Privacy Notice

1. About this notice

This notice explains what CaseDaleel collects when you use casedaleel.com, why we collect it, who it reaches, how long we keep it, and what you can require us to do about it. It is written to align with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the UAE PDPL) and its implementing regulations.

It is written to be read by people who are not lawyers. Where a term has a specific legal meaning we explain it in place rather than in a glossary at the end.

This notice covers casedaleel.com and the account area. It does not cover what an independent legal professional does with your information after you instruct us to send them your case — at that point they become responsible for it under their own privacy terms, which you should ask them for.

2. Who is responsible for your data

Fields shown as [to be confirmed] are not yet published here. We would rather leave them blank than publish a registration detail we have not verified against the trade licence. Ask contact@casedaleel.com if you need them before they appear.

We are the controller of the personal data described in this notice — meaning we decide what is collected and why. The service providers listed in section 7 are processors: they handle data only on our instructions and only to provide the service we buy from them.

Because this platform applies automated processing to case information that is often sensitive, we treat it as processing that calls for a Data Protection Officer and a Data Protection Impact Assessment under the PDPL, rather than waiting to be told. Data protection questions go to contact@casedaleel.com.

3. What personal data we collect

We collect only what the service needs to work. We do not buy personal data from anyone, and we do not build profiles of you from outside sources.

• What you write into the case Navigator — your description of the situation, and your answers to its follow-up questions.
• Case file details — the title, reference, matter type, emirate and language of each case, its status, and the running record of messages and facts attached to it.
• Documents you choose to upload — contracts, notices, statements, correspondence and similar files, together with the file name, type and size.
• Account details — your name (if you give one), your email address, and your password, which is stored only as a hash and never in readable form.
• Tool inputs — figures you enter into the free calculators, such as salary amounts, dates of service and emirate.
• Sign-in and security data — the time you signed in, a truncated record of the browser you used, and the IP address the request came from, kept against the session so you can end it and so we can detect attacks on your account.
• Messages you send us — when you write to us, by email or through a form on the site: your name, your email address, what you wrote, and when. We keep it as correspondence, so that we can answer you and so there is a record of what was asked and what we said.
• Purchase records — that you bought a case pack, when, and for how much.
• Server logs — standard web-server records of requests, generated automatically by our hosting provider.
• Optional analytics — coarse page and feature counts, only if analytics is enabled and you have allowed it. See section 11.

We never see your card details. Payments are taken by a third-party payment provider on its own pages. Card numbers do not reach our servers.

4. The sensitive information inside a legal problem

This deserves its own section, because it is the most important thing in this notice.

A description of a legal problem is rarely neutral. To explain an unpaid salary case you may have to describe your immigration status, your employer, your bank balance and your family's dependence on that money. To explain a tenancy case you may have to give your home address. To explain a family matter you may have to describe your marriage, your children or your health. A document you upload may contain your Emirates ID number, your passport number or your salary.

Some of this is sensitive personal data under the PDPL — for example information revealing health, family life, religious or political belief, or criminal allegations — and some of it, such as an Emirates ID or passport number, identifies you directly.

We handle it accordingly:

• We ask you to write only what is relevant to the matter you are preparing. Please do not upload documents, or paste information, that the matter does not need — particularly other people's documents, medical records that are not in issue, or anything a third party gave you in confidence.
• We do not use case content for marketing, for building audiences, or for any purpose other than those in section 5.
• Where the PDPL requires your explicit consent for sensitive data, that is the basis we rely on: by choosing to describe your matter to the Navigator and to keep it in a case file, you are explicitly consenting to us processing that content for the purposes in section 5. You can withdraw that consent by deleting the case or your account, or by emailing contact@casedaleel.com.

5. Why we process it, and on what basis

The PDPL requires a lawful basis for each purpose. Ours are:

We do not use your personal data for any purpose incompatible with these. If that ever changes we will tell you before it does, and where the new purpose needs your consent we will ask for it separately.

6. The Navigator, AI, and automated processing

The Navigator reads what you write and produces a structured assessment: the likely matter type, the issues it can identify, the evidence usually needed, a likely official route, and whether the matter looks like one that needs a licensed professional.

Your case text is sent to a third-party AI provider. We do not run our own AI model. When you send a message to the Navigator, that message, the earlier messages in the same case, and our instructions to the model are transmitted to Anthropic PBC (the provider of the Claude models), which processes them on servers outside the UAE and returns the reply. In practical terms:

• Anthropic acts as our processor for this. It may use the content only to generate the reply and to run its own safety and abuse checks.
• Under the commercial terms we use, your content is not used to train AI models.
• Anthropic retains a copy for a limited period for safety and abuse monitoring, after which it is deleted from its systems. Deleting a case here removes it from our database; it does not, by itself, reach into that provider's retention window.
• Your documents are not sent to the AI provider unless a feature explicitly says so at the time.

If you would rather no AI provider saw your situation, do not use the Navigator. The guides, the FAQ and the free calculators work without it, and nothing you type into a calculator is sent to an AI provider.

What the automated processing does and does not decide.

The assessment is not a decision made about you. Nothing is approved, refused, priced or ranked on the basis of it. It does not determine your legal rights or obligations, it does not affect what you are charged, and no third party acts on it unless you choose to send it to them. It is information to help you decide what to do next.

Because the PDPL gives you rights in relation to automated processing, here is how they apply:

• Meaningful information about the logic. The model receives your description, the earlier messages in that case, and a fixed set of instructions requiring it to give general information rather than advice on your facts, to avoid stating article numbers, fees or deadlines it is not certain of, to say plainly when a route is free and can be taken without a lawyer, and to flag urgency early where a matter is time-sensitive. It then classifies the matter, extracts the issues and the evidence usually needed, and drafts the reply in the language you wrote in.
• Human review. You may ask a person to review any assessment. Email contact@casedaleel.com with the case reference.
• Objection. You may object to the automated processing and keep using the rest of the platform.
• Accuracy. The assessment can be wrong, incomplete or out of date. It is not advice from a licensed advocate or legal consultant, and anything procedural should be confirmed with the relevant authority.

7. Who your information is shared with

No legal professional receives your case unless you approve that specific handoff. See section 8.

We do not sell personal data, we do not share it for anyone else's marketing, and we do not broadcast your case to a panel of lawyers.

Beyond that, your data reaches only the service providers we need to run the platform. Each is bound by contract to use it only to provide that service to us:

We may also disclose personal data where UAE law requires it — for example a lawful order from a court, regulator or competent authority — or where it is necessary to establish, exercise or defend a legal claim. Where we are permitted to tell you that we have done so, we will.

If the business is ever sold or reorganised, personal data may transfer to the acquirer, which would remain bound by this notice until it lawfully gives you a new one.

8. Sending your case to a lawyer — only when you say so

CaseDaleel is an introduction and case-preparation service. Introducing you to a legal professional is the point of the product, and it is also the moment your information leaves our control, so it works on an explicit instruction from you and nothing else:

• You are shown what would be sent — which parts of the case file and which documents — before anything is sent.
• You approve that specific handoff, to that specific professional. Approving one handoff does not authorise another.
• We record that you approved it, when, and from which IP address, so that both you and the professional have a reliable record of the scope of what was shared.
• You can decline, and you can stop at any point before you approve.

Once a professional receives your case, they hold it as an independent controller under their own obligations and their own privacy terms. Withdrawing consent afterwards stops any further sharing by us, but it cannot unsend what was already sent — ask the professional directly to delete it.

9. Transfers outside the UAE

Several of the providers in section 7 operate outside the UAE, so some of your personal data — including case content — is processed abroad.

The UAE Data Office has not published a list of jurisdictions it deems adequate, so we do not rely on an adequacy decision. We rely on the other transfer conditions the PDPL permits:

• Contractual safeguards with each provider, requiring it to protect the data to a standard consistent with the PDPL, to process it only on our instructions, to keep it secure, and to delete or return it when the service ends.
• Necessity for the performance of our contract with you — we cannot generate a Navigator reply, or host the platform at all, without transferring the data needed to do it.
• Your explicit consent, where neither of the above covers a transfer. In that case we ask you, and tell you the risk, before it happens.

You can ask contact@casedaleel.com which providers currently hold your data and on what transfer basis, and we will tell you.

10. How long we keep it

You can ask us to delete case content sooner at any time, and you do not have to give a reason. Where we must keep something — an accounting record, or a record that you consented to a handoff — we keep only that record and not the underlying case content.

11. Cookies and local storage

This is the complete list. There is nothing else.

The session cookie is strictly necessary — the account area cannot work without it — so it is set when you sign in without a consent banner. The analytics choice is stored in your own browser and is never sent to us.

If analytics is enabled and you allow it, the analytics provider's own script loads and may set its own cookies; declining means that script is never loaded at all. We also honour your browser's "Do Not Track" setting: if it is on, analytics does not run and you are not asked.

We set no advertising, marketing, profiling or cross-site tracking cookies, and there are no third-party advertising pixels on this site.

12. Your rights, and how to use them

Under the PDPL you have the right to:

• Be informed — to know how your data is used, which is what this notice is for.
• Access — to get confirmation that we hold data about you and a copy of it, along with the purposes, recipients and retention periods.
• Correct — to have inaccurate or incomplete data put right. You can edit most of it yourself in your account.
• Erase — to have your data deleted. You can delete a case, or your whole account, yourself. We must keep only what the law requires us to keep.
• Restrict processing — to have us pause processing, for example while we check a correction you have asked for.
• Portability — to receive the data you gave us in a structured, commonly used, machine-readable format, or to have it sent to another controller where that is technically feasible.
• Object — to object to processing based on our legitimate interests, and to object to the automated processing described in section 6.
• Withdraw consent — at any time, and as easily as you gave it. Withdrawal applies going forward; it does not make earlier processing unlawful and it cannot unsend a handoff you already approved.
• Complain — see section 18.

How to exercise them.

1. In the product, for the quickest route: sign in, delete a case, sign out of every device, or delete your account.
2. By email, for anything else: write to contact@casedaleel.com from the address on your account, say which right you are using, and give your case reference if the request concerns one case.

We answer within 30 days of receiving your request. If the request is complex or you have made several, we may need longer — if so we will tell you within those 30 days, explain why, and take no more than a further 30 days.

We may need to check that the request really comes from you. We will ask for the minimum needed to do that, and we will not use anything you send for identification for any other purpose.

Exercising these rights is free, and we will not restrict, degrade or price your use of the platform differently because you did. If a request is manifestly excessive or repetitive we may explain why we are refusing it rather than charge you, and you can complain about that refusal.

13. Consent, and taking it back

Where we rely on consent — the sensitive detail inside a case, each handoff to a professional, and optional analytics — that consent is asked for separately, in plain language, for that specific purpose, and through a clear affirmative action. Nothing is pre-ticked, consent is never bundled into acceptance of the Terms, and refusing does not stop you using the rest of the platform.

You can withdraw consent at any time: delete the case, decline in the analytics banner or clear the stored choice, or email contact@casedaleel.com.

14. Security — what we actually do

These are the measures that are in place, described honestly. We would rather state the limits than imply protections we have not built.

• Passwords are never stored. Each password is put through scrypt with a random 16-byte salt unique to you, and only the result is stored. Comparisons are constant-time. We cannot read your password, recover it, or tell you what it is.
• Session tokens are stored only as a hash. Your sign-in token is 32 random bytes. Only its SHA-256 hash is stored, so a copy of our database contains nothing that could be replayed to sign in as you.
• Email verification and password-reset links work the same way — hashed, single-use, and short-lived.
• Your cases are scoped to you. Every database query for case data is filtered by your user ID, so one account cannot reach another's case by guessing an identifier.
• Account lockout. Repeated failed sign-ins lock the account temporarily, which blunts password-guessing attacks.
• No account enumeration. Sign-in, sign-up and password-reset return the same generic response whether or not an address is registered, so the site cannot be used to find out who has an account.
• Cross-origin protection and rate limiting. Requests that change data are rejected if they come from another site, and request rates are capped.
• Encryption in transit. The site is served over HTTPS, and traffic to our providers is encrypted.
• The session cookie is HttpOnly, so a script injected into the page cannot steal it.

The limits, stated plainly: your case content is stored in our database in a form our systems can read. It is protected by our hosting provider's storage encryption and by access controls, but it is not encrypted with a key that only you hold, and it is not end-to-end encrypted. A person with legitimate administrative access to our infrastructure could in principle read it. We keep that group as small as possible and limit access to what is needed to operate and support the service. No system is perfectly secure, and we do not claim otherwise.

15. If something goes wrong

If a personal data breach occurs, we will:

• Notify the UAE Data Office immediately upon becoming aware of it, where the breach would prejudice the privacy, confidentiality or security of your data, and in any event without undue delay.
• Notify you directly, without undue delay, where the breach is likely to result in a risk to your privacy, confidentiality or security.
• Tell you what happened, what categories of data were involved, roughly how many people were affected, the likely consequences, what we are doing about it, what you can do to protect yourself, and how to reach us about it.
• Keep an internal record of the breach and of what we did, whether or not it was notifiable.

16. Children

The platform is for adults. It is not directed at children, and we do not knowingly collect personal data from anyone under 18. If you believe a child has created an account or sent us personal data, email contact@casedaleel.com and we will delete it.

A legal matter may of course concern a child — a custody or schooling dispute, for example. Information about a child that you provide as their parent or guardian is processed on the same basis as the rest of the case, and we ask you to include only what the matter requires.

17. Changes to this notice

If this notice changes we update the "last updated" date at the top. Where a change materially affects how your case data is handled, we tell you in the product, and by email where we have your address, before it takes effect. Where the change needs your consent, we ask for it rather than assume it.

18. Complaints

If you are unhappy with how we have handled your data or your request, tell us first at contact@casedaleel.com — we would rather fix it. Say what went wrong and what you want us to do, and we will respond within 30 days.

If you are not satisfied with our answer, you have the right to complain to the UAE Data Office, the federal regulator for personal data protection, using the complaint route it publishes. Complaining to us first is not a precondition, and complaining to the Data Office does not affect any other legal remedy you have.