Privacy Policy

Graviton Ventures FZ-LLC, a free zone company registered in Dubai, United Arab Emirates, operating CaseFinder.co, is the controller of the personal data described in this policy.

If you have any question about this policy or your data, you can contact us at the address in section 14.

This policy applies whenever you visit CaseFinder.co, create an account, submit a case study, contact a contributing organisation, subscribe to communications, or otherwise interact with us.

Data you give us. Account data such as your name, work email address, organisation name, job title, country, and sectors of interest; the content you submit as part of a case study, including the organisation described and supporting source links; contact and partnership enquiries; and any correspondence you send us.

Data we collect automatically. Pages viewed, cases opened, searches run, filters applied, referring URL, time spent, IP address, approximate location, browser type, operating system, device type, and language.

Data from other sources. For AI-generated case studies we compile publicly available information from sources such as annual reports, press releases, regulatory filings, and news coverage. Where you sign in using an authentication provider, we receive your name, email address, and profile identifier.

We do not knowingly collect special category data (such as health, religious beliefs, or racial origin), and it should not be submitted in case studies. We do not collect payment card data directly.

Case studies are designed so readers can reach the organisations behind them. A published case may therefore display the name, job title, and business contact details of a designated contact at the contributing organisation.

If you are named in a published case study and want your details corrected or removed, contact us at the address in section 14. We will unpublish the affected contact details on request pending review.

We process personal data for the following purposes:

• To create and administer your account (contract performance).
• To publish and maintain the Register of case studies (legitimate interests; consent where an individual is identifiable).
• To verify case studies before publication (legitimate interests — accuracy and integrity).
• To compile AI-generated case studies from publicly available sources (legitimate interests — documenting organisational practice).
• To generate cross-case analysis, benchmarks, and statistics (legitimate interests — deriving comparative insight).
• To route contact enquiries to contributing organisations (contract performance).
• To improve and secure the Platform (legitimate interests).
• To send service messages such as submission status, security notices, and terms changes (contract performance; legal obligation).
• To send newsletters and marketing, where you have consented (consent).

Where we rely on legitimate interests, we have assessed that our interest does not override your rights. Where we rely on consent, you may withdraw it at any time without affecting processing already carried out.

Compiling case studies. AI-generated case studies are drafted by large language models from publicly available sources. Each is labelled on the Platform and carries a credibility score — an automated indicative assessment of source quality and internal consistency, not a verification.

Cross-case analysis. We use automated analysis across the Register to identify recurring challenges, common solutions, and emerging patterns. Recommendations. We use automated similarity matching to suggest related cases.

We do not use automated processing to make decisions producing legal effects concerning you or similarly significantly affecting you. Where a decision to publish or reject a case study is automated, you may request human review at the address in section 14.

Contributing organisations. When you contact a contributing organisation, we pass your enquiry and contact details to that organisation.

Service providers. We work with third-party providers for application hosting, data storage, email delivery, analytics, and AI processing. These act as our processors and are bound by contractual obligations to protect your data.

Publicly. Case study content, including designated business contact details, is published on the Platform and is accessible to anyone, including search engines.

Advisers, authorities, and acquirers. Where necessary for legal advice, to comply with law or a valid request from a competent authority, to establish or defend legal claims, or in connection with a merger, acquisition, or sale of assets.

We do not sell personal data, and we do not share it for cross-context behavioural advertising.

We are established in the United Arab Emirates. If you are in the EEA or UK, your data may be transferred outside those areas. Such transfers rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses or the UK International Data Transfer Addendum, together with a transfer risk assessment.

For transfers out of the UAE, we rely on the mechanisms permitted under PDPL Articles 22 and 23. You may request a copy of the safeguards in place at the address in section 14.

We use the following categories of cookies:

• Strictly necessary — for authentication, security, and core functionality; consent is not required.
• Preference — for language, saved filters, and similar preferences; consent required.
• Analytics — to understand how the Platform is used; consent required.

Where you are in the EEA or UK we ask for consent before setting non-essential cookies, and we do not treat continued browsing as consent. You can change your choices at any time through your browser settings.

Subject to conditions and exemptions in the applicable law, you may:

• Access — obtain confirmation of whether we process your data and a copy of it.
• Rectify — have inaccurate data corrected and incomplete data completed.
• Erase — have data deleted where there is no continuing lawful basis.
• Restrict — limit how we process your data in certain circumstances.
• Object — object to processing based on legitimate interests, and to direct marketing at any time.
• Port — receive data you provided in a structured, machine-readable format.
• Withdraw consent — at any time, without affecting prior processing.
• Not be subject to automated decision-making producing legal or similarly significant effects.
• Complain — to a supervisory authority (section 14).

Under the UAE PDPL you additionally have the right to request that processing be stopped and to require that we cease processing for direct marketing.

Under the CCPA/CPRA, if you are a California resident, you may request disclosure, deletion, and correction of your personal information and limit use of sensitive personal information. We do not sell or share personal information as those terms are defined.

To exercise any right, contact us at the address in section 14. We will respond within 30 days and may ask for information to verify your identity. Where personal data forms part of a published case study, erasure may require unpublishing the case.

We retain personal data only as long as necessary for the purposes described in this policy:

• Account data — while your account is active, then up to 12 months.
• Published case studies — while published; a record of existence and withdrawal retained indefinitely for citation integrity.
• Withdrawn or rejected submissions — up to 12 months.
• Contact enquiries — up to 24 months.
• Usage and technical data — up to 14 months.
• Correspondence — up to 36 months.
• Records required for legal or tax purposes — as required by applicable law.

We may retain data longer where necessary to establish, exercise, or defend legal claims.

We implement technical and organisational measures appropriate to the risk, including encryption in transit and at rest, access controls on a least-privilege basis, hashed passwords, logging and monitoring, and regular backups. No system is completely secure. Where a breach is likely to result in a risk to your rights, we will notify the relevant supervisory authority and affected individuals as required by applicable law.

The Platform is intended for professional use and is not directed at anyone under 18. We do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

Contact us first at the address below — we would rather resolve any concern directly. You also have the right to complain to a supervisory authority in your jurisdiction.

Graviton Ventures FZ-LLC · Dubai, United Arab Emirates

We may update this policy. Where changes are material we will notify registered users by email at least 30 days before they take effect and post a notice on the Platform. The current version and its last-updated date are always at the top of this page.