Privacy Policy

1. Who is responsible

Elaco Consulting AB (organisation number 559283-7156), Sweden, is the controller for the processing described in this policy.

Questions or requests: privacy@thecaseisyours.com

2. Submitting an accusation (Case Desk)

When you submit an accusation we process the suspect name and page number you enter, the book edition, and your email address.

We use your email address only to send you the verdict. It is not stored in our case database: the submission record (suspect name, page, edition, result and delivery status) is kept without it.

Legal basis: to provide the service you ask for (Article 6(1)(b) GDPR). You do not have to subscribe to anything to receive your verdict.

3. Case Dispatch (our newsletter)

If you tick the Case Dispatch box — on Case Desk or on our homepage — we store your email address, your language, which version of the consent text you agreed to, and when you subscribed, confirmed or withdrew.

We first send you a confirmation email. You are only added once you confirm, and the link expires after 36 hours.

Legal basis: your consent (Article 6(1)(a) GDPR). You can withdraw at any time via the unsubscribe link in every email or by contacting us. We keep a record of consent events so we can show that consent was given.

4. Security and abuse prevention

To protect Case Desk against automated abuse we use Cloudflare Turnstile, which evaluates technical signals from your browser, and we limit how many requests can be made.

For those limits we store only one-way cryptographic hashes of IP addresses and email addresses — never the addresses themselves — and delete them automatically shortly after the one-hour limit period ends.

Legal basis: our legitimate interest in keeping the service secure and preventing misuse (Article 6(1)(f) GDPR).

5. Analytics

We measure how the website is used with cookie-free analytics (Vercel Web Analytics). It uses no cookies, and we never send your email address or your verdict to it.

Legal basis: our legitimate interest in understanding and improving the website (Article 6(1)(f) GDPR).

6. Hosting, logs and cookies

The website is hosted by Vercel. When you visit, technical data such as your IP address and browser information is processed to deliver the pages and may appear briefly in server logs.

Fonts are served from our own website; your browser does not contact Google. We do not use cookies for analytics or advertising.

7. Who processes data on our behalf

• Vercel Inc. — website hosting and analytics
• Supabase Inc. — database, hosted in the EU (Stockholm, Sweden — eu-north-1)
• Sendinblue SAS (Brevo), France — sending verdict and Case Dispatch emails
• Cloudflare, Inc. — DNS, security and Turnstile

We have data processing agreements with each of them. Where a provider may process data outside the EU/EEA, the transfer is protected by [the EU–US Data Privacy Framework and/or Standard Contractual Clauses — CONFIRM per provider].

8. How long we keep data

• Case Desk submissions (without email address): 24 months
• The email address used to send a verdict: not stored in our database; our email provider keeps delivery logs for [BREVO LOG RETENTION — CONFIRM]
• Case Dispatch subscriptions: until you withdraw consent; sign-ups that are never confirmed are deleted after 30 days
• Consent records: for as long as the subscription exists, plus 3 years
• Rate-limit hashes: deleted automatically shortly after 1 hour

9. Your rights

You have the right to access your personal data, to have it corrected or erased, to restrict or object to processing, to data portability, and to withdraw your consent at any time. You can always object to direct marketing.

Contact us at privacy@thecaseisyours.com. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY), imy.se.

10. Changes

If we change this policy we update the date at the top. If a change affects your Case Dispatch consent, we will ask for your consent again.