CaseMail Privacy Policy

1. Scope and Who We Are

This Privacy Policy explains how VerTrius Corp, doing business as CaseMail ("CaseMail," "we," "us," or "our"), collects, uses, discloses, retains, and protects Personal Information when you use CaseMail websites, accounts, Certified Postal Mail services, Certified Email services, Digital Evidence Archive features, certificates, integrations, support channels, and related CaseMail services (collectively, the "Services").

This Policy is intended to apply to CaseMail.us and CaseMail.ai and to CaseMail Services that link to this Policy. A separate or supplemental notice may apply to a specific enterprise deployment, integration, or third-party platform when expressly stated.

2. Information We Collect

We collect information that you provide to us, information generated through your use of the Services, information received from integrations you choose to connect, and technical information collected automatically.

Account and business information may include your name, organization, title, email address, telephone number, mailing address, account credentials, user roles, preferences, and communications with CaseMail.

Billing and transaction information may include subscription plan, transaction history, prepaid balances or postage credits, billing contact information, and limited payment-related information. Payment card information may be processed directly by our payment providers rather than stored by CaseMail.

Certified Postal Mail information may include sender and recipient names and addresses, uploaded documents, mailing selections, address-verification results, postage and fulfillment information, tracking events, delivery information, return-receipt information when available, certificates, and related records.

Certified Email information may include connected email-account identifiers, selected email threads or messages, participants, message bodies, attachments, MIME content, headers, metadata, timestamps, and other information necessary to authenticate, capture, certify, store, display, share, or re-verify correspondence that you select or direct CaseMail to process.

Evidence and records information may include Digital Evidence Archive records, certificates, cryptographic fingerprints, timestamps, audit events, verification history, access history, and related service-generated metadata.

Integration information may be received from services you choose to connect, such as Google Workspace/Gmail, Microsoft services, legal practice-management systems, customer relationship systems, or other authorized third-party platforms. The information available to CaseMail depends on the permissions you grant and the integration you enable.

Technical information may include IP address, browser type, device information, operating system, pages or features used, session information, referring URLs, approximate location derived from IP address, cookies or similar technologies, and security or diagnostic logs.

3. Google Workspace and Gmail Data

When you connect a Google account, CaseMail may access Google user data only to provide the user-facing CaseMail features you authorize. Depending on the scopes and features you enable, this may include account identifiers and Gmail message bodies, attachments, metadata, headers, labels or settings, and related data needed to connect your account, display or select correspondence, certify selected email threads and attachments, create CaseMail evidence records, or perform other user-requested Certified Email functions.

CaseMail requests only the Google permissions reasonably necessary for the enabled feature. The Google consent screen describes the scopes presented to you. You can revoke CaseMail access through your Google account settings, although revocation may disable related CaseMail features.

CaseMail's use and transfer of information received from Google Workspace APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Additional details appear in our Google Workspace API Privacy & Limited Use Policy.

4. How We Use Information

We use Personal Information to provide, operate, secure, maintain, and improve the Services; create and administer accounts; authenticate users and connected accounts; process certified postal and email workflows; generate and maintain certificates and evidence records; provide tracking and verification; process billing; respond to support requests; communicate service notices; prevent fraud, abuse, or security incidents; enforce our agreements; comply with law; and protect CaseMail, our users, and others.

We may use business contact information to communicate about CaseMail products, service updates, events, or offers, subject to applicable law and available opt-out choices. We do not use private email-message contents or uploaded customer documents for targeted advertising.

We may use aggregated or de-identified information for analytics, capacity planning, security, service improvement, and business operations where permitted by law.

5. How We Disclose Information

We may disclose Personal Information to service providers and subprocessors that help us operate CaseMail, such as cloud hosting, data storage, security, payment processing, communications, analytics, customer support, postal fulfillment, address verification, and carrier or delivery providers. These providers are authorized to process information only for the services they provide to us and subject to applicable contractual or legal obligations.

For Certified Postal Mail, information necessary to prepare, address, print, mail, track, or deliver an item may be provided to postal fulfillment providers, the United States Postal Service, or other carriers and service providers involved in the mailing you request.

For integrations, we may exchange information with a third-party platform when you direct us to connect that platform or when the exchange is necessary to provide the integration you requested.

We may disclose information when required by law, legal process, or governmental request; to protect rights, safety, security, and integrity; or in connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of our business, subject to applicable law.

CaseMail does not sell Personal Information for monetary consideration. If applicable law treats certain analytics or advertising disclosures as a "sale" or "sharing," we will provide legally required rights and controls.

6. Customer Content, Evidence Records, and Blockchain Data

You and your organization retain ownership of the documents, correspondence, attachments, mailing files, and other content you submit to CaseMail, subject to the rights of other people in that content. CaseMail processes that content to provide the Services and as otherwise described in this Policy and the Terms of Service.

Some CaseMail features are designed to create durable evidence records. Certificates, audit records, mailing history, delivery evidence, or user-directed Digital Evidence Archive records may therefore be retained after an account is closed when retention is necessary to provide the requested evidentiary function, comply with law, resolve disputes, prevent fraud, maintain business records, or honor an applicable customer agreement.

Where CaseMail records cryptographic hashes, timestamps, transaction identifiers, or similar proof data to a public blockchain, those blockchain entries may be immutable and may not be capable of deletion or alteration by CaseMail. CaseMail's blockchain architecture is intended to record verification evidence rather than publish the full private contents of customer email messages or uploaded documents on a public blockchain.

7. Cookies, Analytics, and Privacy Signals

CaseMail websites and applications may use cookies, local storage, analytics tools, and similar technologies for authentication, security, preferences, performance, diagnostics, and understanding use of the Services. Third-party services may set their own technologies subject to their policies.

Browser "Do Not Track" signals are not a uniform legal standard. Where applicable law requires recognition of an opt-out preference signal, such as Global Privacy Control, CaseMail will process the signal as required for the browser or device sending it.

8. Data Retention

We retain Personal Information for as long as reasonably necessary for the purposes described in this Policy, including to provide the Services, maintain account and evidence records, satisfy legal, tax, accounting, contractual, security, and dispute-resolution requirements, and protect against fraud or abuse.

Retention periods vary by record type and service. Account-profile data may be deleted or de-identified after closure when no longer needed, while billing records, certificates, mailing records, evidence records, backups, audit logs, or blockchain proof entries may be retained longer when necessary for the purposes described above.

9. Security

We use administrative, technical, and physical safeguards designed to protect Personal Information against unauthorized access, loss, misuse, alteration, or disclosure. These safeguards may include encryption, access controls, authentication, logging, monitoring, and other security measures appropriate to the nature of the information and service.

No system is completely secure. We cannot guarantee that unauthorized access, loss, or misuse will never occur.

10. Your Choices and Privacy Rights

Depending on your location and applicable law, you may have rights to request access to Personal Information, correction, deletion, portability, restriction or objection to certain processing, withdrawal of consent, or information about certain disclosures. You may also have the right to appeal a privacy-request decision or contact a regulator.

To exercise a privacy right, email privacy@vertrius.com. We may need to verify your identity and authority before completing a request. An authorized agent may submit a request when permitted by applicable law and subject to verification requirements.

Certain information may be exempt from a request or retained where permitted or required by law, including information necessary to complete a transaction, maintain security, preserve requested evidence records, comply with legal obligations, exercise legal rights, or maintain immutable public-blockchain proof data.

11. California Privacy Rights

To the extent the California Consumer Privacy Act, as amended ("CCPA"), applies to CaseMail and to your Personal Information, California residents may have rights to know or access covered Personal Information, request deletion, request correction, opt out of the sale or sharing of Personal Information, limit certain uses or disclosures of sensitive Personal Information, and receive equal service and pricing without unlawful discrimination for exercising privacy rights.

CaseMail does not sell Personal Information for money. Where applicable law characterizes a particular disclosure as "sharing" or "selling," we will provide the opt-out method required by law. CaseMail will also honor legally recognized opt-out preference signals, such as Global Privacy Control, when required.

California residents may submit requests using the contact information in Section 18. We may verify requests and may deny or limit a request where an exception applies.

12. Children

The Services are intended for business and professional users and are not directed to children under 13. We do not knowingly collect Personal Information from children under 13 through the Services. If you believe a child has provided Personal Information to us, contact us so we can review the matter.

13. International Users

CaseMail is operated from the United States. If you access the Services from another country, information may be transferred to, stored in, or processed in the United States or other locations where CaseMail or its service providers operate. We take steps intended to provide appropriate protections as required by applicable law.

14. Third-Party Services and Links

Third-party platforms, carriers, websites, and integrations have their own privacy practices. This Policy does not govern information processed independently by those third parties. We encourage you to review their privacy notices before using their services.

15. Business Customers and End Users

When CaseMail processes Personal Information on behalf of an organization under an enterprise, partner, integration, or other business agreement, that organization may determine the purposes and means of certain processing. In those circumstances, privacy requests relating to customer-controlled data may need to be directed to the organization that controls the account, and our contract with that organization may govern our processing obligations.

16. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the revised Policy with a new effective or last-updated date and provide additional notice when required by law. Material changes to our use of Google user data will also be reflected in our Google-related disclosures and, when required, in the applicable product or consent experience.

17. Related Policies

Use of CaseMail is also subject to our Terms of Service. Users who connect Google Workspace or Gmail should also review the CaseMail Google Workspace API Privacy & Limited Use Policy.

18. Contact Us