How we handle your information.

This policy covers civilcase.com and the related services we operate under the CivilCase brand. It does not cover third-party websites we link to, payment processors we use, or courts and government agencies you submit filings to. Those have their own privacy policies.

We collect information in three buckets.

Information you give us. What you type into the case-build wizard: your name, address, the defendant’s name and address, the dispute amount, the facts of your case, evidence files you upload, and any other details required to draft a demand letter or filing guide. If you create an account, also your email and a hashed password.

Payment information. When you pay for a product, Stripe collects your card number, billing address, and similar details on our behalf. We never see or store full card numbers. Stripe sends us a transaction reference, the last four digits, the brand of the card, and whether the payment succeeded.

Information collected automatically. When you use the site we log standard request data: IP address, browser type, pages visited, timestamps, and similar diagnostic information. We also use cookies and analytics described below.

We use what we collect for these purposes:

• Run the service. Generate your demand letter, filing guide, and other case artifacts.
• Process payments. Charge you when you buy a product and issue refunds when warranted.
• Send transactional email. Receipts, account activity, mailing confirmations, hearing reminders, and similar service messages.
• Improve the product. Understand which features get used, which states need better content, and where users get stuck.
• Prevent abuse. Detect fraud, spam, and automated abuse of free tools like the case-score quiz.
• Comply with the law. Respond to legal process, enforce our terms, and protect the safety of users and the public.

We do not sell your personal information. We share it only with service providers that help us run CivilCase, and only as needed for them to perform their job.

• Hosting and data storage. Vercel for hosting and Supabase for application data.
• File storage. Amazon S3 for evidence attachments and generated PDFs.
• Payments. Stripe for processing card payments.
• Email. Resend for sending transactional email.
• AI processing. OpenAI for generating drafts of demand letters, filing guides, and procedural research. Inputs we send are limited to what the model needs to do the job. We do not use customer content to train any model.
• Mail delivery. Postal partners that physically deliver demand letters when you purchase that option.
• Analytics. Aggregate, pseudonymous usage analytics provided by industry-standard tools.

We may also disclose information if required by law, subpoena, or court order, or if we believe disclosure is necessary to protect the safety, rights, or property of CivilCase, our users, or the public.

We use cookies and similar technologies for two purposes: keeping you logged in to your account, and measuring how the site is used so we can improve it. You can disable cookies in your browser, but parts of the site will stop working if you do (account login, payment flows, the wizard).

Analytics tools we use receive pseudonymous identifiers and aggregate usage data. We do not use cookies for cross-site behavioral advertising.

We keep your case information as long as your account is active so you can return to your cases. If you delete your account, we delete your case content within thirty days, except where we are required to keep records for tax, payment dispute, or legal compliance reasons. Backup copies may persist for a short period after deletion before they roll out of our backup retention schedule.

Anonymized usage data and aggregate analytics may be retained indefinitely. Those records do not identify you.

We use industry-standard security practices to protect your information: encryption in transit (HTTPS everywhere), encryption at rest for the database and file storage, hashed passwords, and access controls that limit which staff or automated systems can read your data. No system is perfectly secure. We cannot guarantee that data sent over the internet or stored in our systems will never be accessed without authorization.

You can review and update most of your information directly in your dashboard settings. For anything you can’t change there, or to delete your account entirely, contact us through our contact page.

Depending on where you live, you may have additional rights under state law (California, Virginia, Colorado, Connecticut, Utah, and others) to access the personal information we hold about you, request a copy, request correction, or request deletion. To exercise any of those rights, contact us. We will verify your identity before acting on the request.

We do not sell or share personal information for cross-context behavioral advertising. There is nothing to opt out of in that regard.

CivilCase is not for anyone under eighteen. We do not knowingly collect personal information from children. If you believe a child has provided information to us, contact us and we will delete it.

We update this policy when our practices or the law changes. The “last updated” date at the top reflects the most recent change. Material changes will be highlighted on the site or sent to your account email. Continued use after a change means you accept the updated policy.

Questions, requests under state privacy law, or account-deletion requests can be sent through our contact page.