CasefilePrivacy Policy
Updated 12 October 2026
Who handles your data, what we do with it, how long we keep it, and how to get it removed.
Who we are
Casefile is operated by The Ancoats Digital Agency Limited, registered in England and Wales, company number 15918159, at 5 Piccadilly Place, Aytoun St, Manchester M1 3BR.
We are registered with the Information Commissioner's Office under registration number ZB806043.
For anything in this policy, contact marvel@gocasefile.com or 0161 850 1790.
Our role, and your broker's
This distinction matters, so it comes first.
If you are a mortgage applicant, your broker decides what documents to ask you for and what to do with them. In data protection terms your broker is the controller and Casefile is the processor. We handle your documents on their instructions and for no other purpose. If you want your data corrected or deleted, your broker is the right place to start, and we will help them act on it.
If you are a brokerage using Casefile, you are the controller for your applicants' data. You are also the controller for your own staff account data.
What we handle, and why
From applicants, through your broker: your name, email address, employment type, the documents you upload, and the information we read from them. Documents typically include bank statements, payslips, SA302s, P60s, passports or driving licences, utility or council tax bills, and credit reports. These contain financial information and identity document numbers, and may include your National Insurance number, which we read from payslips and tax documents rather than asking you for it.
We use this only to check your documents against the requirements your broker set, to check them against each other, and to show your broker the result. We do not use your documents to train artificial intelligence models, ours or anyone else's.
From brokers: name, work email address, phone number, brokerage, profile image, and a record of actions taken in the service.
Automatically: sign-in records, IP address, browser type, and an audit log of every document uploaded, checked, approved or rejected.
Lawful basis
For applicant data, your broker sets the lawful basis, usually the performance of a contract with you or their legitimate interest in assessing your mortgage application. Identity documents and financial records are not special category data under UK GDPR, but we treat them as sensitive because the harm from disclosure is high.
For broker account data, our basis is the performance of our contract with the brokerage. For security logs, our basis is our legitimate interest in keeping the service secure.
How long we keep things
| What | How long | Counting from |
|---|---|---|
| Uploaded documents | 90 days | The application being archived |
| Values read from documents | 12 months | The application being archived |
| Audit log of actions | Six years | The action |
| Broker account data | The contract, then 12 months | The contract ending |
| Sign-in and security logs | 12 months | The event |
Deletion is automatic, not on request. A brokerage can ask for shorter periods. We do not offer longer ones, because Casefile is not intended to be anyone's system of record: your broker's own system holds the long-term file.
Where your data is
Your documents never leave the United Kingdom. They are stored in Amazon Web Services' London region, and any automated reading of them happens in the same region.
Account information, meaning your name and email address, is handled by Clerk and SendGrid, both based in the United States. These transfers are covered by the UK International Data Transfer Addendum. Your documents are never sent to either of them.
| Who | What they do | Where |
|---|---|---|
| Amazon Web Services | Database, document storage, automated document reading | London, eu-west-2 |
| Clerk | Sign-in and account security | United States |
| SendGrid, a Twilio company | Invitation and notification emails | United States |
We tell brokerages before adding or changing a sub-processor.
Who sees what
Your broker sees your documents. Nobody else does.
If you are applying jointly, you and the other applicant have separate document lists. You cannot see their documents and they cannot see yours. This is enforced in the database itself, not only in the screens.
Our staff do not routinely access applicant documents. Access is possible only for a named engineer, only to resolve a fault, only with the brokerage's knowledge, and every access is logged.
We never sell data and we never share it for advertising.
Your rights
You can ask for a copy of your data, ask for it to be corrected, ask for it to be deleted, object to processing, or ask us to restrict it. Because your broker is the controller, ask them first and they will instruct us. If you cannot reach them, contact us at marvel@gocasefile.com and we will help.
You can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Cookies
Inside Casefile itself we use only the cookies needed to run the service, such as keeping you signed in. There is no advertising or analytics tracking anywhere in the applicant portal or the broker portal.
On our public website we use Google Analytics to see how people find us, and a Meta advertising tag. Neither is set unless you accept it when you first visit, and you can change your mind at any time.
Changes
We post changes here and tell brokerages directly when anything material changes. The date at the top shows the current version.
More detail on how documents are stored and checked is in Data Security.