Privacy policy

Summary

Who is responsible for your information

PNW Web Marketing LLC is responsible for the personal information described in this policy (in legal terms, it is the "controller" of that information).

Privacy Officer: Lucas Barnes, Founder and Privacy Officer, is the person in charge of protecting personal information at PNW Web Marketing LLC for Send to Case and is accountable for our compliance with privacy law and this policy. Contact him at [email protected] with any privacy question, request or complaint.

Data we collect

Clio OAuth tokens

When you connect the extension to Clio, we receive OAuth access and refresh tokens. These are stored locally on your device in the browser's extension storage (chrome.storage.local). We use these tokens only to authenticate your requests to Clio's API.

Adding Send to Case from Clio ("Add to Clio")

If you add Send to Case from Clio's App Directory, our website completes the Clio connection and our backend stores your Clio access and refresh tokens, encrypted, so the extension can collect them without asking you to sign in again. The code the extension uses to collect them is valid for two minutes and works once; the stored tokens are deleted when the extension collects them, and codes that are never used are deleted within about an hour after they expire. Signing in on our website for other reasons, such as managing your subscription, passes your tokens through our website and backend without storing them.

Your matter list (on your device)

To make picking a matter faster, the extension keeps a cached list of your matters and recently used matters on your device, including each matter's number, description, and client name. This list is not sent to our servers.

Settings synced by your browser

A few settings are saved in the browser's sync storage: the Clio IDs (not names) of matters you pin, the websites you have marked as trusted or blocked, and your default upload folder (its Clio folder ID and name). If sync is turned on in your browser, it may copy these to the account you are signed in with (a Google account in Chrome; a Microsoft, work or school account in Edge) and to your other signed-in browsers. We do not receive them.

Files you upload (temporary, on your device)

When you upload a file, the extension stages it temporarily in its private storage in your browser (the Origin Private File System) and sends it directly to Clio's secure storage (Amazon S3). Staged copies are removed after the upload, or later by a periodic clean-up if an upload is interrupted. Files are never transmitted to or stored on our servers. The extension also keeps a local upload history on your device (file names, sizes, and the matter each file went to), which is not sent to us; entries older than 60 days are cleared when the extension starts.

Error and performance reports (pseudonymous)

To find and fix problems, the extension and our backend send error and performance reports to our error-monitoring provider, Sentry. These reports include:

• Error messages and stack traces (technical debugging information)
• Extension version, and your browser and operating system (from your browser's user agent)
• Performance traces of extension and backend operations, such as how long an upload or a request to Clio took. We record every trace, not a sample.
• Warning and error messages the extension logs, and log messages from our backend
• File sizes and file types (for example, "application/pdf")
• Numeric Clio IDs of the matters, folders, and documents involved (IDs only, not names)
• The web address of a file the extension fetched for you, with most of the address after the site's name removed or replaced by codes; the site's host name (for example, a court or portal domain) is kept
• A copy of the extension's recent usage events (described below), attached as context
• A pseudonymous user ID: reports from the extension use a code computed from your Clio user ID (for example, clio_3f2b…); reports from our backend use your internal account ID. We can link either one to your account.

File names are replaced with a short code (for example, file_3f2b1c…) and email addresses are removed before reports are sent. This filtering is automated and best-effort: part of a file name that appears elsewhere in an error message, such as a client name or case number, can still be included. We do not intentionally include file contents, matter names, or client names in reports. Our filtering removes fields labelled as matter or client names, but it cannot recognize a name written inside free text, so a name that appears inside an error message (for example, one returned by Clio) could be included. When the extension in your browser sends a report, Sentry receives your IP address as part of the connection, as any web service does.

Account data and upload counts

When you connect, our backend creates an account record with your Clio user ID and the email address Clio reports for you (or, if Clio doesn't provide one, the email address you later use at checkout). To enforce plan limits we keep a monthly count of the files you upload, plus short-lived records (kept 90 days) that stop a retried upload from being counted twice. These records hold counts, not file names or matter names.

Product-usage events (pseudonymous)

The extension, our backend, and our website record events about how Send to Case is used: uploads that succeed, fail, are cancelled, or are blocked (with the entry point, file sizes, how long the upload took, how many files, and an error category); right-click menu use and page scans that find no files (counts of page elements, not page content or addresses); which screen the file picker opened on; extension installs; steps in signing in to Clio; plan-limit prompts; and failed subscription payments. Our website records views of the page shown after installing the extension, clicks on referral links, and clicks on buttons that lead to the Chrome Web Store.

Each event is stored in our database with the time, the event type, the extension version (for events from the extension), and a user ID, which is one of:

• the same coded ID used in error reports (clio_…), computed from your Clio user ID. We hold your Clio user ID with your account, so we can link these events to you;
• your internal account ID, for failed-payment events, together with a reference to Stripe's record of that payment event; or
• "anonymous", when no one is signed in or the event comes from our website.

Some fields are worth calling out: referrer is the address of the page that linked to our post-install welcome page (its first 200 characters); page_path is the page of our website a button was on; utm_* fields are campaign tags from the link you followed. Usage events never include file names, file contents, matter or client names, or your email address. Older usage events stored in our database may also include the numeric Clio ID of the matter a file was uploaded to; we stopped recording it in October 2026. We do not currently delete usage events automatically; they are deleted with your account data if you ask us to delete it.

The complete list of events and the fields each one stores:

• upload_succeeded: entry_point, file_size_bucket, duration_ms, file_size_bytes, file_count
• upload_failed: entry_point, error_type, upload_error_code, file_size_bytes, attempts
• upload_cancelled: entry_point, file_count
• upload_blocked: entry_point, reason, file_size_bytes
• context_menu_clicked: scheme, link_kind
• page_scan_zero_links: source_kind, scanner, page_scheme, diag_ok, anchors_total, anchors_doc_ext, download_attr_els, buttons_total, iframes_total, pdf_embeds, nonhttp_links
• gmail_scan_diagnostics: is_thread_view, links_found, download_url_attr, view_att_anchors, view_att_attd_safe, view_att_inline, class_a_zo, class_a_qh, class_a_v3, aria_download, tooltip_download, buttons_attachment
• gmail_extractor_diagnostics: subject_found, sender_found, date_found
• page_scan_outcome: outcome, tier, links_bucket
• picker_view_shown: view, entry_point
• payment_failed: stripe_event_id, failure_code, plan, attempt_count
• welcome_page_viewed: referrer
• referral_click: utm_source, utm_medium, utm_campaign, utm_content
• install_click: page_path, placement, browser, utm_source, utm_medium, utm_campaign, utm_content
• auth_exchange_attempted: redirect_kind
• auth_exchange_succeeded: redirect_kind
• auth_exchange_failed: redirect_kind, reason, http_status
• auth_signup_completed: channel
• auth_sync_completed: channel, user_action
• auth_sync_failed: channel, reason, http_status
• extension_installed: browser, store
• auth_started: browser, store
• auth_cancelled_or_failed: browser, store, reason, duration_ms
• selection_quota_prompt: surface, action, state, selected_count, remaining

IP addresses, browser details, and request logs

Rate limiting. To limit abuse, our backend (api.sendtocase.com) counts requests per IP address for the requests made while signing in to Clio and refreshing your connection, the uninstall survey, our website's first-visit referral record, and usage events sent while no one is signed in. Each counter is stored with your IP address and the address of the request, and is deleted about a day after your last such request. Other requests to our backend are counted per signed-in user instead of by IP address.

Security records. Our backend also records your IP address, browser user agent, the address of the request, and your account ID if you are signed in, when a request goes over a rate limit or looks like misuse (for example, a checkout request for a price we don't offer), and for requests from ChromeOS devices, which we log to monitor compatibility. These records are deleted automatically after 30 days.

Request logs. Cloudflare, which hosts our website and backend, keeps records of the requests made to them, including your IP address and browser user agent, and we can look these up to investigate abuse or problems. Our backend also writes a log line with your browser's user agent for every request, and its request logs and traces are kept by Cloudflare for a few days (currently up to 7). Cloudflare decides how long its other request records are kept.

We use all of these records only to protect the service and to diagnose problems. Who else can receive them is described in “Third parties”.

Website analytics identifier (first-party, pseudonymous)

When you first visit our website, we generate a random identifier (a "client ID") and store it in your browser's localStorage. We record it on our backend together with how you arrived: the referring website, the page you landed on, and any campaign parameters (UTM tags) in the link you followed. We use this to understand which channels bring people to Send to Case, so we can measure our own marketing. This is first-party: the identifier is ours, is not a cookie, is not sent to the analytics or advertising tools on our website, and is not used to track you across other websites. (A referring web address can, in rare cases, contain information the referring site placed in the link; we store it only to understand the referral source.) If you later create an account, we store the identifier with your account, which links that first visit to you. The identifier is therefore pseudonymous rather than anonymous. We do not currently delete these records automatically. You can clear the identifier from your browser at any time by clearing your browser storage for this site. In the UK, the European Economic Area, Switzerland and Quebec we create the identifier only after you accept in our cookie banner; see Cookies and your choices.

Install-button clicks (first-party, no identifier)

When you click a button that takes you to the Chrome Web Store, we record that click: which page and which part of the page it was on, your browser family (Chrome, Edge, mobile, or other), and any campaign parameters (UTM tags) from the link that brought you to our site during that browser session, which we keep in your browser's sessionStorage until you close the tab. The click record carries no identifier: not the client ID above, no name, no email. Like any request to our backend, it is subject to the rate-limit counter and request logs described above, which hold your IP address for a short time. Our links to the Chrome Web Store also carry a campaign tag naming our website as the source, so Google's store statistics can show us how many visitors came from our site. In the UK, the European Economic Area, Switzerland and Quebec we record these clicks, and keep your session’s campaign parameters in sessionStorage, only after you accept in our cookie banner (the campaign tag on our store links is part of the link itself and is there for everyone). If you reject later while a page is open, clicks on that page can still be recorded until you leave it, with any campaign parameters in that page’s own address but nothing stored.

Uninstall survey

When you remove the extension, your browser opens a short survey on our website. If you submit it, we store the reason you choose, an optional comment (up to 200 characters, offered when you choose "Other"), and your extension version. The survey record has no account ID or email address, and we delete it after one year.

Data we do not collect

• Your file contents — files upload directly from your browser to Clio.
• Your file names on our servers — file names are not sent to our backend, and they are replaced with codes in error reports (with the limits described above).
• Your Clio password — we use OAuth, so we never see your password.
• Matter or client names on our servers — our backend and usage events do not store them; see "Error and performance reports" above for error reports.
• Browsing history — the extension does not watch your tabs or record the pages you visit. It reads a page only when you ask it to (for example, to find downloadable files), and error reports can include the host name of a site you uploaded from.

Where your information comes from

We collect your information in these ways:

• From you. What you type or choose: for example, the Clio region you pick when you connect, the email address you give at checkout, your uninstall survey answers, and the messages you send us.
• Automatically, by the extension and our website. Code running in your browser and our servers record the usage events, error reports, security records and website identifier described in “Data we collect” when you use Send to Case or visit our website.
• From Clio. When you connect, Clio tells our backend your Clio user ID and the email address on your Clio account (if it has one). Clio's reply also includes your name. We don't store your name in our database, but it could appear in an error report if Clio returns an error at that moment. The extension keeps your Clio user ID, name and email address on your device to show which account is connected. Clio is also the source of the matter list the extension keeps on your device and of the numeric Clio IDs in error reports, as described in “Data we collect”.
• From Stripe. If you subscribe, Stripe, our payment processor, tells us the status of your subscription and payments (for example, that a payment failed, with Stripe's reason code) and, if Clio did not give us an email address for you, the email address you gave at checkout.
• From a colleague. If the owner of a firm subscription invites you to a seat, they give us your email address. We use it to send you the invitation, to give you the seat when you connect, to show the owner whether you have joined, and to keep a record of the firm's seats. We keep that record, including your email address, even if the invitation is revoked or never accepted; it is not yet deleted automatically, and you can ask us to delete it. If you received a seat invitation, this policy applies to you, and the rest of it describes what happens once you connect.

Why we use your information

The table below lists each purpose, the information we use for it and, for people in the UK and the European Economic Area (EEA), the legal basis we rely on. Where the basis is our legitimate interests, the table says what that interest is.

What you need to give us. To use Send to Case you connect a Clio account, which gives us your Clio user ID; without it the extension cannot work. We need an email address to send you account emails, and a paid plan needs the payment details Stripe collects. While the extension is connected it sends usage events and error reports, which you can't yet turn off (see “Your right to object”), and, like any online service, our servers and providers receive your IP address and browser details with each request (see “IP addresses, browser details, and request logs”). Everything else you choose to give us, allow or leave switched on, such as survey answers, product emails, and website analytics where we ask, is optional, and saying no costs you nothing.

No automated decisions. We do not make decisions about you based only on automated processing that have legal or similarly significant effects on you.

If you are in Canada. Canadian privacy law (PIPEDA) relies on consent rather than the legal bases in the table. When you connect Send to Case to Clio and use it, you consent to the uses in this policy that are needed to provide the service, keep it secure and fix errors. The extension also sends usage events and error reports whenever it is connected; there is not yet a setting to turn them off, so today the only way to stop new ones being linked to you is to disconnect or remove the extension. For product emails, and for website analytics and advertising where we do not ask first, we rely on your implied consent: you can opt out at any time with the unsubscribe link in any product email, or for website tags with “Cookie settings” in the footer of our website (see Cookies and your choices) or your browser's or the ad platform's settings. You can also withdraw any consent by writing to our Privacy Officer, subject to legal and contractual limits. What withdrawing means: for account information, you disconnect and remove the extension and we delete your account (see “Data storage and retention”), and you can't use Send to Case unless you sign up again; for product emails, you simply stop receiving them; for usage events and error reports, we delete the usage events stored in our database about you, and you need to disconnect or remove the extension to stop new ones being linked to you (records of failed subscription payments continue while you have a subscription).

Third parties

The following third parties may receive data when you use Send to Case:

We may also disclose personal information when the law requires it (for example, to a court or a government authority), to our professional advisers, or to the buyer if our business is sold.

Cookies and your choices

The analytics and advertising tools on our website — Google Analytics and Google Ads, Microsoft Advertising (UET), the Reddit pixel — together with our own website analytics identifier and the campaign parameters kept for install-button clicks (both described above), store or read information in your browser. Whether they run depends on where you are visiting from, which our website works out from your IP address when it serves each page (the address is not stored for this).

• United Kingdom, European Economic Area, Switzerland and Quebec: none of these tools runs until you choose “Accept” in the banner at the bottom of the page. If you choose “Reject”, or make no choice, they stay off. When we cannot tell where you are visiting from, we treat you the same way.
• Everywhere else: they are on by default, and you can turn them off at any time.

Changing your mind. “Cookie settings” in the footer of our website opens the same choice again. Choosing “Reject” tells these tools to stop at once, keeps them off on every page you open afterwards (anything still running on a page that is already open stops when you leave it), and deletes what they stored in your browser for our site: the Google Analytics, Google Ads, Microsoft and Reddit cookies (names beginning _ga, _gid, _gcl, _gac, _uet or _rdt, plus the same names in browser storage), our website analytics identifier and the install-click campaign parameters. It cannot delete cookies those companies set on their own domains; use your browser’s settings or theirs for those. Rejecting also does not delete a website analytics identifier we already recorded, or one the Send to Case extension already received from our welcome page: the extension keeps it and stores it with your account when you sign in, including if you sign in after rejecting. Email us at [email protected] and we will delete it.

How long your choice lasts. We remember your choice in your browser’s localStorage (as stc_consent). If you accepted in one of the regions listed first, we ask again after 13 months, or sooner if we add a new tool or purpose; an acceptance given where the tools are on by default does not count there. If you rejected, we keep that until you change it. Clearing your browser storage for our site clears the choice too, and so does a browser that clears it for you: Safari, for example, deletes a site’s stored data after about seven days of use without a visit to that site. Outside the regions listed first, that means the tools come back on, so you would need to reject again.

What always runs. Some storage is needed for the website to work and is not covered by this choice: the record of your choice itself; the cookies our account pages set when you sign in or connect Clio (stc_session, stc_oauth, stc_handoff, stc_region); and security cookies Cloudflare, our host, may set to protect the site from automated traffic (such as __cf_bm). Cloudflare Web Analytics does not use cookies and is not affected by your choice. Videos embedded from YouTube are also not controlled by this choice: when a page with a video loads, YouTube’s player may store information in your browser under YouTube’s own policies. Our fonts are served from our own website, so loading them sends nothing to Google.

The “Google LLC (Analytics & Ads)”, “Microsoft Corporation (Microsoft Advertising)” and “Reddit, Inc. (Advertising)” entries under “Third parties” above, and the YouTube entry’s note that Google Analytics records video plays, apply only once those tools are running: in the regions listed first, that means only after you accept.

Notice for visitors in Quebec

Under section 8.1 of Quebec’s Act respecting the protection of personal information in the private sector, we tell you that our website uses technology that can identify you, locate you or build a profile of you: the Google, Microsoft and Reddit advertising and analytics tools, and our own website analytics identifier, described above. These functions are off by default for visitors from Quebec. To turn them on, choose “Accept” in the banner, or open “Cookie settings” in the footer of our website and choose “Accept”. To turn them off again, open “Cookie settings” and choose “Reject”.

How authentication works

Send to Case uses Clio's official OAuth 2.0 authentication flow:

1. When you click "Connect to Clio", you're redirected to Clio's login page.
2. You enter your credentials directly on Clio's website — we never see them.
3. Clio provides an authorization code.
4. Our secure proxy exchanges this code for access tokens.
5. Tokens are stored locally on your device. (If you add Send to Case from Clio's App Directory, see “Adding Send to Case from Clio” above.)
6. When tokens expire, they're automatically refreshed via our secure proxy.

We never see, store, or have access to your Clio username or password.

Data storage and retention

On your device, the extension keeps (in the browser's extension storage and in its private browser storage):

• OAuth tokens (until you disconnect or they expire)
• Your Clio user ID, name and email address, your Send to Case account email and sign-in session, and, if a firm provides your seat, the firm owner’s email address
• Your cached matter list and recent matters
• Your local upload history
• Extension settings and preferences, some of which your browser syncs (see “Settings synced by your browser” above)

When you disconnect from Clio, the extension deletes your tokens, your Clio and Send to Case account details, your cached matter list and recent matters, your current upload list, and your pinned matters. Your trusted and blocked websites, your default upload folder, your local upload history, and the website identifier described above (if the extension received one from our website) stay until you remove the extension. When you remove the extension, your browser deletes the data the extension stored in it; settings it has synced are managed by your browser under the account you sync with.

On our backend we hold the account data needed to run the service, including your Clio user ID, your email address, your subscription status, your upload counts, the dates we sent you each of our emails and whether you unsubscribed, the website analytics identifier and referral record described above (if you arrived through our website), records of the subscription notices we sent you, and, if you manage a firm subscription, the email addresses you invite to seats. We never store your documents — files are uploaded directly to your Clio account. We also hold the product-usage events described above.

Retention: rate-limit records are deleted about a day after your last request, unused "Add to Clio" tokens within about an hour of expiring, security records after 30 days, upload de-duplication records after 90 days, and uninstall survey responses after one year. Your account record, usage events, and referral records are not yet deleted automatically: they are kept until you ask us to delete them. To have your backend account data and usage events deleted, email [email protected] and we will remove them, except records the law requires us to keep, such as billing records and the subscription notices we sent you, which we keep for as long as that law requires. To delete your account for good, first disconnect and remove the extension (and cancel any subscription): while it is connected, the extension signs you back in, and signing in again, in the extension or on our website, creates a new account record. Error reports, emails in our support and alert mailboxes, our log of privacy requests, and our providers' delivery logs are kept under those providers' retention settings or until we delete them; we do not yet have a fixed schedule for them.

Where your information is processed

We are a US company, and the personal information we hold is processed in the United States, and our providers may also process it in other countries where they operate. Our database runs on Cloudflare in North America. Requests to our website and backend are handled by Cloudflare's global network, so a request may first be processed in a Cloudflare data center near you. Error reports are stored in Sentry's US region, and our emails are sent from the United States. Information processed in the United States is subject to US law and may be accessible to US courts, law enforcement and national security authorities.

When you use Send to Case from outside the United States, you send your information to us in the United States. We then share it with the service providers in the table below, which are also US companies, or our website has your browser send it to them directly (they are described in “Third parties” above). If you are in Quebec, this means your information is communicated outside Quebec. Your documents are not part of this: they go directly from your browser to your own Clio account, and Clio's own data-residency arrangements govern where they are stored.

For people in the UK and the EEA: the UK's adequacy regulations for the United States (the “UK-US data bridge”) and the EU's adequacy decision for the EU-U.S. Data Privacy Framework (DPF) cover transfers to US organisations certified under the DPF and its UK Extension. Each provider below is certified under both (for Stripe, through its certified US company, Stripe, LLC), and we rely on that. Some providers' data processing agreements also include the EU Standard Contractual Clauses with the UK Addendum, as an additional safeguard; you can ask us for a copy.

Certifications are as listed on dataprivacyframework.gov when we last checked, on October 8, 2026. Clio (Themis Solutions Inc.) and Amazon Web Services are not in this table because they are not our service providers: your documents go to your own Clio account, which stores them on Amazon S3 under Clio's policies, and our backend contacts Clio only on your behalf, to exchange and refresh your sign-in tokens and to look up your Clio user ID and email address.

Your privacy rights

Wherever you live, you can ask us what personal information we hold about you, ask for a copy, ask us to correct it, or ask us to delete it (except what the law requires us to keep; see “Data storage and retention” for what to do first so a deleted account is not recreated). Write to our Privacy Officer at [email protected]; if you are not sure what to ask for, we will help you work it out. We may need to confirm that the request comes from you, normally by asking you to write from the email address on your account, or, if we have no email address for you, in another way that shows the account is yours. Requests are free.

We reply within 30 days of receiving your request, or within one month if that is sooner (the UK and EEA deadline). Where the law allows, we may extend this, by up to two more months in the UK and EEA or 30 more days in Canada, and if we do, we will tell you why before the first deadline. For Quebec requests, we can extend the deadline only if the Commission d'accès à l'information allows it.

Complaints to us

You have the right to complain to us about how we handle your personal information. Email [email protected] and say it is a privacy complaint. We will acknowledge your complaint within 30 days of receiving it, then look into it, keep you informed of our progress, and tell you the outcome, all without undue delay. You can also complain to the regulator where you live, listed below.

If you are in the UK or the EEA

Under the UK GDPR and the EU GDPR, you have the right to:

• Access your personal information and get a copy of it.
• Rectification: have inaccurate information corrected and incomplete information completed.
• Erasure: have your information deleted.
• Restriction: ask us to limit how we use your information (with the same limits as described in the box above).
• Portability: receive the information you gave us in a machine-readable format, or have it sent to another organisation, where we rely on contract or consent.
• Object to our use of your information, as described in the box above.
• Withdraw consent at any time where we rely on it (for website analytics and advertising tags, the website identifier and install-button clicks), using the consent choice on our website. Withdrawing does not affect what happened before.
• Complain to us, as described above (a UK legal right, which we offer to everyone).
• Complain to a regulator: in the UK, the Information Commission (the ICO) at ico.org.uk; in the EEA, the data protection authority where you live or work, or where you think the problem happened (list of EU authorities).

If you are in Canada

Under the Personal Information Protection and Electronic Documents Act (PIPEDA), you have the right to:

• Access your personal information, and learn how we have used it and who we have disclosed it to.
• Correction: challenge the accuracy and completeness of your information and have it amended.
• Withdraw consent, with the effects described under “If you are in Canada” in “Why we use your information”.
• Challenge our compliance: write to our Privacy Officer, who will investigate and, if your complaint is justified, put it right.
• Complain to the Office of the Privacy Commissioner of Canada.

We reply to access requests within 30 days, subject to the extension described above.

If you are in Quebec

Under Quebec's Act respecting the protection of personal information in the private sector, send your request in writing to our Privacy Officer, the person in charge of the protection of personal information, at [email protected]. You have the right to:

• Access (section 27): confirmation that we hold information about you, and a copy of it. Computerized information we collected from you (not information we created or inferred) can be given to you in a structured, commonly used technological format, or sent to a person or body authorized by law to collect it.
• Rectification (section 28): have information corrected if it is inaccurate, incomplete or equivocal, or if collecting, communicating or keeping it is not authorized by law.
• Cessation of dissemination or de-indexing (section 28.1): ask us to stop disseminating your information, or to de-index a link to it, in the cases the law sets out. We do not publish personal information, but the right applies.
• Withdraw consent to our communication or use of your information, with the effects described under “If you are in Canada” in “Why we use your information”.

On request, we will also tell you what personal information we have collected from you, which categories of people within our company have access to it, how long we keep it, and how to contact our Privacy Officer.

We reply in writing within 30 days of receiving your request (section 32). If we refuse a request, we will give you our reasons, the provision of law the refusal is based on, and the remedies available to you. If we refuse an access, rectification or de-indexing request, or do not reply within 30 days, you have 30 days to submit the disagreement to the Commission d'accès à l'information du Québec (CAI). You can also complain to the CAI at any time about how we handle your personal information.

California privacy rights (CCPA)

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with additional rights:

• Right to Know — what personal information we collect and how we use it.
• Right to Delete — request deletion of your personal information.
• Right to Opt-Out — opt out of the sale of personal information.
• Right to Non-Discrimination — we won't discriminate against you for exercising your rights.

We do NOT sell your personal information.

To exercise these rights, contact us at [email protected].

Chrome Web Store compliance

The use of information received from Google APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

Children's privacy

Send to Case is not intended for use by children under the age of 13. We do not knowingly collect personal information from children under 13.

Changes to this policy

We will update this policy when our practices change, and change the “Last updated” date at the top. If we make a material change, such as using your information for a new purpose, collecting a new kind of information, or sharing it with a new kind of recipient, we will tell you before the change takes effect: by email if you have an account, we have an email address for you, and the change affects how we use your account information, and with a notice on this page. Where a change needs your consent, we will ask for it first.

Contact us

If you have any questions about this privacy policy or our data practices, contact our Privacy Officer, Lucas Barnes, at [email protected]. Send to Case is operated by PNW Web Marketing LLC, Washington State, USA.