Privacy Policy

Version 1.0 — Effective date: 20 April 2026

1. Who We Are

Casework is operated by Aesthetic Ag Ltd, a company registered in England and Wales (Company Number 12626354), with its registered office at 113 Union Street, Oldham, United Kingdom, OL1 1RU.

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, Aesthetic Ag Ltd is the data controller for the personal data described in this Privacy Policy.

Contact: help@case-work.app

2. What Data We Collect

Data we collect and store on our servers:

Data	Purpose
First name, last name	Account identification, personalisation
Email address	Account authentication, communication
Google Account ID (OAuth users)	Authentication via Google Sign-In
Subscription plan and status	Service delivery, feature access
Trial start/end dates	Trial management
Video export count per month	Usage limit enforcement
Referral code and referral count	Referral programme
Terms acceptance timestamp and version	Legal compliance, consent records

Data we do NOT collect or store:

Patient photographs or dental images — all image processing occurs locally on your device. We never receive, transmit, or store these images.
Payment card details — handled entirely by Stripe. We only receive confirmation of payment status.
Logos — stored locally on your device in IndexedDB. If you explicitly enable cloud backup, saved logos are also stored in your private Casework account so they can sync across browsers and devices.
Template configurations — stored locally on your device in IndexedDB. If you explicitly enable cloud backup, template settings are also stored in your private Casework account. Patient photographs and dental images are not included in template backup.

3. Lawful Basis for Processing

Processing activity	Lawful basis
Account creation and management	Contract performance (Art. 6(1)(b) UK GDPR)
Subscription billing	Contract performance (Art. 6(1)(b) UK GDPR)
Usage metrics (video export count)	Legitimate interests — service operation (Art. 6(1)(f) UK GDPR)
Consent records (terms acceptance)	Legal obligation (Art. 6(1)(c) UK GDPR)
Referral programme	Legitimate interests — business growth (Art. 6(1)(f) UK GDPR)

4. How Data Is Stored

Your Account data is stored in Google Firebase (Firestore), hosted on Google Cloud infrastructure. Data is stored in compliance with Google Cloud’s security certifications and data processing agreements.

We do not transfer personal data outside the United Kingdom or European Economic Area. Where transfers are necessary (e.g. Firebase infrastructure), they are protected by appropriate safeguards as required by UK GDPR.

5. Third-Party Processors

Processor	Purpose	Privacy policy
Google Firebase	Authentication + database	firebase.google.com/support/privacy
Stripe	Payment processing	stripe.com/privacy
Google Fonts	Font delivery (Inter typeface)	policies.google.com/privacy
Spline	3D scene delivery	spline.design/privacy

We have data processing agreements in place with each sub-processor.

6. Data Retention

Active accounts: Your data is retained for as long as your Account is active.
Deleted accounts: On Account deletion, personal data will be removed within 30 days.
Consent records: Records of your terms acceptance (timestamp, version) are retained for 7 years after Account deletion, as required for contractual compliance records.
Payment records: Retained by Stripe in accordance with their data retention policies and applicable financial regulations.

7. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

Right of access — request a copy of the personal data we hold about you.
Right to rectification — request correction of inaccurate personal data.
Right to erasure — request deletion of your personal data (subject to legal retention requirements).
Right to restriction — request that we limit how we process your data.
Right to data portability — request your data in a structured, machine-readable format.
Right to object — object to processing based on legitimate interests.

To exercise any of these rights, contact us at help@case-work.app. We will respond within 30 days.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):

Website: ico.org.uk
Helpline: 0303 123 1113

8. Cookies and Local Storage

Casework does not use third-party tracking cookies.

We use the following browser storage mechanisms:

Mechanism	Purpose	Persistence
sessionStorage	UI state (e.g. trial banner dismissal)	Cleared on tab close
IndexedDB	Logos and template metadata stored locally	Persistent until manually cleared
Firestore cloud backup	Optional saved-logo and template-setting backup when enabled by you	Until deleted or cloud backup data is removed from your account
Firebase Auth tokens	Maintaining your login session	Persistent until logout

9. Children

The Service is not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have collected data from a child, contact us at help@case-work.app and we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or via an in-app notification. Material changes may require you to re-consent.

The date of the most recent revision will always be displayed at the top of this policy.

11. Contact

Aesthetic Ag Ltd
113 Union Street, Oldham, United Kingdom, OL1 1RU
Email: help@case-work.app