Privacy Notice

This notice sets out the personal data processed by CaseStudies.Chat, the purposes of that processing, and the rights available to data subjects. Only such data as is necessary to operate an account and to answer an enquiry is retained. The Service carries no advertising, employs no third-party analytics, and sets no cross-site tracking. Personal data is not, and has never been, sold.

Controller

CaseStudies.Chat, operated by an individual proprietor established in the People's Republic of China, determines the purposes and means of the processing described here and is accordingly the controller for the purposes of the GDPR. Enquiries and requests arising from this notice, including requests for access, rectification or erasure, should be addressed to support@casestudies.chat. No charge is made and no form is required.

Categories of data and lawful basis

• Your account. A handle, a password stored as a hash — we cannot read it, and neither can anyone who steals the file — and an email address if you gave one. Because we cannot run the account you asked for without it (performance of a contract).
• How the account was made. The IP address and browser string from that moment, which is how a person is told apart from a script. Because a site that anyone can flood with automated sign-ups stops working for everyone (legitimate interests).
• Your reading. Cases you save to your wall, and any notes you write on them. Performance of a contract.
• Your questions. What you type into an archive's answer box, so the answer can be written and so we can see which questions the archive cannot yet answer. Performance of a contract, and legitimate interests in knowing where the archive is thin.
• Your submissions, if you send in a case. Performance of a contract.
• Page speed. Each page reports how long it took to load, the screen width, the browser's own guess at the connection type, and the browser string. It carries nothing that identifies you, and only the most recent 500 reports are kept. Legitimate interests in the site working on a phone.

No profiling is carried out, and no automated decision producing legal effects or similarly significant effects on the data subject is made.

Recipients

• DeepSeek. Your question, and the passages the archive found for it, are sent to DeepSeek's API so the answer can be written. DeepSeek is a company in China. Treat the answer box accordingly: do not type anything into it you would not want a third party to process, and never type another person's personal details into it.
• Resend. Sends account email — address verification and password resets. It sees your email address and nothing else.
• Paddle. Takes the payments. Paddle is the Merchant of Record and collects your payment details directly on its own systems under its own Privacy Notice — we never see your card number. What reaches us is whether a subscription is active.

The foregoing constitutes the complete list of recipients. No data is disclosed to advertisers, data brokers or analytics providers. Data will be disclosed pursuant to an order of a court of competent jurisdiction, in which case the data subject will be notified unless the order prohibits notification.

International transfers

This service is operated from China and its servers are outside the EEA and the UK. If you are in Europe, the UK, or anywhere with rules about sending personal data abroad, using this site involves such a transfer — to our own servers, and to DeepSeek when you ask a question.

The volume of data transferred is minimised: the enquiry facility requires the question alone, and the user's handle, email address and account identifier are not transmitted with it. Users who do not wish such a transfer to occur may read and search the archives in full without submitting an enquiry and without holding an account. Where the law requires a specific safeguard for a transfer, such a safeguard will be implemented or the transfer discontinued; particulars applicable to an individual data subject are available on request to support@casestudies.chat.

Cookies

A session cookie that keeps you signed in, and a small display-only cookie so the menu bar can show your handle without asking the server first. Both are strictly necessary for a service you asked for, which is why this site has no cookie banner: there is nothing to consent to. No advertising cookies, no analytics cookies, nothing readable by another site.

Retention

Account data is retained for the life of the account. Page-performance reports are limited to the most recent five hundred, after which they are overwritten. On deletion of an account, the profile, saved cases, notes and submissions are erased within thirty days. Payment records are retained by Paddle, not by the operator, for the period required of them, together with any data the operator is independently required by law to retain.

Security

Passwords are stored as hashes and never in readable form. All traffic is transmitted over HTTPS. The database resides on a server accessible only to the operator and is backed up. In the event of a breach affecting personal data, the data subject and the competent supervisory authority will be notified within the period prescribed by law, and the notification will state what occurred.

Rights of data subjects

Data subjects may request a copy of the data held, its rectification or erasure, an export in machine-readable form, or the cessation of a particular processing activity. Requests should be sent to support@casestudies.chat from the email address registered to the account. Requests are answered within thirty days, without charge, and no detriment attaches to their exercise.

Your rights where you live

• European Economic Area and United Kingdom (GDPR / UK GDPR). Access, rectification, erasure, restriction, portability, objection — including objection to anything we do on the basis of legitimate interests — and the right to withdraw consent at any time without affecting what was lawful before. You may also complain to your national data protection authority, and you do not need to come to us first.
• United States. California (CCPA/CPRA), Virginia, Colorado, Connecticut, Utah, Texas and other states: you may know what we collect, get a copy, correct it, delete it, and not be discriminated against for asking. We do not sell personal information and we do not share it for cross-context behavioural advertising — there is no opt-out link on this site because there is nothing to opt out of. We do not use or disclose sensitive personal information beyond what running the account requires. Californians may also designate an authorised agent.
• China (PIPL). Rights to know, to access and copy, to correct, to delete, to port, to withdraw consent, and to ask us to explain how we handle your information.
• Canada (PIPEDA, and Quebec's Law 25). Access and correction, and the right to complain to the Office of the Privacy Commissioner or the Commission d'accès à l'information. We send commercial email only where CASL permits it, and every message has a working unsubscribe.
• Australia and New Zealand. Access and correction under the Australian Privacy Principles and the Privacy Act 2020, and the right to complain to the OAIC or the Office of the Privacy Commissioner.
• Switzerland (revFADP). The rights of access, rectification and erasure under the revised Federal Act on Data Protection, and the right to complain to the FDPIC.
• Every other market we sell in. The Service is priced for, among others, Japan (APPI), South Korea (PIPA), Singapore (PDPA), Hong Kong (PDPO), Taiwan (PDPA), Thailand (PDPA), Vietnam (PDPD), India (DPDP), Brazil (LGPD), Mexico (LFPDPPP), Argentina (PDPA), Chile, Colombia, Peru, Israel (PPL), Türkiye (KVKK), Ukraine and South Africa (POPIA). Wherever a data-protection statute applies to you, the rights it grants apply here. Write to support@casestudies.chat and say what you want done; you do not have to cite the statute or know its name.

Children

The Service is not directed to children, being persons under sixteen in the European Economic Area and the United Kingdom and under thirteen elsewhere. Data relating to such persons is not knowingly collected. Notification that a child holds an account will result in its deletion.

Amendment

Amendments to this notice are reflected in the date recorded below. Any amendment materially affecting data subjects is published on the site before it takes effect.

Effective 25 August 2026 · CaseStudies.Chat · support@casestudies.chat