Privacy Policy

Last updated: July 2026

1. What CaseDesk is

CaseDesk is a managed AI inference platform. We provision and operate dedicated GPU clusters on your behalf in UK and EU data centres (AWS eu-west-2 and Azure westeurope). You connect your applications to a private OpenAI-compatible API endpoint - your prompts and outputs stay within the selected region and never leave it.

2. Information we collect

  • Account: email address and hashed password.
  • Payment: billing details are processed and stored by Stripe. CaseDesk stores only a Stripe customer ID and subscription status - we never see or store your card number.
  • API usage: request count, token counts, model identifiers, and timestamps. Used for billing, rate limiting, and capacity planning. No prompt or response content is logged.
  • Deployment metadata: cluster region, model name, deployment status, and endpoint identifiers.
  • Web server logs: IP address, timestamp, HTTP method and path. Retained for 30 days.

3. Prompt and inference data

CaseDesk does not log, store, or inspect the content of your API requests or model responses. Inference runs inside your dedicated deployment. Prompts and outputs are not transmitted to CaseDesk servers.

4. How we use your information

  • Authenticate you and operate your account.
  • Provision and manage your dedicated inference deployment.
  • Calculate GPU-hour usage for billing via Stripe.
  • Send transactional emails (deployment status, billing receipts).

We do not sell your data, use it for advertising, or share it with third parties except as required by law or to operate the service (Stripe for payments).

5. Data residency and GDPR

Your inference workload runs in the region you select at deployment time. UK deployments run on AWS eu-west-2 (London) or Azure uksouth. EU deployments run on Azure westeurope (Netherlands). No data is transferred outside your selected region. CaseDesk complies with the UK GDPR and EU GDPR. For NHS and regulated healthcare deployments, Enterprise Isolation tiers provide dedicated hardware and meet DSPT-aligned data handling requirements.

6. Data retention and deletion

You can delete your account at any time from your account settings. On deletion, your deployment is terminated, usage records are anonymised within 30 days, and your account data is permanently removed. Stripe retains billing records in accordance with their own retention policy.

7. Security

All connections are served over HTTPS with HSTS enforced. API keys are hashed before storage. Deployments run in isolated Kubernetes namespaces. Enterprise Isolation tier uses dedicated hardware nodes with no shared GPU. Encryption at rest is applied to all persistent volumes.

8. Cookies

CaseDesk uses a single session cookie to keep you signed in. We do not use tracking cookies, advertising cookies, or third-party analytics.

9. Contact

Questions about this policy or data subject requests: privacy@getcasedesk.com