Last reviewed 21 August 2026
Privacy notice
Plain-language summary: this site has no contact form, analytics or advertising cookies. Emailing us opens a message in your own email service.
Case Proof Studio is a trading name of James Root, a sole trader. We are responsible for deciding how we use personal information for our own business purposes. Contact us at hello@caseproofstudio.com or write to Suite RA01, 195-197 Wood Street, London E17 3NU.
Information we collect
We may collect your name, job title, business contact details, correspondence, project brief, billing information and records of our work together. If your organisation commissions a case study, we may also receive interview recordings, transcripts, project notes and approved quotes relating to people involved in the featured work.
Why we use it
- To respond to enquiries and take steps at your request before entering a contract.
- To deliver, administer and invoice for contracted services.
- To keep tax, accounting and business records where the law requires it.
- To protect our services, establish legal claims and manage business risk.
- To send relevant business-to-business marketing where permitted, after completing a legitimate-interests assessment and always providing a simple opt-out.
Lawful bases
Depending on the context, we rely on contract, steps before a contract, legal obligation, legitimate interests, or consent. Our legitimate interests include operating and improving the business, keeping appropriate records, and offering relevant services to corporate organisations. Where consent is the basis, you may withdraw it at any time.
Client project material
Where we process interview or project material only on a client’s documented instructions, the client is normally the controller and we act as processor. Our service agreement includes the required processing terms. Clients remain responsible for having a lawful basis to share the material and for securing any permissions needed to publish names, quotations, logos or claims.
Who receives information
We share information only where necessary. Current providers are Freeola Limited in the UK for domain, DNS and business email, and OVHcloud for the UK-hosted website, access-controlled project storage and basic security logs. A bank or payment provider will receive invoice and payment information only after a payment method is selected and disclosed to the client. Professional advisers or authorities may receive information where necessary or legally required. We do not sell personal information.
Anthropic (Claude) and OpenAI business services may be used for assisted drafting only when the signed order form names that provider and the client has expressly authorised that use. Identifiable confidential project material is not submitted by default. Each provider states that business and API inputs and outputs are not used to train its models by default; retention depends on the selected service and controls.
International transfers
The public website and primary project storage are hosted in the UK. Email routing may involve a recipient’s provider outside the UK. If a client authorises AI-assisted drafting, UK personal data may be processed in the United States and other locations used by Anthropic, OpenAI and their subprocessors. Each provider’s Data Processing Addendum incorporates the EU Standard Contractual Clauses as amended by the UK Addendum for those restricted transfers. We assess any other restricted transfer and put an appropriate safeguard in place before it occurs.
How long we keep it
- Enquiries that do not become clients: up to 12 months.
- Client contracts, invoices and core transaction records: normally 6 years after the relevant accounting period, subject to applicable tax and legal requirements.
- Raw interview recordings and working transcripts: deleted within 30 days after final acceptance unless a different period is agreed in writing.
- Suppression records for marketing opt-outs: kept as long as reasonably necessary to honour the opt-out.
Your rights
Depending on the circumstances, you may have rights to access, correct, erase or restrict your information, object to its use, or receive a portable copy. You may object to direct marketing at any time. Contact us using the details above. You can also complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint.
Website data and cookies
This static website does not set analytics, advertising or other non-essential cookies. Nginx and the hosting provider process basic request data such as IP address, time, requested path and browser information for security and delivery. Local nginx logs rotate daily and are retained for up to 14 days. If analytics, embedded media, forms or advertising tools are added, this notice and the site’s consent controls will be updated before those tools are enabled.
Changes
We may update this notice when our services or suppliers change. The review date at the top shows the latest version.