How we handle your information

Who we are

LiveCases.net is a Canadian startup, operated as a sole proprietorship at 17 Van Order Drive, Kingston, Ontario K7M 1B5. It runs the LiveCases service at livecases.org. For personal information collected in commercial activity, Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) applies. For any privacy question or request, email contact@livecases.org.

What we collect

Account information

Your name, email address, sign-in method (Google or email and password), terms acceptance, creator verification status and profile preferences. We use it to create and secure your account and deliver the service. Passwords are handled by our sign-in provider, Amazon Cognito; we do not store them. If you sign in with Google, Google shares your name and email with us.

Teaching content

Cases, characters, source documents, case files and teaching notes that creators write or upload. They are stored so creators can edit, publish and run sessions with them. Private objectives, teaching notes and character instructions are never shown to participants.

Conversations

Messages participants send to characters and the characters' replies. They are stored so participants can continue their conversations and the organizer running the session can review and export them.

Usage and coins

For each AI reply or case build: the model used, token counts and the coins charged. This keeps balances and charges accurate. Participants never pay; the session organizer's balance is charged.

Case creator verification

If you apply to become a verified case creator: how you intend to use LiveCases, an optional organization, a contact email address (a different address from your sign-in email is confirmed with a six-digit code), a public professional link and an optional note. We fetch that public page and an AI model summarizes it for the administrator who decides. The AI never makes the decision.

Support messages

If you email us, we keep your message and address to answer you.

Security records

Our hosting provider records technical request data, such as IP addresses, for security and troubleshooting. Administrator actions are recorded in an audit log.

Cookies and browser storage

We use one essential cookie to keep you signed in, plus short-lived cookies during sign-in, invitations and account deletion. Your browser also stores a few preferences on your device: your theme, your last sign-in method, the sidebar state and unsaved case drafts. We do not use analytics, advertising or tracking cookies.

AI processing

To generate character replies, AI case drafts and verification summaries, we send the relevant case content and conversation to OpenAI through its API, with storage of those requests disabled. We do not use your content to train AI models, and OpenAI does not use API data for training by default. Characters are simulated roles; their answers are not verified facts.

Who can see your information

• The organizer who runs a session can see its participants and read and export their conversations. Other participants cannot.
• Creators a case owner invites to collaborate can see the shared case and add their own characters. Their sessions and conversations stay private to them.
• A small number of LiveCases administrators, who sign in with multi-factor authentication, can see account details, balances and verification requests for support and review. Their actions are audited.

We do not sell your information.

Service providers

We share only what each provider needs to run the service:

• Amazon Web Services: hosting, storage, sign-in and service emails.
• OpenAI: AI replies, AI case drafts and verification summaries.
• Google: only if you choose to sign in with Google.
• Gravatar: only if you turn on a Gravatar photo. Your browser then loads the image using a hash of your email address.

Stripe processes purchases. It receives your email address, name and the billing details you enter at checkout, and handles card details; we never see or store full card numbers. We keep order and payment records, and show you the card brand and last four digits from Stripe.

How long we keep it

• Accounts, cases and content: while your account exists, or until you delete them.
• Conversations: available for 180 days after the session ends. The session page shows the date. After that, no one can view or export them, and they are deleted from our database. We keep only anonymous counts of participants and replies, and the coin records.
• Verification codes expire after 10 minutes. The fetched professional page and AI summary are deleted 90 days after the final decision; the decision itself is kept while it applies.
• When you delete your account from your profile, we remove our copy of your account, cases, sessions, conversations, files and wallet. Security audit events stay, along with a redacted marker so the email can be registered again. Stripe keeps the payment records it needs for charges, refunds and invoices. Backups, logs and provider retention are not erased at the same moment.

Your choices and rights

• Update your name and photo settings on your profile.
• Delete your account yourself from your profile.
• Organizers can download transcripts, and creators can download case exports. You can ask by email for a copy of your personal information or a correction. We answer within 30 days, or we write to say we need longer. You can also complain to the Office of the Privacy Commissioner of Canada.

International transfers

LiveCases is based in Canada. Our servers and service providers are in the United States, so your information is processed there. We do not currently have an EU representative; if you are in the EU or EEA, please do not use the service until further notice.

Changes and questions

We will post updates here and change the date above. Links to other websites are covered by their own policies. Use of LiveCases is also subject to the terms of service. Questions go to contact@livecases.org.