Privacy Policy

1. Who we are and how to contact us

CaseClock is operated by Craimor Products (trading as CaseClock). Our Data Protection Lead can be contacted at support@vigildocs.co.uk. We are the controller for account administration, security and deletion requests. Housing providers and landlords normally act as controllers for tenant and inspection records; we process those records on their instructions. Contact your housing provider for decisions about your housing case.

2. Information we collect

• Accounts: name, work email, authentication credentials managed by our authentication provider, organisation name, workspace membership, role and sign-in/session information. We do not receive your Google password.
• Housing cases: property addresses, case references, tenant contact details when entered, reported hazards, awareness timestamps, deadlines, investigation findings, remedial actions and correspondence.
• Inspection evidence: surveyor, contractor and tenant photographs, certificates, moisture readings, temperature, relative humidity, room/location labels, visit identifiers, surveyor notes and timestamps. Images or documents can incidentally identify people or contain sensitive information.
• Vulnerability: high-level vulnerability categories and flags, not detailed medical histories. Please do not include unnecessary health information in free text or images.
• Security and operations: IP address and technical request information processed by hosting providers, browser/device details, error diagnostics, audit events and account deletion requests.

3. Permissions and device access

Camera and photo selection: used only when you choose to capture or upload property evidence or a meter-screen image. CaseClock does not access the camera in the background. You can deny or revoke permission in your device settings and use manual readings instead. Images are uploaded when you save or submit them; selected meter-screen images are sent for reading extraction when you request it.

Bluetooth: compatible meter access is initiated by you and subject to your browser/device permission. Location: any coordinates you explicitly supply or authorise are used only as evidence context; CaseClock does not continuously track your location. Permission settings can vary in the packaged Android app.

4. Why we use information and our lawful bases

• Provide accounts, private workspaces and requested services: performance of our contract with users and customer organisations.
• Protect accounts, diagnose failures and maintain reliable evidence records: legitimate interests in a secure, auditable service, balanced against individual rights.
• Handle rights requests and comply with applicable law: legal obligation.
• Housing controllers determine their lawful basis for statutory housing compliance and tenant records, including legal obligation or public task where applicable. Any special-category health information requires a separate valid UK GDPR Article 9 condition established by the controller.

Device permission is not by itself a lawful basis for all subsequent processing. We do not use your evidence for advertising. We do not sell personal data.

5. AI-assisted meter reading

When you request meter-screen extraction, the selected image is processed through Lovable's AI gateway and its model provider to suggest a reading. Include only the meter screen, not people or unrelated documents. A human must review the suggestion before it is saved. AI does not calculate statutory deadlines, classify cases without human sign-off, or make legally significant decisions about individuals.

6. Storage, encryption and sharing

Account and evidence data is hosted in Lovable Cloud using managed database, authentication and private object storage services. Data is encrypted in transit using HTTPS/TLS and at rest by the managed storage infrastructure; this is not end-to-end encryption. Workspace access controls restrict ordinary users to their organisation. Authorised service operations may access data to provide support, maintain security or fulfil deletion requests.

Data is shared with hosting/authentication/storage providers and, only for requested meter extraction, AI processing providers. Your organisation may share evidence with its team, contractors, landlords, tenants, regulators or courts. External portal links grant access to limited information for one case: anyone holding a link may use it, so treat it as confidential. Exporting, emailing or sharing a report transfers it outside CaseClock's access controls. We may disclose data where legally required.

7. International transfers

Hosting, support or AI processing may involve processing outside the UK. Where a restricted international transfer occurs, the responsible controller must ensure an applicable adequacy decision or appropriate safeguards such as the UK International Data Transfer Agreement or UK Addendum to standard contractual clauses, with relevant risk assessments. Contact our Data Protection Lead for the current processors, processing locations and safeguards applicable to your service.

8. Retention and deletion

Account data is kept while the account is active. Housing case evidence is retained according to the customer organisation's documented statutory, complaint and legal-claims needs; there is no single automatic retention period for all housing cases. Deletion requests are handled by the Data Protection Lead within 7 days, with identity verified through confirmation from the registered account email address.

Direct deletion removes your account, your private workspaces and their cases, readings, photographs, reports and chronology from active systems. It is blocked when your owned workspace has other team members, so ownership and records can be reviewed safely. Shared housing records controlled by another organisation are not automatically erased when a team member leaves. Limited records may be retained where required by law or for legal claims; we will explain any exception. Isolated provider backups may retain residual data until their normal rotation and are not used for ordinary access. Copies already exported or received by third parties cannot be withdrawn by CaseClock.

Use our public Account & Data Deletion Request page, or email the Data Protection Lead. Deletion request records are used only to verify and fulfil your request; completed direct-deletion records are stripped of the account email and user identifier.

9. Your UK GDPR rights

You may request access, correction, erasure, restriction, portability where applicable, or object to processing based on legitimate interests or public task. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing. Rights can be limited by statutory duties or others' rights. Send requests to support@vigildocs.co.uk; for tenant case records we may refer you to your landlord/controller. General rights requests are normally answered within one month under UK GDPR. Our account deletion service targets seven days.

You may complain to the UK Information Commissioner's Office at ico.org.uk or call 0303 123 1113.

10. Cookies, local storage and children

CaseClock uses essential authentication/session storage and app resources needed to keep you signed in and provide the service. The app service worker does not intentionally cache private API responses or evidence files. We do not use case data for advertising or cross-app tracking. CaseClock is a professional housing tool, not intended for children to create accounts. Housing records may relate to children only where the housing controller has an appropriate lawful basis.

11. Updates

We will update this policy when our processing changes and revise the effective date. Material changes will be communicated where required. For a copy, clarification or processor details, contact support@vigildocs.co.uk.