01 Who we are
CaseConduit (“CaseConduit”, “we”, “us”, “our”) is a platform for the case method — writing, simulating, storytelling, teaching, learning and researching with case studies — available at caseconduit.io, and operated from the United Kingdom.
We are the “data controller” responsible for the personal data described in this notice, and you can reach us about anything in it at privacy@caseconduit.io.
CaseConduit is an early-stage, independently run product. As our formal company details are finalised we will add them here; in the meantime, the contact address above reaches the people responsible for looking after your data.
02 The data we collect
Account & profile data
When you register with an invite code we collect your email address, name, the organisation you belong to, your job title (optional), and the invite code you used. Your password is handled by our managed authentication service and is never seen or stored by us in readable form.
Content you provide
The materials you put into the platform — including case-study documents you upload, the prompts and instructions you write, and the cases, simulations, stories and other outputs generated — together with related session and interaction data (for example, moves and responses within a simulation, and the feedback produced).
Technical & usage data
Information generated automatically as you use the service, such as your IP address, device and browser type, and access logs collected by our hosting and content-delivery infrastructure for security and reliability.
03 How and why we use your data
We use your personal data only where the law allows. Our lawful bases under the UK GDPR are:
- To perform our contract with you — to create and secure your account, run the studios, process your case materials into the outputs you request, and save your library.
- Our legitimate interests — to keep the service secure, prevent misuse, provide support, and improve and develop the platform. We balance these against your rights, and you can object at any time.
- Your consent — for any processing we ask you to opt in to; you can withdraw consent at any time.
- Legal obligation — where we must process data to comply with the law.
We do not sell your personal data, and we do not use it for third-party advertising or profiling.
04 AI processing of your content
CaseConduit uses artificial intelligence to generate case studies, simulations, animated stories and synthesised voices. To do this, the content you provide — including case materials you upload and the text of your prompts — is transmitted securely to specialist third-party AI providers that carry out the generation on our behalf, as our processors.
Under the business/API terms on which we operate, this content is used only to produce the output you asked for and is not used to train those providers' general-purpose AI models. We ask you not to upload personal or confidential information you are not permitted to share.
We want to be clear and honest: your content is stored on our infrastructure and is technically accessible to us and our processors as needed to operate, support and improve the service. We do not claim “zero-knowledge” encryption of your content.
06 International data transfers
Your data is primarily stored and processed in the United Kingdom. Some of our AI processors operate outside the UK (for example, in the United States). Where personal data is transferred internationally, we rely on appropriate safeguards recognised under UK data-protection law — such as the UK International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses, or an adequacy decision. You can ask us for more detail at privacy@caseconduit.io.
07 How long we keep your data
We keep personal data only for as long as necessary for the purposes above:
- Account & profile data — for as long as your account is active, and deleted within 30 days of account closure (except where we must retain it by law).
- Content & library — kept until you delete it or close your account.
- Technical & log data — retained for up to 12 months for security and diagnostics.
When data is no longer needed, we delete it or irreversibly anonymise it.
08 How we protect your data
We take appropriate technical and organisational measures to protect your data, including:
- Encryption in transit — all connections use HTTPS/TLS.
- Encryption at rest — stored data is encrypted at rest by our cloud provider.
- Managed authentication — sign-in and passwords are handled by a dedicated identity service; passwords are never stored in readable form.
- Secret handling — credentials for our AI providers are held only on our server-side infrastructure and are never exposed to your browser.
- Access controls — access to personal data is limited to what is needed to operate and support the service.
No online service can be guaranteed 100% secure, but we work to protect your data and to detect and respond to incidents. If a personal-data breach is likely to result in a risk to your rights, we will notify the ICO and, where required, affected users without undue delay.
09 Your rights
Under the UK GDPR you have the following rights over your personal data:
| Access | Ask for a copy of the personal data we hold about you. |
| Rectification | Ask us to correct data that is inaccurate or incomplete. |
| Erasure | Ask us to delete your data (the “right to be forgotten”), where applicable. |
| Restriction | Ask us to limit how we use your data in certain circumstances. |
| Portability | Ask for your data in a portable, machine-readable format. |
| Objection | Object to processing based on our legitimate interests. |
| Withdraw consent | Withdraw any consent you have given, at any time. |
Do it yourself, any time: once signed in, you can see the data we hold about you, download a copy, and permanently delete your account and data from the MyData panel in your CaseConduit workspace — no need to ask.
You can also email privacy@caseconduit.io to exercise any of these rights, and we will respond within one month. Exercising your rights is free, and we will not treat you differently for doing so.
11 Children & learners
CaseConduit is intended for educators, researchers and adult learners, and is not directed at children. Where an educator invites learners who may be under 18, the educator and their institution are responsible for ensuring they have the appropriate basis (including, where relevant, parental consent) for those learners to use the platform. If you believe a child has provided us personal data without the proper basis, contact us at privacy@caseconduit.io and we will remove it.
12 Automated processing
The platform uses AI to generate content and to score activities such as simulations. These outputs are intended as educational feedback and do not produce legal or similarly significant effects on you, and educators remain in control of how they are used. If you have concerns about an automated output, contact us and a person will review it.
13 Changes to this notice
We may update this notice as the platform evolves. We will change the “last updated” date above and, for significant changes, tell you through the service. Please check back from time to time.
14 Complaints
We hope to resolve any concern you raise directly. You also have the right to complain to the UK's data-protection regulator, the Information Commissioner's Office (ICO) — ico.org.uk, helpline 0303 123 1113 — though we'd appreciate the chance to help first.
15 Contact us
For any question about this notice or your personal data — or to exercise your rights — email us at privacy@caseconduit.io and we'll be glad to help.