Privacy policy

This policy explains what personal data LegalTech ("we") processes when a law firm uses CaseFlow Desktop ("CaseFlow") and its integrations, and when you visit caseflow.co.il. The short version: the firm's case data lives on the firm's own computers, encrypted, and never reaches our servers. Our servers see only what is needed to issue licences, to relay a few optional services, and to keep the software working.

The policy is written under Israel's Protection of Privacy Law, 5741-1981, as amended by Amendment 13, and the Protection of Privacy Regulations (Data Security), 5777-2017.

1. Who is responsible

The controller for the data described in sections 3 to 6 is LegalTech, Israel, contact privacy@caseflow.co.il. For the case data the firm keeps in CaseFlow (section 2), the firm is the controller and we are not a processor: we have no access to it.

2. Data that stays on the firm's computers

Clients, contacts, cases, documents, hearings, time and billing records, e-mail and messages, and the details of meetings scheduled through Zoom (meeting id, topic, start time, duration, join link) are stored in a local database on each computer where CaseFlow is installed. The database is encrypted, and its key never leaves that computer. Credentials for connected services, including the Zoom authorisation tokens, are stored only on that computer. None of this is transmitted to us.

3. Data our servers process

Licensing. To issue and renew a licence we keep the licensee's name and e-mail address, the licence key, tier, seats and expiry, and for each activated computer a one-way fingerprint (not a serial number), the app version and the activation and last-seen times. Licence events (activation, refresh, deactivation, seat refusals) are logged with the requesting IP address. Purpose: performing the licence contract and enforcing seat limits. Kept for the life of the licence relationship.

Zoom and other OAuth sign-ins. When you connect Zoom, Zoom redirects your browser to an endpoint of ours. That endpoint forwards the authorisation code straight back to CaseFlow on your computer and stores nothing: no code, no token, no account identifier. We never receive your Zoom tokens, your Zoom profile, or any meeting content.

Crash reports and usage events. The reporting mechanism exists in the software but is switched off in the current release, and nothing is transmitted. If it is enabled in the future, a report will contain the error message, file paths made relative to the app and version numbers, scrubbed of identifying data and not linked to a licence or a firm, and will be deleted automatically after 180 days. This policy will be updated before that happens.

Managed AI (optional). If the firm uses CaseFlow's managed AI instead of its own provider keys, the text the lawyer chooses to send (for example a document to summarise) passes through a proxy of ours to the model provider, in a processing region in the European Union. The proxy adds the provider key and records only usage meters, the model and the cost against the licence, for metering. The content itself is not stored or logged by us. The providers process it under their API terms, which exclude training on API data.

Remote signing (optional). When a lawyer sends a document for a client to sign from a browser, the PDF, the signer's name, e-mail and phone, and the signature placements are stored on our server behind an unguessable single-use link, and the signer's IP address and the time of viewing and signing are recorded as evidence under the Israeli Electronic Signature Law. The signed PDF is returned to the firm's CaseFlow. Purpose: performing the signing service the firm requested. Retention: for the life of the licence relationship, unless the firm asks us to delete a request earlier.

Support. If you contact support by e-mail or WhatsApp, we keep the correspondence for as long as needed to resolve the matter. If you use the in-app support assistant, your question is answered by an AI model and is not stored; only usage meters and a session id are recorded. If you ask the assistant to escalate to a person, your name, e-mail, phone and the conversation transcript are sent to us and held in a delivery queue until the send is confirmed.

The website. Visiting caseflow.co.il sets no tracking cookies and loads no third-party services. The server keeps an operational access log with the IP address, deleted after 30 days. The contact form passes what you filled in (name, e-mail, phone and firm if given, topic and message) to our support mailbox through an e-mail delivery provider, and sends you an acknowledgement. The server log records a hashed identifier of the address, not the address itself, to prevent abuse. The message is kept for as long as needed to answer it.

4. Sharing

We do not sell or rent personal data and do not share it with third parties for their own purposes. Data is shared only with the service providers named above, each acting on our instructions: the model providers (for managed AI), our e-mail delivery provider (for the contact form, support escalations and licence correspondence), and our hosting provider, Hetzner Online GmbH, whose servers in the European Union run the licence service and this website. Data may be disclosed where the law requires it.

5. Security

All traffic between CaseFlow and our servers is encrypted. The local database is encrypted; the licence service runs in an isolated environment and its database is reachable only locally. Servers are patched and access is limited to the development team. The Zoom integration uses OAuth 2.0 with PKCE and requests only the scopes it needs: create, update and delete meetings, and read the connected user's own profile.

6. Your rights

Under the Israeli Protection of Privacy Law, and where it applies the EU GDPR, you may ask to access, correct or delete the personal data we hold about you, to receive a copy of it, or to object to a processing. For the data in section 3 write to privacy@caseflow.co.il; we answer within 30 days and may ask you to confirm your identity. For case data held by a law firm in CaseFlow, address your request to that firm. To stop CaseFlow's access to your Zoom account, disconnect it in CaseFlow (Settings → API Keys & Integrations → Zoom → Disconnect) and remove the app at marketplace.zoom.us under Manage → Added Apps; see the Zoom guide. You may also complain to the Israeli Privacy Protection Authority.

7. Children

CaseFlow is a professional tool for law firms and is not directed at children.

8. Changes

The current version of this policy is always at this address, with the date above. Material changes are announced to licensees by e-mail before they take effect.