your pay, the dates of what happened, the people involved and what you would like to happen, including your answers on Let's get started.
Your messages: your conversation with Casey.
Your documents: the emails, letters, contracts, fit notes, reports and other files you upload, and the text we read from them.
What Casey produces: your timeline, your Casey Snapshot (which shows how complete and clear your information is and highlights points to look at), summaries of your documents, and the drafts Casey writes for you.
Your subscription: your plan, whether your payments have gone through, and your payment history. Square handles your card details, and we never see your full card number.
Technical records: our servers and our network provider keep logs for security and troubleshooting, which include your IP address, browser and device details, and the pages you ask for. We also keep a record of each AI request Casey makes for your case: which AI model ran, how much text it handled, what it cost and when. That record does not include what you or Casey wrote.
Emails with us: when you write to us, we keep your email and our reply.

4. Sensitive information and other people

Employment cases often involve sensitive information. You may tell Casey about, or upload documents that show, your health, a disability, sickness absence, occupational health reports or fit notes, a grievance, or your race, religion or beliefs, sex life or sexual orientation, or trade union membership. UK data protection law calls this special category data and gives it extra protection. Allegations of criminal offences are protected in a similar way.

We use this information only to run Casey for you, because that is what you ask Casey to do. We never use it for marketing. We don't share it with your employer or anyone else, apart from the providers who help us run Casey and for the legal reasons at the end of section 7.

Your messages and documents will often include information about other people, such as your managers, colleagues and HR staff. We use it only as part of your case. Please include only what your case needs.

5. Why we use your information

UK data protection law requires a lawful basis for each use. Ours are:

To provide Casey to you, which means organising your documents and timeline, answering you and preparing drafts: performance of our contract with you, for information about you.
To take payment and manage your subscription: performance of our contract with you.
To send you emails about your account, such as sign-in and password links: performance of our contract with you.
To keep Casey secure, prevent misuse and fix problems: our legitimate interests in running a safe and reliable service.
To keep tax and accounting records and meet our other legal duties: legal obligation.

We don't send you marketing emails unless you have agreed to receive them.

You need to give us your email address and a password to open an account, and card details to subscribe. What you tell Casey about your case is up to you, but Casey can only help with what it knows.

6. How Casey uses AI

Casey uses AI models made by Anthropic (Claude) to reply to you, read your documents, build your timeline, prepare your Casey Snapshot and write drafts. To do this, the parts of your case each task needs, such as your messages, your case details, the text of your documents and sometimes the document files themselves, are sent over an encrypted connection to Anthropic, which processes them in the United States. Anthropic's terms for business use of its AI models do not allow it to use this content to train its models.

To find the right parts of your documents when Casey needs them, we turn their text into search data on our own server. That step doesn't send your documents to anyone else.

We don't use your content to train AI models.

Your Casey Snapshot and any figures Casey shows are produced automatically, to help you see where your information stands. They are not decisions about you, and we don't make any decision about you by automated means that has a legal or similarly significant effect on you.

We don't sell your personal data. We use these providers to run Casey, and they act on our instructions:

Supabase: our database, sign-in system and file storage. Your account, case, messages and documents are stored in London, UK (Amazon Web Services, eu-west-2).
IONOS: the server that runs Casey, in London, UK.
Anthropic: AI processing in the United States, as section 6 explains.
Cloudflare: our network and security layer. Everything sent between you and Casey passes through Cloudflare's network.
Resend: sends our emails, such as sign-in and password links, from the EU (Ireland).
Square: takes card payments and manages your subscription payments.

We may also share information where the law requires it, or where it is needed to establish, exercise or defend legal claims.

8. Data outside the UK

Your account, case and documents are stored in the UK. Anthropic processes content in the United States. Cloudflare handles traffic between you and Casey, usually at the data centre nearest to you, which may be outside the UK. Resend and Square may process limited data outside the UK. When personal data leaves the UK, UK data protection law requires it to be protected, for example by adequacy regulations or by standard data protection clauses in our contracts. You can ask us which safeguard applies to each provider.

9. How long we keep it

Your case, messages and documents: for as long as you have an account, including while it is read-only after your subscription ends, so you can come back to your case. We delete them when you ask us to delete your account.
Payment records: for as long as tax and accounting law requires.
Server and network logs: for a limited period, for security and troubleshooting.
Emails with us: for as long as we need them to deal with what you asked and anything that follows from it.

Our providers may keep backup copies for a limited time after we delete something, until the backups are replaced. Anthropic also keeps what Casey sends it for a limited time under its own terms, and can keep content its safety checks flag for longer.

10. Your rights

You have the right to see the personal data we hold about you and get a copy, to correct it, to have it deleted, to restrict or object to how we use it, and to receive the data you gave us in a format you can take elsewhere. Where we rely on your consent, you can withdraw it at any time.

To use any of these rights, including to delete your case and your account, email [email protected] from the email address on your account. We will reply within one month.

11. Complaints

If you are unhappy with how we have handled your personal data, please tell us first at [email protected] so we can put it right. We will acknowledge your complaint within 30 days, look into it and tell you the outcome. You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk.

12. Keeping your data safe

Casey is served only over HTTPS, so what you send and receive is encrypted on the way.
Our database and file storage provider encrypts stored data.
Your documents are kept in private storage, and each account can reach only its own case.

Casey is not end-to-end encrypted. To answer you, Casey and its AI provider have to read what you send. No system is completely secure, but we work to protect your data and keep access to it limited.

13. Cookies

Casey uses only the cookies it needs to keep you signed in, keep the service secure and take your payment. Our Cookie policy lists them.

14. Age

Casey is for people aged 18 and over.

15. Changes to this policy

We may update this policy. The version and date at the top show when it last changed. If a change significantly affects how we use your data, we will tell you by email before it applies.

16. Contact

HR AI Pro Ltd, registered in England and Wales, company number 06717074. Registered office: Europa House, Barcroft Street, Bury, BL9 5BT. Email [email protected]. See also our Terms of service and Cookie policy.