Privacy Policy
How Casentra collects, uses, discloses and protects personal data. Read together with the Terms of Service.
1. Scope and Our Role
This Privacy Policy explains how Casentra collects, uses, discloses and protects personal data in connection with the Casentra platform, applications, websites and related services (the "Service"). This Policy should be read together with the Terms of Service.
Casentra acts in two capacities:
(a) Casentra is a data user/controller for personal data relating to Users and their use of the Service, including account information, subscription information and usage data.
(b) Casentra acts as a data processor for personal data relating to a User's clients, prospects or other third parties submitted through the Service ("Client Data"). For Client Data, the User remains responsible for lawful collection, notices, consents, permissions and regulatory compliance. Casentra processes Client Data only on documented instructions and as described in the applicable Data Processing Addendum.
2. Personal Data We Collect
We may collect:
(a) Account and professional information, including name, email, phone number, licence or registration information, organisation, role and verification information.
(b) Payment and subscription information processed through payment providers.
(c) Content and Client Data submitted through the Service, including documents, files, notes, communications, recordings, prompts and other information provided by Users.
(d) Usage and technical information, including logs, feature usage, device information, browser information and security information.
(e) Communications with Casentra, including support requests.
3. How We Use Personal Data
We use personal data to:
- provide, operate, maintain and secure the Service;
- authenticate Users and manage accounts;
- process Client Data according to User instructions to provide Service functionality;
- generate AI-assisted summaries, drafts, suggestions and other Outputs requested by Users;
- process payments and subscriptions;
- communicate service, security and administrative notices;
- detect fraud, abuse and unauthorised access;
- maintain, analyse and improve the Service using appropriate aggregated, anonymised or de-identified information where permitted by law; and
- comply with legal, regulatory and record-keeping obligations.
4. AI Processing and Model Usage
The Service uses artificial intelligence technologies, including third-party AI providers, to process inputs and generate Outputs.
Inputs may be transmitted to relevant AI providers only to the extent technically necessary to provide requested functionality.
Casentra does not use Client Data, prompts, uploaded files or Customer-specific content submitted through the Service to train or fine-tune general-purpose AI models for unrelated customers.
Casentra requires AI providers used in connection with the Service to apply contractual restrictions regarding the use of Customer Data submitted through the Service for model training purposes.
Casentra may use aggregated, anonymised or de-identified information that does not reasonably identify any User, client or individual for purposes including analytics, security, reliability and improvement of the Service, where permitted by Applicable Laws.
5. PDPO Compliance and Customer Responsibilities
Casentra processes personal data in accordance with applicable privacy laws, including the Personal Data (Privacy) Ordinance (Hong Kong).
For Client Data, Users are responsible for ensuring that they have a lawful basis, provide required notices and obtain necessary consents or authorisations before submitting such data through the Service.
6. Disclosure and Service Providers
Casentra does not sell personal data.
We may disclose personal data to service providers and sub-processors that process data on our behalf under appropriate confidentiality, security and data protection obligations, including:
- cloud infrastructure providers;
- artificial intelligence providers;
- storage providers;
- payment processors; and
- other technology providers necessary to provide, maintain and secure the Service.
A current list of material sub-processors may be maintained and updated from time to time.
We may also disclose information where required by law, regulation, court order or competent authority, or in connection with corporate transactions.
7. Data Location and International Transfers
Casentra may process and store personal data in Hong Kong and other jurisdictions where Casentra, its affiliates, cloud infrastructure providers, artificial intelligence providers or other service providers operate.
Certain Service features, including AI-powered functionality, may require personal data to be processed by third-party technology providers located outside Hong Kong.
Where personal data is transferred across jurisdictions, Casentra will implement reasonable contractual, technical and organisational safeguards appropriate to the nature of the processing and applicable legal requirements.
The location of infrastructure, models and service providers may change from time to time as Casentra develops and operates the Service.
8. Data Retention
Casentra retains personal data only for as long as reasonably necessary for the purposes described in this Policy, the Terms of Service, applicable agreements and legal obligations.
Retention periods may vary depending on the nature of the data, Service configuration, Customer requirements and applicable laws.
9. Security
Casentra implements reasonable technical and organisational measures designed to protect personal data, taking into account the nature of the data processed and risks associated with the Service.
Such measures may include access controls, authentication mechanisms, encryption safeguards, monitoring and other security practices appropriate to the circumstances.
No electronic transmission or storage method can be guaranteed to be completely secure.
10. Data Rights
Individuals may request access to or correction of their personal data in accordance with applicable law.
Requests relating to Client Data should generally be directed to the relevant User or organisation responsible for that data. Casentra will assist Users as appropriate where acting as a processor.
11. Direct Marketing
Casentra does not use Client Data for Casentra direct marketing.
Where Casentra conducts direct marketing using personal data relating to Users, it will comply with applicable legal requirements and provide appropriate opt-out mechanisms.
12. Cookies and Analytics
Casentra may use cookies and similar technologies to operate the Service, maintain security, remember preferences and understand usage patterns.
13. Children
The Service is intended for professional users and is not directed to children under 18.
14. Contact
Casentra Limited
Office 5, 8/F, Mega Cube
8 Wang Kwong Road
Kowloon Bay, Kowloon, Hong Kong
Privacy enquiries: [email protected]
15. Changes to this Policy
Casentra may update this Privacy Policy from time to time. Material changes will be notified through the Service or by email where appropriate.