We know that "AI", "data privacy", and "GDPR" can sound intimidating. This guide explains what CaseFlow actually does, how it keeps your information safe, and what you need to know - all in plain English.
CaseFlow helps credit hire teams deal with insurer correspondence faster and with greater confidence. You paste in (or upload) a letter from an insurer, and the system analyses the legal arguments they're making, identifies which court cases they're relying on, and helps you draft a professional response.
Think of it as a very well-read assistant that's studied all the key credit hire case law - but one that always needs you to check its work before anything goes out the door.
CaseFlow uses Google's Gemini 3 Pro - one of the most capable AI models available - for tasks that need careful legal reasoning, like case advice and drafting argument letters. For quicker tasks like initial analysis, it uses Gemini 3 Flash, which is faster but still very capable.
These are the same models used by major businesses worldwide. We don't use an experimental or unproven system.
This is the biggest risk with AI in a legal context - it's called "hallucination", where the AI invents a case name or citation that doesn't exist. We take this extremely seriously and have built a three-layer protection system that every AI output must pass through before it reaches you:
That said, no AI is perfect. We always recommend checking case citations independently before using them. The system is a starting point, not a final answer.
Your PDFs never leave your computer - with one narrow exception. When you upload a normal text-based PDF, it's read and converted to text right there in your web browser. The actual file is never sent to our servers.
The exception is a scanned (image-only) PDF: because the browser can't read the text, the file is briefly uploaded to a private temporary store so it can be OCR'd, then deleted immediately. As a safety net, anything left over is automatically wiped within 24 hours. In day-to-day use this should virtually never happen.
Only the text content is sent for analysis - and even then, it goes through our privacy filter first (more on that below).
We understand that "trust us" isn't always enough - particularly if your IT team or a client wants proof. The short answer: any IT professional can watch your browser's network traffic while a PDF is being loaded. They will see zero outbound requests at that stage. The only call to our servers happens after you click Analyse, and it carries extracted text - not the original file. The document genuinely never moves.
This isn't just our policy - it's how the underlying technology works. PDF reading runs entirely inside the browser tab, using the same open-source library that Firefox uses to display PDFs natively. It's physically incapable of uploading the file.
Before any text is sent to the AI, it passes through our PII masking gateway. "PII" stands for Personally Identifiable Information - things like names, email addresses, phone numbers and registration plates.
Our system attempts to detect these and replaces them with placeholders. So instead of seeing "Mrs Lisa Chen", the AI sees "[NAME_REDACTED]". Instead of "john.smith@example.com", the AI sees "[EMAIL_REDACTED]". Instead of "AB12 CDE", it sees "[VRM_REDACTED]".
Here's what we try to catch:
Postcodes are deliberately kept. UK postcodes matter to locality and basic-hire-rate arguments, so we leave them in the text the AI sees. As a safeguard, an output check then removes any postcode the AI tries to introduce that was not in your original text.
An honest note: Automated pattern-based masking is a strong first layer, but it isn't a perfect filter. That's why we also ask you to send only the personal data the task actually needs. Anything that slips through is covered by the next layers: our AI provider operates under Zero Data Retention terms (your data is not kept or used to train models), and the data itself is deleted shortly afterwards on session close, with a continuous purge as a backstop so nothing is retained beyond 24 hours.
The masking runs in two places: once before text is sent to the AI, and again at the database level when results are saved. That means the history we keep on our servers (your past analyses, replies, advice and letters) already contains placeholders like [NAME_REDACTED] rather than real names or contact details. If our database were ever accessed without authorisation, the personal information has already been stripped out.
No. Absolutely not. We do not use your data to train AI models. Your correspondence and case details are used solely to generate the specific response you asked for - nothing more. The AI provider's terms also prohibit them from using your data for training.
No. Every company on CaseFlow operates in its own completely separate space. Your correspondence, case advice, templates, and history are invisible to other companies. This is enforced at the database level - it's not just a setting that could be accidentally turned off.
GDPR (the UK's data protection law) requires organisations to only collect and process the minimum personal data necessary, to protect it properly, and to be transparent about what they do with it. Here's how we line up:
✅ Data minimisation: PDFs stay on your device. Text is masked before reaching the AI.
✅ Privacy by design: The masking gateway is mandatory - there's no way to bypass it.
✅ Transparency: We tell you exactly what we do (you're reading it now).
✅ Your rights: You can request access to, correction of, or deletion of your data at any time.
✅ ICO registered: We're registered with the Information Commissioner's Office (ZC013423).
No. CaseFlow is a decision-support tool. It helps you draft responses and understand legal arguments, but it's not a substitute for qualified legal advice. Every output should be reviewed by someone who understands the specific case before it's used.
We make this clear throughout the platform - you'll see reminders when you first log in, on every page that uses AI, and alongside every generated response.
📄 Your documents stay on your device - we only see the text, never the file (scanned PDFs are the one narrow exception, and are deleted within 24 hours).
🛡️ Personal details are filtered out before the AI sees anything, and again before anything is saved to our database.
🤖 We use Google's Gemini 3 Pro - a leading, enterprise-grade AI model.
🚫 Your data is never used to train the AI - full stop.
🏢 Your data is completely separate from every other company on the platform.
🔒 3-layer protection against made-up case law - prompt rules, citation validator, and text-body scrubber all run automatically.
⚖️ We're GDPR compliant and registered with the ICO.
⚠️ It's a tool, not a lawyer - every output needs human review.
Behind the scenes, your PDFs stay in your browser - they're never uploaded to our servers. Before any text reaches the AI, we mask common personal details (emails, phone numbers, registration plates, and more) so the model works on cleaned‑up text, not raw data. Postcodes are deliberately kept because they matter to locality arguments, and an output check stops the AI inventing a postcode that was not in your original text. And we never use your data to train AI models - full stop.
For the complete picture, see our How We Protect Your Data page.
Got questions? If anything in this guide isn't clear, or you'd like more detail on any point, get in touch at info@caseflowautomation.co.uk.
For the full technical details, see our How We Protect Your Data and AI Safety & Security Policy documents.