Privacy Policy

Last updated: July 23, 2026

This policy covers all CaseMargin products: the standalone web app at casemargin.com, the Zendesk Marketplace app, and the Chrome extension.

What CaseMargin does with your data

When you submit ticket text to CaseMargin, the text is sent to our server, forwarded to OpenAI's API for analysis, and the structured brief is returned to your browser. That is the entire data flow for the core product.

What is stored on our server

• Account records — email address (for email-verified accounts) or Zendesk account subdomain (for Zendesk installs). Used to identify your account and track usage against your monthly quota.
• API keys — generated at signup, stored as hashed identifiers. Used to authenticate requests.
• Usage counts — the number of briefs generated per account per billing period. No ticket content is stored alongside the count.
• Feedback — if you rate a brief (thumbs up or down) or leave a comment, that rating, the optional comment text, and the ticket ID are stored. The ticket content itself is not stored.
• Generated briefs (signed-in accounts only) — when you generate a brief while signed in with an API key or through the Zendesk app, the resulting brief is saved to your workspace so it appears in your team's shared history. This is the structured brief only — the ticket text it was generated from is never saved. Briefs generated anonymously (without an account) are never saved.
• Workspaces — every account belongs to one workspace, and each workspace has a single invite link. Members of a workspace can read every brief saved to that workspace, including briefs their teammates generated. Joining a workspace via an invite link is how you consent to sharing your saved briefs with its other members.

What is NOT stored on our server

• Ticket text — the content you paste or that the Zendesk app reads is sent to OpenAI for processing and returned as a brief. It is not written to our database, not logged, and not retained after the response is returned. This applies to shared workspace history too: your team sees the brief, never the original thread.
• Anonymous briefs — briefs generated without an account are returned to your browser and not stored server-side.
• Browsing activity — the Chrome extension does not read, monitor, or access any web page content. It operates entirely within its own side panel.

What is stored in your browser

• API key — saved in localStorage so you don't have to re-enter it each session. Stays on your device, never sent anywhere except to casemargin.com to authenticate your requests.
• Cached briefs — the Chrome extension and standalone web app cache the most recent brief in localStorage so it persists when you close and reopen the panel. This data never leaves your browser.
• Brief history — the standalone web app also keeps a copy of your recent briefs in localStorage for quick offline access. This local copy stays on your device. It is separate from the workspace history described above, which is stored on our server for signed-in accounts.

Third-party services

• OpenAI — ticket text is sent to OpenAI's API (model: GPT-4.1) to generate the brief. OpenAI's API data usage policy states that data sent through the API is not used to train their models. See OpenAI's enterprise privacy page.
• Resend — used to send email verification messages when you sign up for an API key. Receives your email address for delivery purposes only.
• Cloudflare — our server is accessed through a Cloudflare Tunnel. Cloudflare processes requests in transit (standard CDN/proxy behavior) but does not store ticket content.
• Google Fonts — the interface loads typefaces from Google Fonts. Google may collect standard web request metadata (IP address, browser type) as part of serving the fonts. See Google Fonts privacy FAQ.
• Google Ads — we use Google Ads conversion tracking to measure the performance of our ad campaigns. This sets cookies and shares limited interaction data (e.g. that an ad was clicked and a signup followed) with Google. See how Google uses advertising cookies.
• Microsoft Clarity — we use Microsoft Clarity to understand how visitors use casemargin.com (pages viewed, clicks, scrolling, general location, device and browser type), including aggregated heatmaps and session replays. This sets cookies and shares usage data with Microsoft. See Microsoft's privacy statement.

Cookies

casemargin.com uses cookies for Google Ads conversion tracking and Microsoft Clarity analytics. How consent is handled depends on where you are:

• EU, EEA, United Kingdom and Switzerland — these cookies are not set until you accept them. On your first visit a banner asks you to accept or reject; if you reject, no advertising or analytics cookies are set. Your choice is remembered in your browser (via localStorage, not a cookie) so you aren't asked again.
• Elsewhere (e.g. United States, Canada, Australia) — these cookies are enabled by default, consistent with local law. You can still opt out at any time using browser-level controls, an ad or tracker blocker, or the Google controls below.

Your region is determined from your IP address at the network (Cloudflare) level. You can change a remembered choice by clearing your browser's site data for casemargin.com. Browser-level controls (e.g. Google Ads Settings) also let you opt out of personalized advertising directly with Google.

Zendesk app: what it accesses

The Zendesk sidebar app reads the following data from the ticket you're viewing, solely to assemble the transcript that gets analyzed:

• Ticket subject, status, priority, type, tags, channel, timestamps
• All comments (public and internal), including author name and role
• Requester name, email, role, organization, account tenure
• Requester's recent ticket history (count and IDs of open tickets)
• Assignee name and group

This data is assembled into a text transcript, sent to our server for analysis, and not stored after the brief is returned. The Zendesk account subdomain is stored to track usage and quota.

Chrome extension: what it accesses

• Side Panel permission — the extension's interface runs in Chrome's side panel. It does not inject scripts into web pages or read page content.
• Clipboard Read permission — used only when you click the "Paste from clipboard" button. The clipboard is never read automatically or in the background.
• Network access to casemargin.com — the extension sends ticket text to casemargin.com/analyze and reads usage data from casemargin.com/usage. No other domains are contacted by the extension.

Data retention

Account records, usage counts, feedback, and saved workspace briefs are retained indefinitely. There is currently no automatic deletion schedule. If you want your account and associated data deleted, email the address below and it will be removed within 7 days. Note that briefs you saved to a shared workspace remain visible to that workspace's other members until they are deleted — email us if you need briefs removed from a workspace.

Browser-side data (cached briefs, API keys, history) is controlled entirely by you. Clear your browser's localStorage or uninstall the extension to remove it.

Data location

The CaseMargin server runs in Spain. Requests are routed through Cloudflare's global network. Ticket text sent for analysis is processed by OpenAI, whose infrastructure is located in the United States.

Children

CaseMargin is a workplace tool for support teams. It is not intended for use by anyone under 16.

Changes to this policy

If this policy changes, the updated version will be published at this URL with a new "last updated" date. Material changes that affect how ticket data is handled will be communicated through the product interfaces (the Zendesk app, the Chrome extension, or the web app).