Legal

Privacy Policy

Last updated: 27 September 2026

This Privacy Policy explains how Synara AI (Pty) Ltd (registration number 2025/921363/07), trading as Caseo ("Caseo", "we", "us", "our") collects, uses, shares and protects personal information when you visit caseo.co.za, join our waitlist, or use the Caseo legal practice platform (the "Service"). It is intended to comply with the Protection of Personal Information Act, 2013 (POPIA).

The short version. We collect what we need to run your firm's workspace and to keep paid traffic honest. We don't sell your data. We don't train third-party models on it. You can email privacy@caseo.co.za any time to access, correct or delete your information.

1. Who is responsible

Synara AI (Pty) Ltd, trading as Caseo, is the responsible party for personal information you provide directly to us (e.g. when you join the waitlist, register an account, or contact us). Where your firm uses Caseo to manage its clients' information, your firm is the responsible party and Caseo acts as an operator under POPIA.

Information Officer: Nakai Farid Williams — privacy@caseo.co.za (Information Regulator registration 2026-067492).

2. What personal information we collect

From visitors and waitlist sign-ups (caseo.co.za):

  • Email address (required to join the waitlist or open an account)
  • Optional firm details: firm name, firm size, current software in use, your role at the firm — only if you choose to enter them
  • When you ask us to call you: your name, phone number, firm name, firm size, current software and when you are looking to switch
  • With a callback request, where you arrived from: the first page you opened on caseo.co.za, the campaign tags in that link (source, medium, campaign and content), whether the link carried a Facebook click ID (yes or no, not the ID itself) and the name of the website that sent you (for example instagram.com, not the page). Your browser keeps this for the visit and sends it only with the form; if you never send the form, we never receive it
  • Technical data: IP address, browser user-agent, device type, referring URL, and basic interaction events (page views, button clicks)
  • Meta advertising identifiers (where applicable): the Meta browser cookie (_fbp) and click ID (_fbc), plus a server-side event ID we generate to deduplicate Meta Conversions API (CAPI) signals
  • Google Ads identifiers (where applicable): the Google click ID and Google's advertising cookies, used to attribute a callback request to the ad that led to it

From firm users of the Caseo platform:

  • Account information: name, email, phone number, role, firm membership
  • Authentication metadata via Clerk (our identity provider): sign-in times, devices, IP addresses
  • Firm content you choose to upload: matter records, client information, transactions, diary entries, FICA records, documents

3. Why we collect it

  • To run the Service — provision accounts, deliver features, process firm data
  • To send the welcome email and (later) onboarding emails when you join the waitlist
  • To measure, attribute and improve our marketing — including paid campaigns on Meta (Facebook and Instagram) and Google. See section 7 for how we handle ad attribution.
  • To keep the Service secure: detect abuse, prevent fraud, respond to incidents
  • To comply with our legal obligations (tax, FICA, court orders, valid regulatory requests)
  • To communicate with you about service updates, security notices, and (if you opt in) product news

4. Lawful basis under POPIA

We process personal information based on (a) your consent (for marketing and optional fields), (b) the necessity of processing to perform a contract with you or your firm, (c) compliance with our legal obligations, and (d) our legitimate interests in operating and improving a secure service. You can withdraw consent at any time without affecting prior lawful processing.

5. Sub-processors

We use the following service providers to operate Caseo. Each is contractually bound to confidentiality and to processing personal information only on our instructions:

  • Convex — Application database and backend (matters, clients, trust records, documents) (United States)
  • Vercel — Serves the web app (no client records stored) (Global edge)
  • Clerk — Sign-in and identity for firm staff (United States)
  • Resend — Transactional email (United States / EU)
  • PostHog — Product analytics (no client records) (United States)
  • Meta — Ad attribution on caseo.co.za marketing pages only, after you accept cookies; never inside the app (United States)
  • Google — Google Ads conversion tag on caseo.co.za marketing pages only, after you accept cookies; never inside the app (United States)

Where a provider is outside South Africa, we rely on POPIA section 72 through data processing agreements with each provider.

More on how Caseo handles client data is on our Trust & compliance page.

6. Cookies and tracking

We use cookies and similar technologies for: (a) keeping you signed in, (b) measuring product usage with PostHog so we can improve features, and (c) measuring advertising performance with the Meta Pixel and the Google Ads tag. You can disable non-essential cookies via your browser settings; doing so will not break Caseo's core functionality.

On caseo.co.za's public pages a cookie notice asks for your choice. The Meta Pixel and the Google Ads tag load only after you choose Accept. If you choose Decline, they stay off and PostHog stops collecting analytics from your browser. Neither the Meta Pixel nor the Google Ads tag ever loads inside the Caseo app. We remember your choice in your browser's local storage. .

7. Advertising: Meta and Google

If you accept cookies on caseo.co.za, the Meta Pixel loads in your browser and may set or read advertising cookies (_fbp, _fbc), and the Google Ads tag loads and may set or read Google's advertising cookies. If you have accepted cookies and then submit the callback form, we report the request to Google Ads as a conversion and additionally send a server-side "Lead" event to Meta's Conversions API including a hashed version of your email address and your IP / user-agent, so Meta can attribute the conversion to its campaign. The hash is deterministic but one-way (SHA-256). We use these signals only to measure and optimise campaigns — never to target advertising back at you off-platform.

If you do not want this attribution, you can (a) choose Decline in the cookie notice, (b) install a browser-level tracker blocker, or (c) email us and ask for any matched signal to be invalidated.

8. Sharing personal information

We do not sell personal information, and we do not share it with third parties for their own marketing. We share information only:

  • With sub-processors listed above, to operate the Service;
  • With your express instruction (e.g. exporting your firm's data to another system);
  • When required by law, court order, or a valid regulatory request;
  • In the context of a corporate transaction (merger, acquisition, financing) where the receiving party is bound by equivalent obligations.

9. Retention

We keep personal information only for as long as we need it for the purposes set out above, or longer where the law requires. Specifically:

  • Waitlist email addresses: kept for the lifetime of the waitlist; you may unsubscribe at any time, after which we delete the row within 30 days.
  • Firm content (matters, clients, transactions): retained for the duration of your subscription, then returned or deleted from active systems within 30 days of termination (records the law requires to be kept are handed over to the firm).
  • Encrypted backups may persist for a further 30 days before being overwritten.
  • Records that we are legally obliged to keep (e.g. for tax or FICA purposes) are retained for the statutory minimum period.

10. Security

We implement reasonable and appropriate technical and organisational safeguards: TLS encryption in transit, encryption at rest by our infrastructure providers, role-based access controls, audit logging, and least-privilege access for Caseo personnel. No system is completely secure — we will notify affected users and the Information Regulator promptly in the event of a security compromise that affects personal information, as required by section 22 of POPIA.

11. Your rights

Under POPIA, you have the right to:

  • Confirmation of whether we hold personal information about you;
  • Access to that information and a record of who has had access;
  • Correction or deletion of inaccurate, irrelevant or excessive information;
  • Object to processing on reasonable grounds, including processing for direct marketing;
  • Withdraw consent where processing is based on consent;
  • Lodge a complaint with the Information Regulator (South Africa) at inforegulator.org.za.

To exercise any of these rights, email our Information Officer at privacy@caseo.co.za. We respond within 30 days.

12. Children

Caseo is not intended for use by anyone under 18. We do not knowingly collect personal information from children. If you believe we have done so inadvertently, contact us and we will delete it.

13. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top reflects the most recent version. Material changes will be emailed to account holders at least 14 days before they take effect.

14. Contact

Synara AI (Pty) Ltd, trading as Caseo
Registration number 2025/921363/07
Information Officer: Nakai Farid Williams
privacy@caseo.co.za