The short version: Case Waypoint is a portal law firms use to keep their clients updated. We collect only what the portal needs to work. We do not sell or share personal information for advertising, we use no advertising or analytics trackers, and your law firm controls your case information.
1. Who we are and our role
Case Waypoint is operated by Case Waypoint LLC (“Case Waypoint,” “we,” “us”). This policy covers app.casewaypoint.com and the emails it sends (the “Service”).
We play two roles:
- For case information, we act for your law firm. Your firm decides what goes into the portal about your case and who can see it. We handle that information as the firm's service provider, under its instructions and our agreement with it. Your firm's own privacy notice also applies.
- For account and service information, we decide. For things like sign-in details, security logs, feedback you send us and demo requests, Case Waypoint is responsible.
If you are a client and have questions about your case information, ask your law firm first. We will help your firm respond.
2. Information we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Account details | Name, email address, role (client, staff, admin), job title, law firm | Your law firm (or Case Waypoint, for a firm's first admin) |
| Case information | Case number, case type, what the case is about (for example a vehicle or an incident), case stage, dates and events, notes, updates | Your law firm, and you |
| Messages | Messages between you and your firm, and when they were sent and read | You and your firm |
| Documents and files | Files you or your firm upload (for example contracts, records, photos, ID or registration), with file name, type and size | You and your firm |
| Sign-in and security data | One-time sign-in codes, authenticator setup for firm accounts, session cookies, IP address, browser type, sign-in times | You and your device, automatically |
| Activity records | What was done in a case and by whom (for example "document uploaded"), with times | Created automatically as the portal is used |
| Email records | Which emails we sent you, when, and whether they were delivered; your email preferences | Created automatically |
| Feedback | Rating, topic, the screen you were on, and what you wrote | You, if you choose to send it |
| Demo requests | Your name, email address and firm, the date and time you pick, and your phone number and note if you add them | You, if you book a demo at app.casewaypoint.com/demo |
Case files can contain sensitive information, such as a driver's license, financial details or health information mentioned in records. We use it only to provide the Service to your firm and you.
3. How we use it
We use personal information only to:
- run the portal: show you your case, deliver messages and files, and let your firm manage its cases and team;
- sign you in securely and keep accounts and firms separate;
- send the emails described in our Terms, such as sign-in codes, document reminders, case check-ins and staff alerts;
- check uploaded files for viruses and malware;
- keep records of activity, investigate problems, and protect the Service and its users;
- improve the Service using feedback people send us;
- reply to demo requests and arrange the demo;
- meet legal obligations and enforce our Terms.
We do not sell personal information, share it for cross-context behavioral advertising, show ads, or use case information or files to train artificial intelligence models.
4. Who we share it with
| Recipient | Why | What they receive |
|---|---|---|
| Your law firm | It is your firm's portal | Your case information, messages, files and activity, as the firm's settings allow |
| Supabase | Database, sign-in and file storage (United States) | All information stored in the portal |
| Vercel | Website hosting | Web requests, including IP address and browser details |
| Resend | Sending email | Your name, email address and the email's contents |
| Cloudmersive | Virus and malware scanning | Each uploaded file, scanned and not kept |
| Cloudflare | Checking that a sign-in is from a person, not a bot | Browser and device signals on the sign-in page |
| Backblaze | Encrypted backups | An encrypted copy of all information stored in the portal, kept for 90 days and then deleted |
These providers act on our instructions and may not use the information for their own purposes.
We may also disclose information when the law requires it (for example, a valid subpoena or court order), to protect the rights and safety of users or the Service, or as part of a merger, sale or reorganization of our business, under this policy's protections. We will tell your law firm about a legal request for its information unless the law forbids it.
5. Cookies and tracking
We use only the cookies the portal needs to work:
- Sign-in cookies keep you signed in, for up to 60 days, or until you close the browser if you chose “Sign me out when I close the browser.”
- A sign-in step cookie remembers the email you entered while you type your code. It lasts 15 minutes.
- A shared-device cookie remembers that you asked to be signed out when the browser closes.
We use no advertising, analytics or social media cookies or trackers. Because we do not track you across sites, there is nothing for a browser's “Do Not Track” or Global Privacy Control signal to turn off; we treat either as a request not to sell or share your information, which we do not do anyway.
6. How long we keep it
- Case information, messages and files: for as long as your law firm keeps them in the portal. Your firm decides this and may need to keep records for legal reasons.
- When a firm leaves Case Waypoint: the firm can request an export for 30 days; we then delete its information within 90 days.
- Backups: deleted information can remain in encrypted backups until they expire, within 90 days.
- Activity and email records: kept with the case they belong to, as a record of what happened.
- Feedback: kept until it is no longer useful for improving the Service, or until you ask us to delete it.
- Demo requests: not stored in the portal. They reach us by email, and we keep them until we no longer need them to follow up, or until you ask us to delete them.
We may keep information longer where the law requires it.
7. How we protect it
- All connections are encrypted, and stored data and backups are encrypted.
- Sign-in uses one-time email codes, and every firm account also needs an authenticator app.
- The database itself enforces who can see what: each firm sees only its own cases, each client only their own, and Case Waypoint's own admin page never shows client names or case contents.
- Every uploaded file is scanned for malware before anyone can open it, and file links expire after 60 seconds.
- Firm actions in a case are recorded in an activity log.
- We test these protections automatically each time the Service changes.
No system is perfectly secure. If a breach affects your personal information, we will notify your law firm and you as the law requires.
8. Your choices and California privacy rights
Emails. Every reminder, check-in and alert email has an unsubscribe link. Sign-in codes and account emails cannot be turned off while you have an account.
Your rights. If you live in California, you can ask:
- to know what personal information we have about you, and get a copy;
- to correct information that is wrong;
- to delete your information, subject to legal exceptions (for example, records your law firm must keep);
- to limit the use of sensitive personal information to what is needed to provide the Service, which is already all we use it for;
- to opt out of sale or sharing, though we do not sell or share personal information.
We will not treat you differently for using these rights.
How to ask. Email [PRIVACY EMAIL]. For case information, you can also ask your law firm directly; if you ask us, we will pass the request to your firm, since it controls that information. We will confirm your identity, usually by a code sent to the email on your account, and respond within 45 days. You may use an authorized agent with your written permission.
9. Children, changes and contact
Children. The Service is not meant for children under 18 and we do not knowingly collect information directly from children. A parent or guardian may use the Service for a minor's case.
Changes. If we change this policy in a way that matters, we will email account holders or show a notice in the portal at least 30 days before the change takes effect, and update the date at the top.
Contact. Case Waypoint LLC, [MAILING ADDRESS]. Privacy questions: [PRIVACY EMAIL].