Privacy notice

Who we are

Casebriar Ltd (“Casebriar”, “we”) is the controller for the information described here. Our postal address is 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ. You can contact us about anything in this notice at support@casebriar.com.

This notice covers our website, our business marketing, free-month sign-ups, the accounts of people who use the Casebriar application and the problem reports they send us. It does not cover the tenant complaints agencies put into the application: for those, the agency is the controller and we act on its instructions, as set out in our data processing terms.

Our lawful basis, in brief

The UK GDPR lets us use personal information only where we have a lawful basis for it. Here is ours for each use; each section below explains more.

Wherever we rely on legitimate interests, you can object (see “Your rights” below).

Business contact details we collect

Casebriar is software for letting agents and property managers. To tell businesses about it, we keep a record of UK letting and property management businesses and how to contact them. This can include:

• the business name, company number, registered office, company type and status;
• its website, branch addresses and business phone numbers;
• business email addresses published by the business, such as a lettings or enquiries inbox;
• the name, job title (where shown) and work email address of a person the business lists on its own website with their own address, such as someone who handles its complaints, manages its lettings or property management, owns or directs it, or works in its lettings team. We write to that person rather than a shared inbox, and we don’t keep the details of people whose role is plainly unrelated, such as sales or accounts. Where the business publishes a work address that is itself a person’s name (such as sarah@ or j.smith@) without printing the name beside it, we may write to that address too, greeting the person by the first name the address shows. Where an address the business publishes belongs to one of its current directors, we take that director’s name and role from the Companies House register; we don’t keep the other names on the register. If we don’t write to someone within 25 days of finding their name, we delete their name and job title;
• a record of the emails we’ve sent, replies, whether a link in our email was clicked, calls, notes, and any request not to be contacted.

Where it comes from

We collect these details from public sources: Companies House, the business’s own website, and search engine results that point to it (we use the Brave Search API). We record which source each detail came from. We don’t buy contact lists, we don’t guess email addresses, and we don’t collect personal (non-business) contact details.

Why, and on what basis

We use these details to send occasional emails about Casebriar to businesses it may be relevant to, and to follow up where someone has shown interest. Our lawful basis is legitimate interests: telling relevant businesses about a product that may help them, in a way they’d reasonably expect, with an easy way to say no.

The Privacy and Electronic Communications Regulations (PECR) let us send these emails to companies and limited liability partnerships (“corporate subscribers”) without asking first, as long as each email says who we are and gives an easy way to opt out. We don’t send unsolicited marketing emails to sole traders or partnerships, unless they have asked to hear from us.

Saying no

Every marketing email has an unsubscribe link, and you can also reply “unsubscribe” or email us. You have an absolute right to object to direct marketing. When you do, we stop straight away and keep only the minimum needed to make sure you aren’t contacted again (a suppression record).

Free-month sign-ups

When you sign up, we use your agency name, manager name, work email and password (stored only as a secure hash) to create and secure the account, and we email you a link to confirm your email address. The free month is one month of the Essential plan, free: up to 5 complaints over 30 days. Our lawful basis is the same as for the application’s accounts (see below).

If you signed up through a link in one of our emails or campaigns, we keep the link’s reference and UTM tags to understand which outreach led to the sign-up. The reference shows which of our emails it was, so it links your agency’s account to our record of your business. Our lawful basis for this is legitimate interests: knowing which of our outreach works.

Requests made through our earlier request form

Before the free month, agencies could ask to try Casebriar through a request form on this website. That form has closed. For requests made through it, we use what you gave us (your name, work email, phone, role, agency details and message) to review the request, set your agency up on the free month if we approve it, contact you about it and ask for feedback. The basis is taking steps at your request, and our legitimate interest in following up a request you made. If you ticked the box for product updates, we’ll also email you about Casebriar on the basis of your consent, which you can withdraw at any time.

What the application tells our growth console

Our growth console is the separate system we use for marketing and customer relationships. The Casebriar application sends it a short message when any of these happens in an agency’s account:

• the agency’s account is created;
• its free month starts;
• someone accepts an invitation to the account;
• someone signs in;
• a case is created;
• an analysis is saved to a case;
• a reply is drafted;
• a reply is approved;
• someone saves past replies for drafts to follow;
• someone clears their saved past replies;
• a document in the agency’s policy library has been processed;
• one of its policies is used in an assessment;
• an assessment of a complaint against its own policies is completed.

Each message says only what happened, when, and which agency account it was. For a drafted reply it also says whether saved past replies were used, never their text. When an account is created or a free month starts, the message also carries the agency’s name and any reference and UTM tags from the sign-up link, and for a free month the date it ends.

The console can also ask the application, over a signed, read-only connection, for a summary of each agency’s use: its name, its plan or free-month status and end date, the number of users, cases and complaints used, counts of analyses (including any that failed), drafts and how many used saved past replies, approved replies, policy assessments and processed policy documents, whether past replies are saved, and the dates of its first and most recent activity, sign-in and analysis.

None of this includes complaint content, case details, document titles or contents, or the names or email addresses of the people who use the application.

We use it to run the free month (for example, to see whether an agency has started using Casebriar and when its month ends), to support agencies on any plan, to see which of our outreach works, and to improve Casebriar. Our lawful basis is legitimate interests: running the free month, supporting agencies and improving Casebriar, using counts and dates rather than anything from a complaint. You have the right to object to this (see “Your rights” below).

People who use the Casebriar application

If your agency gives you a Casebriar account, we hold your name, work email, role, agency, password (stored only as a secure hash), when you sign in, and a record of the actions you take in the application, so we can provide the service, keep it secure and support you. We also keep any past replies you choose to save so drafts can match your style; you can change or delete them at any time. We email you about your account, for example a link to confirm your email address, to set or reset your password, or to accept an invitation.

Our lawful basis is contract: we need this information to provide the service your agency has signed up for. Where the contract is with your agency rather than with you personally, our basis is legitimate interests: providing the service your agency asked for, and keeping it secure. We keep account data while your account is active and for up to two years after it closes.

Problem reports

People signed in to the Casebriar application can report a problem to us from its help page. A report holds what you write, the kind of problem you choose, the case reference if you give one, which page of the application you were on, your agency, who sent it and when.

Casebriar staff read reports to find and fix problems, and we keep them so problems can be tracked over time. Our lawful basis is legitimate interests: keeping Casebriar working for the agencies that use it.

The form asks you not to include names, addresses, contact details or complaint text, and to give the case reference instead. Before a report is stored, email addresses, phone numbers, postcodes, names that follow a title such as “Mr” or “Dr”, street addresses and long numbers that Casebriar recognises are replaced with “[removed]”. This works by recognising patterns, so it can miss things: please still leave personal details out. 90 days after a report is sent, it no longer records who sent it; your agency and the case reference stay with it. Reports sent before we added these steps are cleaned in the same way.

Replies and calls

When you reply to us, we keep the reply so we can respond and so we don’t contact you if you’ve asked us not to. Fixed rules spot bounces, out-of-office messages and clear unsubscribe requests. Other replies to our emails, and mail from businesses already in our records, may be sorted by an AI service; anything else is left for a person to sort. A person reads anything that needs a response. We may phone a business number where someone has shown interest; we don’t make unsolicited marketing calls to numbers registered with the Corporate Telephone Preference Service. Our lawful basis is legitimate interests: answering you, and making sure we respect any request not to be contacted.

This website

We don’t use advertising or analytics cookies. We count page visits in aggregate (which page, which site referred the visit, and campaign tags in the link) without storing IP addresses or setting cookies. If you arrived from one of our emails, the link carries a reference so we can tell which email it came from.

We also use Searchable, a marketing tool, to see how AI assistants and search engines find this website. We send the page path, referring site, campaign tags, request time, HTTP method, response status and duration, and the browser or crawler’s User-Agent string (up to 512 characters). This metadata can describe a browser, device or crawler. Our analytics payload excludes IP addresses and cookies.

Our lawful basis is legitimate interests: understanding how people find and use this website, and which of our emails work.

Who we share it with

We use service providers to run Casebriar: hosting and database (Railway), email (Google Workspace), receiving forwarded complaints by email (Postmark), web search for business websites (Brave), an AI provider for analysing complaints, sorting replies and drafting content (Anthropic), and marketing analytics for this website (Searchable). They process data on our instructions. Some of them may process data outside the UK, in which case we rely on UK-approved safeguards such as adequacy regulations or the International Data Transfer Addendum. We don’t sell data.

How long we keep it

Business contact records that have had no response are deleted automatically 24 months after we first recorded them, or 24 months after our last email to them if that is later. Bounces and out-of-office replies are deleted after six months. Records of people and businesses we’re in conversation with, or whose agency uses Casebriar, including the usage events above, are kept while that relationship continues and for up to two years after.

Accounts in the Casebriar application are kept while they are active and for up to two years after they close. Problem reports are kept so problems can be tracked over time, with no set end date; 90 days after a report is sent, it no longer records who sent it. Suppression records are kept indefinitely, because that’s how we make sure you’re not contacted again.

Your rights

You can ask for a copy of the information we hold about you, ask us to correct it, delete it or restrict how we use it, and object to how we use it. Wherever we rely on legitimate interests, including for the usage events and problem reports, you can object at any time, and we’ll stop unless we have compelling reasons to carry on that override your interests. Where we rely on consent, you can withdraw it at any time. Email support@casebriar.com. You can also complain to the Information Commissioner’s Office (ico.org.uk), though we’d appreciate the chance to put things right first.

Cookies and changes to this notice

See our cookie notice for the few cookies we use. If we change this notice we’ll update the date at the top; significant changes will be highlighted on this page.