Privacy Policy.

CaseLens generates teaching case reports for higher-education classrooms. The service is operated by Masa Concept Lab, which is the data controller for the personal information described here.

Questions, requests and complaints all go to the same place: hello@caselens.cc.

This policy sits alongside our Terms of Use. It covers two kinds of visitor: educators who hold an account, and students or readers who open a case someone has shared with them.

We have kept the service deliberately thin on personal data. What it holds is:

• Your email address, if you have an account, along with when the account was created, when it was last used, and whether the free first case has been used. There is no password to store: we sign you in with a single-use link, and even those links are stored only as a one-way hash.
• What you type into a case — the company name, any additional information or teaching guidance, the topics you select, the discussion questions you curate — plus the case, teaching note and sources that come back, the AI model used, and how many students you licensed it for.
• Purchase records: what was bought, the amount, the currency, the status, and the Stripe identifiers for the payment. Card details are entered on Stripe's own checkout and never reach us.
• Feedback you send us through the feedback button: your message, the page you sent it from, and your email address if you choose to include one. Also, if you register interest in a subject beyond strategy, your email address, department and any comments.
• Reading activity: for each case, a count of how many times a given browser has opened it and when it last did, and which strategy-concept cards were opened. This is tied to the browser identifier below, not to a name.
• Highlights and notes where annotation is enabled: the passage you highlighted, the note you wrote, its colour and position in the case.
• Technical data: your IP address is read from the incoming request to apply rate limits. It is held in memory for that check and is not written to our database. Our hosting provider keeps standard server logs.

We do not ask for, and do not want, student names, student numbers, grades or any other personal information about the people in your class. Please do not put them into a case request or teaching guidance.

CaseLens sets three first-party cookies and no others. All of them are HTTP-only, which means the page's JavaScript cannot read them, and none of them follow you to other sites.

• caselens_session — your signed sign-in token, holding your account id and email. It lasts 30 days and renews while you keep using CaseLens, so only a genuinely idle month signs you out. Signing out clears it.
• caselens_viewer — a random identifier for your browser, set when you open a case and kept for a year. It is what makes annotation possible without student accounts: it brings your highlights and notes back on your next visit. It is also what lets us count how many distinct browsers have read a case and which concept cards get opened. It contains no personal information and is not linked to your identity unless you also have an account.
• caselens_admin_token — set only on the operator's own admin screen.

Two things are kept in your browser's local storage rather than in a cookie: a note you write while your connection is down, held only until it reaches us and then removed, and a flag remembering that you dismissed the annotation notice. Neither is sent anywhere else, and clearing site data removes both.

There are no advertising cookies, no cross-site trackers, and no third-party analytics scripts. Clearing cookies signs you out and, as the annotation panel warns, means saved notes will not be found again — the notes panel has a one-click Markdown export for exactly that reason.

Under the UK GDPR and EU GDPR we need a legal basis for each use. Ours are:

• To run the service — signing you in, generating and storing your cases, publishing them, saving annotations, and emailing you when a case is ready or has failed. Basis: performance of our contract with you.
• To take payment and keep records of what was bought and refunded. Basis: performance of our contract, and our legal obligation to keep accounting records.
• To keep the service working and honest — rate limits, capacity controls, spotting abuse, and investigating problems you or we report. Basis: our legitimate interest in a service that stays available and is not abused.
• To improve CaseLens — reading feedback, and looking at aggregate reading activity to see whether features like the concept layer are actually used. Basis: our legitimate interest in improving the product. We look at this in aggregate; it is not used to profile individual readers.
• To follow up on interest you register in subjects we do not yet cover. Basis: your consent, which you can withdraw at any time by emailing us.

We do not sell personal information, and we do not use it for advertising. We do not send marketing email; the email we send is transactional — sign-in links, and news about a case you asked for.

CaseLens is a small service built on established providers. Each one processes data on our instructions, under a contract, and only for what it is listed here to do:

• Vercel — hosting and serving the site; standard request logs.
• Neon — the managed PostgreSQL database where accounts, cases, purchases, annotations, reading counts and feedback are stored.
• OpenAI and Anthropic — the AI models that research, write and check a case, including the web searches their research step runs.
• Financial Modeling Prep — financial statements for the company a case is about. It receives the company or ticker being looked up, and nothing about you.
• Resend — sending transactional email, which means it processes your email address and the message.
• Stripe — taking payments and issuing refunds. Stripe collects your payment details directly as an independent controller for its own compliance purposes, under its own privacy policy.

Beyond these, we share personal information only where the law requires it, to establish or defend legal claims, or with a successor if the service is transferred — in which case this policy continues to apply until you are told otherwise.

This one deserves its own section, because it is the least obvious. When you request a case, the company name and anything you write in the additional-information or guidance boxes are sent to the AI provider that generates it, and the research step issues web searches for the company through that provider.

We use these providers through their commercial APIs rather than their consumer chat products, and we do not opt in to any use of submitted content for training their models. Even so, treat what you type as leaving CaseLens: it should be teaching direction about a public company, not confidential or personal material.

Highlights and notes are stored on our servers, not on your device. What your browser holds is only the identifier they are filed under. This is worth being clear about, because the annotation panel says notes are "tied to this browser", and that is true in effect for a different reason than it sounds: the notes are in our database, and the cookie is the only thing that can find them again.

Which is also what happens when that cookie goes. Clearing cookies, switching device, or using private browsing does not delete the notes — it leaves them in our database with nothing able to match them to you, and you start fresh. Export keeps a copy while you still can.

Annotations are keyed to that identifier, or to your account if you have one, and CaseLens only ever returns a reader their own. Neither the educator who created the case nor any other student can see them through the service.

That last part is a product guarantee, not a technical impossibility: because the notes sit in our database, we can reach them for support or abuse investigations, and, unlike an end-to-end encrypted system, we could read one if we had to. We do not do so as a matter of course.

Our providers operate internationally, and some process data outside the UK and European Economic Area, including in the United States. Where that happens, the transfer relies on the safeguards those providers offer — UK and EU standard contractual clauses, the UK addendum, or an adequacy decision — under our contracts with them.

• Cases are kept indefinitely by design. A published case has a permanent URL that a syllabus may point at for years, and a private case stays in your dashboard until you ask us to remove it.
• Your account is kept while it exists, and deleted on request.
• Sign-in links expire within an hour (a week for the link inside a case-ready email), are single-use, and are only ever stored as a hash.
• Purchase records are kept for at least six years, because tax and accounting law requires it.
• Annotations, reading counts and concept-card counts are kept while the case is available. A student can delete any note from the notes panel at any time, which removes it from our database.
• Feedback and interest registrations are kept while they are useful to the product, and deleted on request.

The site is served over HTTPS. Sign-in cookies are HTTP-only, signed, and cannot be read by page scripts; sign-in links are single-use, short-lived and stored only as hashes; there are no passwords to leak. Card details never touch our systems. Access to the production database is limited to the operator, and annotation and case routes check ownership on every request rather than trusting the identifier a browser sends.

No service is perfectly secure. If we suffer a breach affecting your personal data, we will notify the Information Commissioner's Office and, where the law requires it, you.

If you are in the UK or EEA, you have the right to ask us for a copy of your personal data, to correct it, to delete it, to restrict or object to how we use it, to receive it in a portable form, and to withdraw consent where consent is the basis we rely on. Similar rights apply in many other jurisdictions.

Email hello@caselens.cc and we will respond within one month. There are two limits worth stating up front: we cannot delete purchase records we are legally required to keep, and a case you have published and licensed to a class may stay available while students are relying on it — we will discuss the options with you rather than break a live course.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk, or to your local supervisory authority in the EEA. We would appreciate the chance to put it right first.

CaseLens is for higher education. Accounts are for adults, and cases are written for university-level classes. We do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal data, tell us and we will delete it.

AI writes the cases, but it makes no decisions about you. Nothing in CaseLens profiles you or makes automated decisions with legal or similarly significant effects.

We will update this policy as the service changes, and the date at the top shows when we last did. If a change materially affects how we use your personal information, we will give reasonable notice by email or on the site before it takes effect.

Email hello@caselens.cc, or use the feedback button in the bottom-right corner of any page. It reaches the person who built CaseLens.