Caseura Privacy Policy

1. Who we are

Caseura is a business software platform designed to help food and beverage brands discover potential customers, organise sales activities, manage customer relationships, and prepare AI-assisted outreach.

For the purposes of applicable data protection law, including the EU General Data Protection Regulation (GDPR), the proposed data controller is:

• Controller: Daniel Taylor, trading as Caseura
• NIF: Z4413612D
• Email: hello@caseura.io
• Postal address: [UNRESOLVED — confirm the address that can lawfully be published before launch]

This policy explains how Caseura collects, uses, stores and protects personal data when people visit the website, create or use an account, interact with the platform or contact us.

2. Personal data we collect

The information collected depends on how you use Caseura.

Account and team information

We may process information such as:

• Name and email address
• Account credentials and authentication information
• Company and team membership
• User role, permissions and account status
• Invitations, notifications and account activity

Sign-in is handled through Lovable Cloud authentication. Caseura provides email/password and Google sign-in, with registration currently restricted to invitations. Users can enable an authenticator-based second sign-in step.

Customer, lead and CRM information

Depending on how you use Caseura, the platform may contain:

• Business names and business contact details
• Lead and customer records
• Contact names, job titles, business email addresses and telephone numbers
• Sales tasks, notes, events and interaction history
• Products, promotions, wholesalers and related business information
• Outreach drafts and related records
• Business discovery searches, including the locations and business types searched and the business results returned
• Opt-out and suppression records
• Images or other files uploaded to the platform, such as customer photos and company logos

You are responsible for ensuring that you have an appropriate legal basis to upload and use personal data in Caseura, including data relating to your prospects and customers.

Communications and support

If you contact Caseura, we may process your email address, the contents of your message and information needed to respond.

Caseura stores a history of emails prepared within the platform, including relevant details and correspondence content. Email history is private to the user who created it and is not visible to other members of the same company.

Caseura prepares outreach drafts, which users copy or open in their own email program. Caseura does not send outreach emails directly from the application. Caseura does send account-related emails, such as welcome and authentication emails.

Technical and security information

The platform and its service providers process technical information for operation and security, such as authentication events, timestamps, diagnostic information, error reports and security-related activity. Lovable also reports hosting request logs and, with Visitor analytics enabled for Caseura, page-view events containing full requested URLs and a session identifier. These analytics data are pseudonymous, not anonymous; see section 10.

3. How we use personal data

Caseura may use personal data to:

• Create and manage accounts
• Authenticate users and manage team access
• Provide CRM, lead discovery and sales-management functionality
• Process user instructions and generate AI-assisted suggestions
• Provide customer support
• Maintain service reliability and security
• Detect misuse, investigate incidents and enforce platform rules
• Meet applicable legal and regulatory obligations
• Communicate important service, account or policy updates

We will not use personal data for purposes incompatible with those described in this policy without an appropriate legal basis and, where required, further notice or consent.

4. Legal bases for processing

Where the GDPR applies, Caseura may rely on the following legal bases, as appropriate to each processing activity:

Performance of a contract: Processing necessary to provide the service, manage accounts and carry out actions requested by users.

Legitimate interests: Processing necessary for legitimate interests such as protecting the platform, preventing misuse, maintaining security and responding to business enquiries, provided those interests are not overridden by the individual's rights and freedoms.

Legal obligation: Processing required to comply with applicable law.

Consent: Processing based on consent where consent is legally required, such as for certain non-essential cookies or other activities where consent is the appropriate legal basis.

Where processing relies on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

The appropriate legal basis must be assessed for each processing activity rather than assumed to be the same for all data.

5. AI-assisted features

Caseura includes AI-assisted functionality for product matching, venue ranking, outreach drafts, customer emails and an in-product help assistant.

To process these requests, relevant information is sent through Lovable's AI service to an external AI model, which returns a response. Some of this information may include personal data.

According to Lovable, the AI Gateway entry point is hosted in the EU, but requests are passed to model-provider endpoints hosted in the USA. The complete AI-processing path is therefore not EU-only.

Lovable says app users' data is not used to train Lovable models, and that its provider agreements limit content use to service delivery and prohibit model training. These are statements supplied by Lovable, not independently audited guarantees by Caseura. Retention periods for AI request/response content at Lovable and model providers are unpublished; no zero-retention guarantee is available.

The separate Pro-plan builder-content training opt-out is OFF. That setting concerns builder-contributed prompts, code, files and generated output, not Caseura end-user data. It does not mean previously processed builder content has been removed. It is distinct from the AI app context setting described in section 10.

Product matching, venue ranking, outreach drafts and customer emails

These features use Lovable's AI service; their specific model providers are not confirmed for this policy. Requests may include relevant business, venue, product, company-profile and promotion information, together with user instructions and examples of the user's preferred tone.

Customer-email requests may also include a contact's first name, job title, past engagement, notes, product mix, order timing and order-value figures.

The sender's own email signature is added afterwards and is not sent to the AI model for these features.

Casey, the in-product help assistant

Casey uses an OpenAI model through Lovable's AI service. Casey receives the questions the user has asked during the current session, the name of the page the user is on (from an approved list), and a fixed help guide about using Caseura.

Casey does not receive CRM records, such as customer, lead or contact details, and cannot make changes in the account.

AI-generated results may be incomplete or inaccurate. Users should verify important information before relying on it or contacting a prospect.

6. Service providers and data sharing

Caseura uses the following third-party providers to operate the service:

• Lovable Cloud: hosting, database, authentication, file storage, background jobs and transactional email.
• Lovable AI service: processing of requests for AI-assisted features.
• AI model providers through Lovable: providers for product matching, venue ranking, outreach drafts and customer-email features remain to be confirmed.
• OpenAI: AI model used for Casey, the in-product help assistant.
• Google Maps / Places: business discovery searches.
• Google: Google sign-in, where a user chooses it.

On the Pro plan, Caseura does not have an Article 28 processor agreement in its own name. Lovable identifies its Terms and Privacy Policy (https://lovable.dev/privacy) as governing the relationship and publishes https://lovable.dev/data-processing-agreement. Its official subprocessor list is https://trust.lovable.dev/subprocessors. The contractual roles and legal adequacy of the existing arrangements remain unresolved; this policy does not establish that they are legally sufficient.

The legal identities of these providers, their contractual roles, retention practices, processing regions, international transfers and data-protection terms have not all been confirmed and remain subject to verification.

Providers may process personal data as necessary for their services and subject to applicable contractual arrangements and laws. Where a provider processes personal data on Caseura's behalf, appropriate data-processing terms must be in place. Some providers may act as independent controllers for particular processing activities; their roles must be assessed individually.

Caseura does not sell personal data as a business model. Personal data may nevertheless be disclosed where necessary to operate the service, comply with the law, protect rights or respond to lawful requests.

7. International data transfers

Personal data may be processed in countries outside Spain or the European Economic Area, depending on the providers and infrastructure used.

The confirmed project database region is Europe (Ireland), running PostgreSQL 17.6.1.127. Lovable says daily full database snapshots are stored in the same region as the database. Storage files are not included in these database backups, and the file-storage location remains unconfirmed. Lovable reports an EU AI Gateway entry point forwarding requests to model-provider endpoints in the USA (see section 5); other hosting, network and provider processing locations remain to be confirmed.

Lovable's Privacy Policy (https://lovable.dev/privacy) states that its international-transfer mechanisms include EU Standard Contractual Clauses where applicable. This is Lovable's stated position, not Caseura's independent verification of the mechanisms applicable to each data flow. The required transfer safeguards and their legal adequacy for Caseura remain subject to review.

8. Data retention

Caseura retains personal data for as long as reasonably necessary for the purposes described in this policy, including providing the service, maintaining security, resolving disputes and meeting legal obligations.

Retention periods depend on the type of information and the reason it is held. Some records may need to be retained for longer where required by law or necessary to establish, exercise or defend legal claims.

Account deletion

When a member deletes their account, the following happens immediately: company work records they owned are transferred to an authorised company manager, their private email history is deleted, their personal profile details are cleared, they can no longer sign in, and historical activity shows them as "Former member".

Removal of their profile photo and login record is then queued for processing by a background cleanup task and is not completed instantly. Suspending a member blocks sign-in but does not delete their data.

Company deletion

When a company owner deletes a company, the company enters a 30-day recovery period during which it can be restored. After that period, the company's records are permanently purged, and removal of its logos, customer photos and the login records of people who belonged only to that company is queued for processing. Logins of people who still belong to another company are not removed.

This cleanup behaviour has not yet been verified through a live test.

Confirmed retention periods

• Company recovery period: 30 days after a company deletion request.
• Company logo links: temporary links to company logos expire after five minutes.

Caseura has adopted a proposed policy of retaining contact and support emails for 12 months after the last meaningful interaction, except for ongoing issues, legal obligations and disputes. This period is not yet technically enforced, and support emails are not currently deleted automatically.

Lovable says daily full database snapshots are stored in the database region, Europe (Ireland), and do not include storage files. Backup retention periods are unpublished. Deleted database rows may remain in snapshots until those backups age out; deleting live records does not promise immediate erasure from backups.

Retention periods are unpublished for database backups, hosting/application logs, email delivery logs, analytics and AI request content. Provider-held copies and inbox copies are not guaranteed to be erased immediately. Lovable says deletion of the hosting project makes its data inaccessible immediately, with permanent deletion, including backups, following after an unpublished holding period. This is distinct from deleting a Caseura member, company or database record. There is no API for deleting individual AI Gateway log entries; AI app context OFF affects only new AI activity logs and does not delete historical entries. Caseura does not promise immediate erasure from every provider, log or backup.

9. Data security

Caseura implements technical measures intended to protect personal data against unauthorised access, loss, misuse, alteration and disclosure. These include authentication, role-based permissions, server-side access checks and database access restrictions for company records and private email history.

No system can be guaranteed to be completely secure. Caseura will address personal data breaches in accordance with applicable legal obligations.

Users are responsible for protecting their login credentials and ensuring that team members receive access only where appropriate.

10. Cookies and similar technologies

A review of the Caseura application found no application-added analytics, advertising or tracking scripts. This does not mean the hosted site has no analytics: Lovable Visitor analytics is ON for Caseura.

Caseura uses browser storage for three purposes:

• Login session: keeping you signed in to your account.
• Theme preference: remembering whether you chose a light or dark appearance.
• Sidebar state: remembering whether the in-app sidebar is expanded or collapsed.

Hosting, logs and provider cookies

Lovable says published-site requests, including API routes, can generate hosting logs containing the full URL and query string, request method, caller IP address, response status, timing and approximate country/city derived from IP. These logs do not include request headers or bodies, but server console output may be stored as written. According to Lovable, these logs support hosting and security, not advertising or tracking users or devices. Their retention periods are unpublished. These are provider statements, not an independent inspection of all published-site logs.

Lovable identifies `__cf_bm` for Cloudflare bot management, `_dpl` or `__dpl` for deployment routing, and `session-id` when Visitor analytics is ON. The deployment-routing cookie identifies a deployment, not a visitor. These provider-identified cookies are not a verified exhaustive list of cookies or tracking technologies on the actual published site.

Visitor analytics is ON for Caseura. According to Lovable, page-view events include the full requested URL and a session identifier. These data are pseudonymous, not anonymous. Analytics retention periods are unpublished. Lovable provides no consent API or visitor opt-out for published sites; whether legally required consent applies, and how any required consent would be obtained, remains unresolved.

Caseura's AI app context setting is OFF. New AI activity logs omit full request/response content and retain summaries instead. This does not delete existing logs, control hosting request logs or establish external model providers' retention. There is no API for deleting individual AI Gateway log entries.

The legal need for consent and suitable arrangements for obtaining, managing or withdrawing it remain subject to review. This working draft does not assert that consent is unnecessary or that a compliant consent mechanism currently exists.

11. Your data protection rights

Subject to applicable law, you may have the right to:

• Request access to your personal data
• Request correction of inaccurate or incomplete data
• Request deletion of personal data
• Request restriction of processing
• Object to certain processing
• Receive certain personal data in a portable format
• Withdraw consent where processing relies on consent
• Lodge a complaint with a competent data protection authority

To exercise your rights, contact hello@caseura.io. We may need to verify your identity before responding.

We will respond within the time limits required by applicable law. Under the GDPR, this is generally one month, although permitted extensions may apply in certain circumstances.

If you are in Spain, you can contact the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD) at https://www.aepd.es.

12. Your responsibilities when using CRM data

If you upload or manage personal data about prospects, customers or other contacts in Caseura, you remain responsible for complying with the data protection rules that apply to your own activities.

This may include providing appropriate privacy information, establishing a lawful basis for processing, respecting objections and marketing opt-outs, keeping data accurate and ensuring that information is not used unlawfully.

Caseura's provision of software does not automatically make every use of data entered by a customer lawful.

13. Children's data

Caseura is a business-oriented service and is not intended for children. We do not knowingly seek to collect children's personal data through the service.

If you believe a child has provided personal data inappropriately, contact hello@caseura.io so that the matter can be reviewed.

14. Changes to this policy

We may update this Privacy Policy to reflect changes to the service, our data-processing practices or applicable law.

The latest version will be published on the Caseura website with its updated date. Where required by law, we will provide additional notice of material changes.

15. Contact

For questions about this policy or to exercise your data protection rights, contact:

Daniel Taylor, trading as Caseura

Email: hello@caseura.io

Postal address: [UNRESOLVED — confirm before publication]