Privacy Policy

• Account info — email, name (if provided), MBA program (inferred from email domain), and authentication metadata.
• Session content— case books you upload as a coach, candidates' names and emails you enter for a session, the notes and stopwatch values you record, and the ranking/scorecard generated at the end.
• Operational data — server logs, error reports, and basic usage analytics necessary to run the service.
• We do not store passwords (we use magic-link authentication), credit card numbers (handled by our payment processor if you subscribe), or precise location data.

• To operate the cockpit, scorecards, and case-book pipeline.
• To link sessions across accounts — if a guest candidate (entered by email) later signs up with the same email, their past sessions automatically appear in their history.
• To prevent abuse and respond to security incidents.
• To improve the product based on aggregate, de-identified usage patterns.
• We don't sell personal data, share it with advertisers, or train models on customer content.

• Coach & candidate — both can see the session they participated in. Coaches see candidates they ran a session with. Candidates see their own scorecards.
• Other coaches — never. Sessions are scoped to their participants.
• CaseVault administrators — limited employees who need access to operate, debug, or comply with legal obligations.
• Service providers we depend on: [Supabase](database & auth), [Vercel] (hosting),[Anthropic] (case-book segmentation during the digitization pipeline). Each is bound by their own data-processing agreement.

• Access — see everything in your account by signing in.
• Correction — fix profile fields from Account settings.
• Deletion — delete your account from Account > Danger zone. Sessions where you were the candidate keep the coach's record (the coach owns it), but the link to your account is severed and your name/email are stored only as the coach originally entered them.
• Portability — request a JSON export of your data by emailing [SUPPORT_EMAIL].
• If you're in a jurisdiction with additional rights (EU/UK GDPR, California CPRA, etc.), those rights apply.

We keep account and session data while your account is active. On account deletion we remove your profile and authentication credentials immediately and purge backups on our standard rolling window (currently 30 days). Operational logs are retained for [LOG_RETENTION_DAYS] days and then deleted.

All data is transmitted over TLS and stored encrypted at rest on our managed database. Access to production systems is restricted to authorized personnel with multi-factor authentication. No system is perfectly secure — if we discover a breach affecting your data we'll notify you within [NOTIFY_HOURS] hours.

CaseVault is intended for users 16 and older. We don't knowingly collect personal information from anyone younger.

Your data may be processed in countries other than your own — primarily the United States, where our hosting and database providers operate. We rely on standard contractual safeguards with those providers.

We may update this policy. Material changes will be announced via email or an in-app notice at least [NOTICE_DAYS] days in advance.

Privacy questions? Email [SUPPORT_EMAIL]with “Privacy” in the subject line.