Legal

Privacy policy

Effective June 29, 2026

This Privacy Policy explains how CaseCatalyst ("we," "us," "our") collects, uses, and shares information when you use casecatalyst.org or the CaseCatalyst work experience platform (the "Platform"). Read it with our Terms of Service and Cookie Policy.

By using the Platform, you confirm you have read this Policy.

1. Who we are

CaseCatalyst is operated by CaseCatalyst LLC, a Delaware limited liability company with offices at 37 Angel Ct, Stanford, CA 94305, United States.

For privacy questions and any request under this Policy: contact@casecatalyst.org.

2. What we collect

2.1 What you give us

Account: your name and email when you sign up.
Submissions: drafts, files, reflections, links, and final deliverables you upload to your Workspace.
Payments: Stripe processes your card details directly. We receive a transaction reference, the amount, the currency, and whether the payment succeeded or failed. We never see or store your card number.
Communications: anything you email or send us.

We do not currently collect a profile photo, school self-entry, field of study, year, city, or free-text bio. Your avatar is generated from your initials. If you are part of a school, your school is linked to your account by a school administrator, not entered by you.

2.2 What we collect automatically

Usage data: briefs and projects you open and Workspace events (drafts saved, milestones reached, submissions made).
Device and log data: standard server and security logs from our hosting and database providers (e.g. IP address, browser, timestamps).
Error reports: crash and performance data via Sentry, with your email, IP address, and cookies removed before the report is sent.
Cookies and local storage: see the Cookie Policy. We do not run product or marketing analytics at this time.

2.3 What we receive from third parties

Google Sign-In: if you sign in with Google, we receive your name, email, and Google account identifier (we do not store your Google profile photo). See Section 4.
Sponsor Companies: the brief they write, and the signatory name and title used on your certificate.
Schools: if your school enrolls you, we receive your name, email, and cohort/program details.

2.4 What we don't collect

We don't ask for government IDs (SSN, passport, driver's license number), biometric data, precise geolocation, or health data. Don't upload these in a submission unless a brief specifically requires it.

We also do not knowingly collect any "sensitive personal information" as defined by the California Consumer Privacy Act.

3. How we use it

We use your information to:

create your account and sign you in;
run the Platform — show briefs, host your Workspace, save drafts, accept submissions, generate certificates, and host your public verify URL;
process payments and refunds;
make your submitted work available to the Sponsor Company that wrote the brief, so they can review it and authorize the certificate they sign;
send transactional emails — deadline reminders, receipts, certificate delivery, security alerts, account notices;
detect and prevent fraud, abuse, and security incidents;
comply with law; and
fix bugs and improve the Platform using aggregated, de-identified data.

We do not sell your information. We do not share it for cross-context behavioral advertising. We do not use it for advertising, retargeting, marketing profiles, or to build inferences about you for marketing.

4. Google user data

If you sign in with Google, we use Google's OAuth 2.0 flow.

Scopes: openid, email, profile only.
What we receive: name, primary email, and Google account ID.
How we use it: to create or sign you into your CaseCatalyst account, show your name in your profile, and send transactional emails to your verified email.
What we don't do: we do not request access to Gmail, Drive, Calendar, Contacts, or any other Google service. We do not sell Google user data. We do not transfer it to third parties except as needed to provide user-facing features of the Platform, and never for ads. We do not use Google user data to train AI/ML models.
Revoking access: https://myaccount.google.com/permissions. Revoking access does not delete your CaseCatalyst account — see Section 11.

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

5. How we share information

5.1 With Sponsor Companies

When you submit work for a brief, we make your submission and name available to the company that wrote it so they can review it and authorize your certificate.

5.2 With Schools (school-enrolled users only)

If you're enrolled through a school agreement, your school can see which briefs you've unlocked, which projects you've submitted, and your certificates. Your draft contents are not shared with your school.

5.3 With service providers

Each processes information only on our instructions, under confidentiality and security obligations.

Provider	Purpose	Location
Vercel	Hosting and serverless infrastructure	United States
Supabase	Database and authentication	United States
Google LLC	Google Sign-In	United States
Stripe	Payments	United States
Sentry	Error and performance monitoring (email, IP, cookies stripped)	United States
Resend	Transactional email delivery	United States

A current list is available on request to contact@casecatalyst.org.

5.4 For legal reasons

We may disclose information when we believe in good faith it's required to comply with law, a court order, subpoena, or governmental request; to enforce our Terms; to protect the rights, property, or safety of CaseCatalyst, our users, or others; or in connection with an investigation of suspected fraud or wrongdoing.

5.5 In a business transfer

If CaseCatalyst is involved in a merger, acquisition, financing, reorganization, or sale of assets, your information may be transferred. We will notify you before your information becomes subject to a different privacy policy.

5.6 With your consent

For anything else, only with your explicit consent.

6. Public information

Certificates — each certificate has a public verify URL showing your name, the brief title, the Sponsor Company, and the submission date. It's meant for sharing with employers and schools. The page is not search-indexed. To request that a verify URL be taken down, email contact@casecatalyst.org.

7. International users

CaseCatalyst is operated from the United States. The Platform is intended for users in the United States and other countries except residents of the European Union, the European Economic Area, the United Kingdom, and Switzerland. We do not knowingly accept users from those jurisdictions, and this Policy is not designed to satisfy the EU/UK General Data Protection Regulation, the Swiss Federal Act on Data Protection, or related regulations. If you are a resident of any of those jurisdictions, please do not use the Platform.

If you are accessing the Platform from outside the United States (and outside the excluded jurisdictions above), you understand that your information will be transferred to, stored in, and processed in the United States, which may have data-protection laws different from those of your country.

8. Children's privacy

The Platform is intended for students aged 13 and older. We do not knowingly collect personal information from children under 13, in line with the U.S. Children's Online Privacy Protection Act ("COPPA").

If you are between 13 and 18 (or below the age of majority where you live), you confirm that a parent or legal guardian has reviewed this Policy and agreed to your use of the Platform.

If you are a parent or guardian and believe we have collected information from your child without proper consent, email contact@casecatalyst.org and we will delete it promptly. Under COPPA, parents and guardians have the right to review the personal information we have collected from their child, to direct us to delete it, and to refuse further collection — email contact@casecatalyst.org to exercise any of these rights.

9. How long we keep things

Category	Retention
Account profile (name, email)	While your account is active; removed within 30 days of a verified closure request
Submission drafts	While your account is active; removed within 30 days of a verified closure request
Submitted work and certificates	Retained so your verify URL stays live; you can request takedown (Section 11)
Payment records	7 years, as generally required by U.S. tax and accounting law
Email and transactional records	Up to 3 years
Support correspondence	Up to 3 years after last contact
Cookies and Sentry events	See Cookie Policy

After the applicable period, we delete or de-identify.

10. Your rights

10.1 Rights we extend to all users

Access — request a copy of the personal information we hold about you.
Correction — ask us to correct inaccurate or incomplete information.
Deletion — see Section 11.
Portability — request a copy of your information in a commonly used format.
Withdraw consent — at any time, where processing is based on consent.
Object or restrict — object to or restrict certain processing.
Non-discrimination — we will not deny service, charge a different price, or provide a different level of service because you exercised a privacy right.

Email contact@casecatalyst.org to exercise any right. We respond within 45 days and may need to verify your identity first.

10.2 California residents (CCPA / CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act:

Right to know — what categories of personal information we collect, the sources, the purposes, and the categories of third parties we disclose it to. This Policy provides that information.
Right to delete — subject to legal exceptions (such as the retention periods in Section 9).
Right to correct inaccurate personal information.
Right to limit use of sensitive personal information — we do not collect "sensitive personal information" as CCPA defines it, so this right has nothing to act on.
Right to opt out of sale or sharing — we do not sell personal information, and we do not share it for cross-context behavioral advertising. There is no sale or sharing for you to opt out of.
Right to non-discrimination for exercising any CCPA right.

Shine the Light (Cal. Civ. Code § 1798.83): we do not disclose your personal information to third parties for their own direct marketing purposes.

Authorized agents: California residents may use an authorized agent to submit a request on their behalf. We may ask the agent for written authorization and may ask you to verify your identity directly.

10.3 Residents of other U.S. states

Residents of states with comprehensive privacy laws — including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Tennessee, Indiana, Delaware, and others as their laws take effect — have substantially similar rights of access, correction, deletion, portability, and opt-out of targeted advertising or sale. To exercise these rights, email contact@casecatalyst.org.

10.4 Complaints

You may complain to the U.S. Federal Trade Commission at reportfraud.ftc.gov or to your state attorney general's office. California residents may complain to the California Privacy Protection Agency at cppa.ca.gov.

11. Data deletion and account closure {#data-deletion}

This section explains how to delete your CaseCatalyst account and the personal information associated with it. If you signed in with Google, this section is the data-deletion path required by Google for OAuth-authenticated accounts.

11.1 What account deletion means

Within 30 days of a verified request, we permanently remove or anonymize:

your profile (name, email);
your saved drafts and unsubmitted Workspace content;
your support correspondence beyond what we must retain by law; and
the link between your account and your Google profile, including stored OAuth tokens (if applicable).

You can clear cookies and local storage the Platform set on your own device at any time through your browser settings.

11.2 What we may retain

Issued certificates and their underlying submissions, in anonymized form (your name removed), unless you also ask us to take these down.
Payment and tax records for 7 years, as generally required by U.S. tax and accounting law.
Logs and audit records needed to defend legal claims, investigate fraud, or meet regulatory obligations.
Backups are overwritten on our rotation schedule.

If you also want your certificates and their public verify URLs taken down, say so in your request.

11.3 How to delete

From the email linked to your account, write to contact@casecatalyst.org with the subject "Delete my CaseCatalyst account." Include the full name on the account, the signup email, whether you also want certificates/verify URLs deactivated, and any context.

Google-authenticated accounts: sending the request from the same Google email is usually enough to verify identity. You can also revoke our Google access at https://myaccount.google.com/permissions; revoking access does not, by itself, delete your CaseCatalyst account.

11.4 Timeline

Step	Time
Acknowledgement	Within 3 business days
Identity verification	Up to 7 days
Account and data deletion	Within 30 days of a verified request
Removal from backups	On our backup rotation

We confirm by email when deletion is complete.

11.5 Effects

Deletion is irreversible. We cannot restore your account, drafts, or unsubmitted work afterward.
Issued certificates already on a public verify URL remain visible unless you specifically request takedown.
Unredeemed credits and unused subscription time are not refunded by deletion. Refunds are governed by the Terms of Service.
If you return later, you'll need a fresh account; previous certificates cannot be re-linked.

11.6 Parental requests

If you are a parent or legal guardian and want us to delete a child's account, email contact@casecatalyst.org with the child's name and email and a brief statement of your relationship. We may ask for reasonable verification. Under COPPA, parents may also direct us to delete information and refuse further collection from a child under 13.

12. Security

We use commercially reasonable safeguards: HTTPS/TLS in transit, encryption at rest managed by our database provider, role-based access control with row-level security, logging and monitoring, vendor due diligence, and periodic reviews.

No system is perfectly secure. If we discover a personal data breach likely to create a risk to your rights, we'll notify you and the relevant regulators in line with applicable U.S. state breach-notification laws.

13. Do Not Track and Global Privacy Control

We do not currently respond to Do Not Track signals, and we do not currently support Global Privacy Control signals. Because we do not sell personal information or share it for cross-context behavioral advertising, there is nothing for these signals to opt you out of. If our practices change, we will update this Policy and honor opt-out preference signals where required by law.

14. Third-party links

The Platform may link to third-party sites (Sponsor Companies, school portals, payment pages). This Policy doesn't apply to them — read their policies before sharing information.

15. Changes

We may update this Policy. For material changes, we'll notify you by email and post a notice on the Platform at least 7 days before they take effect. The "Last Updated" date at the top tells you when it was last revised. Continued use after changes take effect means you accept the revised Policy.

16. Contact

Privacy and all requests: contact@casecatalyst.org
Mailing address: CaseCatalyst LLC, 37 Angel Ct, Stanford, CA 94305, United States

We aim to respond within 45 days.