Privacy Notice

Last updated: 2026-10-29

Astercase is a product of Paradoc AI, Inc., a Delaware corporation ("Astercase," "we," "us"). Astercase runs on the Asterdoc platform.

This notice explains what happens to personal information in Astercase. It covers both Astercase apps, the operator app at app.astercase.com and the client portal at my.astercase.com, and the website astercase.com. It covers three groups:

  • Members: staff of an organization that uses Astercase to run cases, such as a city agency, a school, or a bank. The organization is our customer. Members use the operator app.
  • Clients: people whose intake or case an organization runs in Astercase, such as residents, applicants, or students. Clients use the client portal.
  • Visitors: people who visit astercase.com.

The organization decides how client information is used. The organization that runs a case decides what to ask its clients, why, and how the answers are used. In privacy law, it is the controller of that information. Astercase processes the information for the organization, on its instructions and under our agreement with it. In privacy law, Astercase is its processor or service provider. This applies to everything in an intake or a case: what clients enter in the client portal, uploads, messages, signatures, and payment records.

The organization's own privacy notice also applies. If you are a client, the organization's privacy notice explains how it uses your information. When the organization adds a link to its notice, the client portal shows it. You can also ask the organization for it, and you should ask it first about your case. This notice explains what Astercase does with the information for the organization.

Some information is Astercase's own. We decide how to use members' accounts, the organization's billing contacts and credit purchases, information about visitors, server logs, and the record of who accepted our Terms of Use. For this information, Astercase is the controller.

1. What we collect

Clients

  • Your name, email address, and mobile number, as the organization or you enter them.
  • Your answers to the questions in your case, in the chat or in the form.
  • Documents you upload, such as identity documents, tax forms, and bank statements. We check each upload for quality and sort it by type.
  • Your messages with the Astercase agent and with the organization.
  • Signatures and signing records: the time you signed and the device details that the signing link records.
  • Payment details for any payment you make by card. Our payment processor, Stripe, handles the card. We keep the amount and the payment status.
  • If you return to the same organization, the earlier cases it holds for you. The agent uses them to prefill your answers. You confirm them before they are used.

Members

  • Your name, email address, role in the organization, and sign-in details. We sign you in through WorkOS.
  • What you do in Astercase: changes you make to a case, decisions you record, and approvals you give.
  • If you connect your Google Workspace account, the access you grant to Gmail, Calendar, or Drive. See section 5.
  • The organization's billing email address and its credit purchases. Our payment processor, Stripe, handles the card.

Everyone who signs in

  • The date you accepted our Terms of Use, and the version you accepted.

Visitors and everyone who uses Astercase

  • Standard server logs and error reports, such as IP address, time, and pages requested.
  • The cookies needed to keep you signed in.

2. How we use it

We use this information to:

  • run the case: the agent's conversation, the upload check, forms, e-signature, payments, and delivery of the finished packet;
  • send emails about the case, such as a request to sign or a document that is ready;
  • show each case's history, which records every change and every action the agent takes outside Astercase, with screenshots;
  • keep the service secure, fix faults, and answer support requests;
  • bill the organization for credits it uses.

For information in an intake or a case, we do these things only for the organization that runs it. We do not use client information for our own purposes, except to keep the service secure, fix faults, bill the organization, and obey the law.

We do not train AI models on customer data. Your documents, answers, messages, and forms are not used to train any AI model.

3. The AI agent

Each organization has an AI agent that works for that organization. The agent reads the case, the organization's instructions, and the documents on the case. It drafts answers, checks uploads, and prepares forms.

The agent cannot send a filing, make a payment, or message a person outside the organization without a member's approval. Each outside action it takes is logged on the case with a screenshot.

4. Uploads and the upload check

Each upload is checked for quality and sorted by document type. The check is automated. A member can change any result. Nothing is deleted or rejected automatically.

5. Google Workspace connections

If an organization turns on Google connections, a member can connect their own Google Workspace account to use Gmail, Google Calendar, and Google Drive from Astercase. We connect through WorkOS, which holds the access that Google grants. We ask Google for this access only:

  • Gmail (gmail.readonly, gmail.compose): to search and read the member's email, and to draft and send messages. A message to another person is sent only after a member approves it.
  • Google Calendar (calendar.readonly, calendar.events): to check the member's availability and to put holds on their own calendar. An invitation to another person is sent only after a member approves it.
  • Google Drive (drive.readonly): to browse the member's files and copy a file the member picks into a case. A copied file gets the same upload check as any other upload.

We use this data only for the actions the member or the agent does in Astercase for the member's organization. On a client's case, the agent uses the connection of the member who owns the case. Elsewhere, it uses the connection of the member who asks. To do an action, the agent sends the data it needs to the AI model provider that runs the agent. That provider may use the data only to give us its service.

Astercase's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

  • We do not use Google user data for advertising, and we do not sell it.
  • We do not use Google user data to train generalized AI or machine learning models.
  • People at Astercase do not read Google user data, unless the member asks us to (for example, for support), we must do so for security or to obey the law, or the data is aggregated and anonymized for internal operations.

A member can disconnect the account at any time in Astercase, or remove our access in their Google account settings. Disconnecting stops our access. A file already copied into a case stays with the case and follows section 8.

6. Email

We send emails about cases, such as a request to sign, an approval that is waiting, or a document that is ready. Members set their own notification preferences in Astercase.

7. Who we share it with

  • The organization that runs your case. Its members can see your case. The organization decides how it uses your information, under its own privacy notice.
  • People you or the organization choose. For example, a signer on a document, or the other party to a payment.
  • Service providers that help us run Astercase: hosting, the database, logs and error reporting, email delivery, AI model providers, sign-in (WorkOS), payments (Stripe), and e-signature and document services on the Asterdoc platform. They may use the information only to provide their service to us.
  • Authorities, when the law requires it.

We do not sell personal information, and we do not share it for advertising.

8. How long we keep it

Each organization sets how long its closed cases are kept, from 1 to 10 years. The default is 7 years.

  • Before a closed case is deleted, the organization's Admins get a warning 30 days ahead.
  • A closed intake, which is a request that never became a case, is deleted after 90 days.
  • When an organization closes its Astercase account, we delete all its client data within 30 days. This includes open and submitted cases, intakes, uploads, and messages.
  • When a member deletes a case, it moves to the organization's Trash. Nobody sees it in Astercase, and nothing more happens on it. It stays in Trash until an Admin or a Manager restores it, or an Admin purges it. Nothing leaves Trash by itself.
  • When a case is purged, everything derived from it is deleted, including documents, signed forms, messages, and the agent's work on the case. The case history keeps a record that the deletion happened, without the content.
  • The organization's retention period and a client's approved deletion request delete the case for good in the same way, also when it is in Trash.
  • We keep a backup copy of case files so that we can restore a file that was lost by mistake. Purged files leave the backup within 1 hour.

9. Your choices and requests

Download your data. Clients can download their documents, signed forms, and messages from the client portal.

Ask for deletion. Clients can ask for their case to be deleted in the client portal. The request goes to the organization, and its Admins decide. They approve or refuse, and they give a reason. An organization may have a legal duty to keep a file, so a request can be refused.

Other requests. Depending on where you live, you can ask to access, correct, or delete your information, or to object to how it is used.

  • Information in an intake or a case: send your request to the organization that runs it, because the organization decides. Astercase helps the organization answer it. If you send such a request to us, we forward it to the organization.
  • Information Astercase controls: for a member account, billing contacts, server logs, your Terms of Use acceptance, or anything about visitors, email legal@astercase.com. We may ask you to confirm that you control the email address on the account before we act.

10. Where data is processed

Astercase and the Asterdoc platform are operated from the United States. If you use Astercase from outside the United States, your information is processed in the United States.

11. Access within Astercase

Each organization is a separate boundary. Members of one organization cannot see another organization's cases. A client sees only the cases that belong to them.

12. Changes to this notice

We post changes here and update the date at the top.

13. Contact

Paradoc AI, Inc. Email legal@astercase.com with any question about this notice.