Privacy Policy

CasePilot is an online platform operated in the Czech Republic that connects clients with verified lawyers for consultations, bookings, and ongoing communication. The data controller for your personal data is CasePilot.

For any questions about this policy or your personal data, you can contact us at support@casepilot.cz.

We collect data you give us directly when you use CasePilot:

• Account details — name, email, password, role (client or lawyer).
• Profile information — for lawyers, this includes bar number, practice areas, languages, location, biography, and pricing.
• Booking and message content — subjects, scheduled times, and messages exchanged with the other party.
• Payment information — for lawyer subscriptions, billing data is processed by our payment provider Stripe; we do not store your full card details.
• Technical data — IP address, browser type, device information, and basic usage logs needed to keep the platform secure.

We process personal data for the following purposes:

• Providing and operating the platform (performance of contract — Art. 6(1)(b) GDPR).
• Facilitating communication and bookings between clients and lawyers.
• Processing payments and managing lawyer subscriptions.
• Sending essential transactional notifications about your account, bookings, and messages.
• Keeping the platform secure and preventing fraud or abuse (legitimate interest — Art. 6(1)(f) GDPR).
• Complying with legal obligations under Czech and EU law.

We share data only when necessary to provide the service or meet legal requirements. This includes:

• Other users — when you book a lawyer or send a message, the relevant participant sees your profile and message content.
• Service providers — Stripe (payments), our cloud hosting and database providers, and email delivery services. They process data on our behalf under data processing agreements.
• Authorities — when required by law, court order, or to protect our legal rights.

We do not sell your personal data to third parties.

Some of our service providers may process data outside the European Economic Area. When they do, we rely on safeguards recognised under the GDPR — such as the European Commission's Standard Contractual Clauses — to ensure your data continues to be protected.

We keep personal data only for as long as necessary for the purposes described above. Account and profile data is kept while your account is active. Booking, message, and billing data may be retained for up to ten years where required by Czech tax and accounting law. When you delete your account, we delete or anonymise data that is no longer required.

You have the right to:

• Access the personal data we hold about you.
• Have inaccurate data corrected.
• Have your data erased ("right to be forgotten").
• Restrict or object to certain processing.
• Receive your data in a portable, machine-readable format.
• Withdraw consent at any time, where processing is based on consent.
• Lodge a complaint with the Czech Data Protection Authority (Úřad pro ochranu osobních údajů, www.uoou.cz).

You can exercise most of these rights directly from your account settings, or by contacting us at support@casepilot.cz.

We use industry-standard security measures including encryption in transit, secure password hashing, role-based access controls, and database-level row security to protect your data. No system is completely secure, but we work hard to minimise risk and respond quickly to incidents.

We use cookies and similar technologies to operate the platform and improve your experience. For details, see our Cookie Policy.

We may update this Privacy Policy from time to time. When we make material changes, we'll notify you through the platform or by email. The "last updated" date at the top of this page always reflects the most recent version.