Privacy Policy
case.global and CASE Q
Effective date: October 9, 2026
This Privacy Policy explains how we collect, use, store, share and delete information in two places:
1. The case.global website at https://case.global, our public company website
2. The CASE Q service at https://q.case.global, our in-house social media scheduling tool
The section on the website comes first. The rest of this policy covers CASE Q. Our Terms of Service at https://case.global/terms-and-conditions also apply.
Who we are
The case.global website and CASE Q are operated by CASE CREATIVE CONSULTANTS L.L.C, a limited liability company licensed by the Dubai Department of Economy and Tourism (commercial licence no. 1574265). CASE Global is our brand. In this policy, "we", "us" and "our" mean CASE CREATIVE CONSULTANTS L.L.C.
Address: Office No. B-46, Business Bay, Bur Dubai, Dubai, United Arab Emirates (Parcel ID 346-475)
Email: lee@caseglobalhq.com
Part 1: The case.global website
The case.global website is built with Hostinger Website Builder and hosted by Hostinger, our website host. The website gives information about our company. It has no signup, login, contact form or newsletter form.
Cookies: the website uses only cookies strictly needed for it to work securely. Hostinger's content delivery network sets a security cookie (named hcdn) to protect the site from automated traffic, and the network that serves the site's images and files may set a short-lived bot-protection cookie (named __cf_bm). The website does not use advertising cookies and does not run Google Analytics, Meta Pixel or other tracking scripts. Hostinger's website builder includes optional platform analytics, which run only if you accept them in a cookie banner.
Fonts: the website's fonts are delivered by Hostinger's content delivery network and by Google Fonts. To load them, your browser connects to those servers, which receive your IP address.
Server logs: to deliver and protect the website, Hostinger processes technical data such as your IP address, browser type, the pages you request and the time of each request. Hostinger handles this data under the Hostinger Privacy Policy: https://www.hostinger.com/legal/privacy-policy.
Emailing us: the website's "Contact us" button opens your own email app. If you email us, we use your name, email address and message only to reply to you, and we keep them only as long as needed to deal with your enquiry and any follow-up.
The sections on your rights, international transfers, changes and contact at the end of this policy also apply to the website.
Part 2: The CASE Q service
What CASE Q is
CASE Q is an in-house tool that our staff use to schedule and publish content for CASE Global clients under their client agreement with us. It is not a public product and there is no public signup. Only authorised CASE CREATIVE CONSULTANTS L.L.C staff sign in to CASE Q. Clients do not log in to CASE Q.
Clients authorise their own social accounts through each network's official sign-in process. A CASE staff member starts the connection in CASE Q, and the account holder signs in on the network's own consent screen and approves the permissions listed below. CASE Q never sees or stores the account holder's social media password. For Bluesky, the account holder creates an app password for CASE Q. For Telegram, the client adds the CASE Q bot to their chat or channel.
For the content and accounts we manage for clients in CASE Q, we act on our clients' instructions under their client agreement. CASE Q does not scrape websites or use unofficial automation.
Information we collect
Staff sign-in
The work email address of each authorised staff member who signs in, and a record of which staff member took review actions in Engage (for example, approving a draft)
Connected social accounts
The account identifiers the network returns when an account is connected, such as account or channel ID, username or handle, display name and profile picture
Access tokens and refresh tokens, or the equivalent credential a network uses (such as a Bluesky app password). These are encrypted at rest and are never shown in CASE Q.
Content we schedule
Media files (images and videos), captions, titles, descriptions, hashtags, privacy and disclosure settings, and scheduled publish times
Media that CASE staff pick up from shared folders in our own Google Drive (see "Google Drive" below)
Publishing results and post performance
The post or video ID the network returns, the post link, the publish status and any error message
For posts CASE Q published on X, YouTube and Bluesky, public performance counts the network provides, such as likes, views, comments and shares
Engage (X only)
For the Engage feature: public details of the X posts a suggested comment would respond to (the post text and link, the author's public username and follower count, and public like, repost, reply, quote and impression counts), the tone and audience tags set for the client's account, and the AI-drafted suggestions with their review status (see "AI-assisted drafting" below)
Basic logs
Technical logs of requests, errors and publishing jobs, used to run, secure and fix CASE Q. Access tokens, app passwords, bot tokens and other credentials are redacted from logs and from stored error messages.
What we do not collect
Social media passwords
Direct messages or private conversations
Private data about the people who follow our clients' accounts
Comments, watch history, subscriptions or YouTube Analytics reports. The only content from other people's accounts CASE Q reads is public X posts used by Engage.
Payment card details (CASE Q does not take payments)
Cookies and browser storage in CASE Q
CASE Q uses only essential, first-party cookies, set for signed-in staff: a sign-in cookie that lasts up to 12 hours, and short-lived security cookies (10 minutes) used while an account is being connected. CASE Q also uses the browser's local storage to remember screen preferences, such as the client last selected and alerts dismissed. CASE Q does not use analytics, advertising or cross-site tracking cookies, and does not load third-party analytics scripts.
How we use information
We use information only to:
Let authorised staff sign in and work on the right client
Connect the client's own social accounts
Schedule and publish the client's approved content to the accounts the client connected
Show which account is connected, the status of each post, and how published posts are performing
Draft suggested X comments for staff review through Engage
Keep CASE Q secure, prevent misuse and fix problems
Meet legal obligations
We do not:
Sell information or rent it to anyone
Use information from social network APIs for advertising, ad targeting or profiling
Share information with data brokers
Use information from social network APIs to train artificial intelligence or machine learning models, or allow our AI provider to do so
Send any data received from YouTube API Services, Google Drive or any other Google API to OpenAI or any other AI model
Use one client's data for another client
CASE staff view connected-account data only when needed to provide the service the client asked for, for security, or where the law requires.
AI-assisted drafting (Engage)
CASE Q's Engage feature uses AI to help draft suggested comments on public X posts. It works like this:
What is sent to the AI: only the text of the public X post, and the tone and audience tags set for the client's account. Nothing else.
What is never sent to OpenAI or any AI model: the post author's handle or any other usernames; access tokens, refresh tokens, app passwords or other credentials; private account data such as direct messages; and any data received from YouTube API Services, Google Drive or any other Google API.
The AI provider: OpenAI, through the OpenAI API (model gpt-4o-mini), under our own OpenAI API account. OpenAI acts as our service provider for this purpose.
Human review: every draft is only a suggestion. CASE Q never posts Engage comments. A CASE staff member reviews each draft, approves or skips it, and posts any reply themselves on X.
Training: under OpenAI's API terms, data sent through the OpenAI API is not used to train OpenAI's models by default, and we have not opted in to share data with OpenAI for training. OpenAI may keep API inputs and outputs for up to 30 days to monitor for abuse. See OpenAI's business data commitments at https://openai.com/business-data/ and OpenAI's API data controls at https://platform.openai.com/docs/guides/your-data.
Network-by-network details
Each network also processes data under its own terms and privacy policy. We request only the permissions CASE Q needs.
Meta: Instagram and Threads
CASE Q uses the official Instagram API and Threads API. Instagram publishing works with Instagram professional (Business or Creator) accounts only.
Permissions we request
instagram_business_basic: to identify the Instagram professional account that was connected (account ID, username, name and profile picture) and attach it to the right client
instagram_business_content_publish: to publish the approved posts to that account
threads_basic: to identify the Threads profile that was connected
threads_content_publish: to publish the approved Threads posts to that profile
What we store: account IDs, usernames, an access token encrypted at rest, and the IDs, links and status of posts CASE Q published.
Meta deauthorization and data deletion:
If you remove CASE Q from your Instagram or Threads settings, Meta tells CASE Q and CASE Q deletes the stored token for that account straight away.
If you ask Meta to delete your data, CASE Q deletes your Instagram and Threads accounts from CASE Q, together with their tokens and the post IDs and links it holds for them. This normally happens as soon as Meta's request arrives, and in any case within 7 days. Meta gives you a confirmation code and a link where you can check the status of the request.
Meta's policies:
Meta Privacy Policy: https://www.facebook.com/privacy/policy/
Instagram Terms of Use: https://help.instagram.com/581066165581870
Threads Terms of Use: https://help.instagram.com/769983657850450
Threads Supplemental Privacy Policy: https://help.instagram.com/515230437301944
Meta Platform Terms: https://developers.facebook.com/terms/
Google and YouTube
CASE Q uses YouTube API Services. When a client connects a YouTube channel, CASE Q asks Google for two permissions only:
Manage your YouTube videos (youtube.upload): used only to upload the client's approved videos, with the title, description, privacy setting (public, private or unlisted) and publish time set in CASE Q before upload.
View your YouTube account (youtube.readonly): used only to show which channel is connected, so the right channel can be confirmed before anything is uploaded, and to show the status and public statistics (views, likes and comment counts) of videos CASE Q uploaded.
What we store: the YouTube channel ID and channel name, the IDs, links, status and public statistics of videos CASE Q uploaded, and an OAuth token encrypted at rest. We do not store your Google password. We do not read your subscriptions, playlists, comments, watch history or YouTube Analytics reports.
How we use and share it: only to provide the scheduling, upload and reporting features the client asked for. Video statistics are shown to CASE staff and made available to OSCodex, CASE Global's internal planning system at os.caseglobalhq.com, for reporting to the client. We do not sell this data, transfer it to advertising platforms, data brokers or information resellers, use it for advertising, use it to decide credit-worthiness or for lending, or use it to train AI models. Our staff do not view this data except to provide the features the client asked for, for security (for example, investigating abuse), or to comply with the law.
Limited Use: CASE Q's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.
Google's policies: Google's handling of your data is covered by the Google Privacy Policy: https://policies.google.com/privacy (also at http://www.google.com/policies/privacy). By connecting a YouTube account to CASE Q, you agree to be bound by the YouTube Terms of Service: https://www.youtube.com/t/terms.
Revoking access: the client can ask us to disconnect YouTube at any time. In addition to CASE Q's normal deletion process, you can revoke CASE Q's access to your Google data at any time through your Google security settings at https://myaccount.google.com/permissions (also at https://security.google.com/settings/security/permissions).
Deleting YouTube data:
When YouTube is disconnected in CASE Q, CASE Q cancels the channel's queued posts, revokes the token with Google, and deletes the stored token, the channel ID, handle and picture, and the video IDs and links from its active systems straight away, well within 7 days.
If you ask us to delete your YouTube data, we disconnect the channel, which deletes that data from CASE Q's active systems within 7 days.
If you revoke access through Google's security settings instead, CASE Q deletes the stored token as soon as Google refuses it. A daily cleanup then deletes the channel ID, handle and picture, and the video IDs and links, once more than 30 days have passed since CASE Q detected the revocation.
Copies in our encrypted backups roll off automatically within about 10 days (see "Backups").
Deleting data stored by CASE Q does not affect anything stored on YouTube. To delete a video from YouTube, use YouTube Studio or the YouTube app.
Google Drive (CASE staff only)
Google Drive in CASE Q is a staff tool on our own Google Workspace (caseglobalhq.com). Clients upload content to shared folders in our Drive. Clients never connect their own Google Drive to CASE Q.
Who connects it: only authorised CASE staff, using their caseglobalhq.com Workspace accounts. CASE Q uses a separate Google OAuth client for Drive that is limited to our Workspace, and it refuses any sign-in from an account outside caseglobalhq.com.
Permissions: Google Drive access (drive), plus your email address (userinfo.email) and basic sign-in (openid) so CASE Q can confirm the connected Workspace account.
What it is used for: to list the folders staff choose, download the approved media in them for scheduled posting, and move each file into a "posted" folder once it has been published.
What we store: the connected staff email address, an OAuth token encrypted at rest, the chosen folder names and paths, and the names and IDs of files scheduled for posting.
No AI: data from Google Drive is never sent to OpenAI or any other AI model.
Disconnecting: when staff disconnect Drive, CASE Q revokes the token with Google and deletes the stored connection.
The Limited Use statement above also applies to Google Drive data.
TikTok
CASE Q uses TikTok Login Kit and the TikTok Content Posting API (Direct Post).
Permissions we request
user.info.basic: to identify the TikTok account that was connected (open ID, display name and avatar)
video.upload: to upload the approved video to that account
video.publish: to publish the approved video to that account
Before each TikTok post, CASE Q shows TikTok's privacy and content disclosure options (including branded content and commercial content disclosure) so the correct settings are chosen.
What we store: the TikTok open ID and display name, an access token and refresh token encrypted at rest, and the IDs and status of videos CASE Q posted.
TikTok's policies:
TikTok Privacy Policy: https://www.tiktok.com/legal/page/row/privacy-policy/en
TikTok Terms of Service: https://www.tiktok.com/legal/page/row/terms-of-service/en
TikTok Developer Terms of Service: https://www.tiktok.com/legal/page/global/tik-tok-developer-terms-of-service/en
TikTok Branded Content Policy: https://www.tiktok.com/legal/page/global/bc-policy/en
X (formerly Twitter)
CASE Q uses the X API v2 with OAuth 2.0 (PKCE).
Permissions we request
users.read: to identify the X account that was connected (user ID, username and name)
tweet.write: to publish the approved posts to that account
media.write: to upload the images and videos attached to the client's approved posts
tweet.read: to read back posts CASE Q published so their status and public counts can be shown, and to find the public X posts used by Engage
offline.access: to keep the connection working without signing in again each time
CASE Q does not access direct messages and does not follow, like or repost. CASE Q never posts Engage comments: staff post any approved reply themselves on X.
What we store: the X user ID and username, an access token and refresh token encrypted at rest, the IDs, links, status and public counts of posts CASE Q published, and for Engage, the public post details and draft suggestions described above.
X's policies:
X Privacy Policy: https://x.com/en/privacy
X Terms of Service: https://x.com/en/tos
X Developer Agreement: https://docs.x.com/developer-terms/agreement
X Developer Policy: https://docs.x.com/developer-terms/policy
Bluesky
CASE Q connects to Bluesky through the AT Protocol using an app password that the account holder creates in Bluesky's settings. An app password is not the main Bluesky password, and it can be deleted at any time in Bluesky's settings.
What we access and why: the Bluesky handle and account identifier (DID), to show which account is connected; permission to create posts, to publish the approved posts; and the public counts of posts CASE Q published.
What we store: the handle and DID, the app password (encrypted at rest), and the IDs, status and public counts of posts CASE Q published. CASE Q does not store Bluesky session tokens. Posts on Bluesky are public by design.
Bluesky's policies:
Bluesky Privacy Policy: https://bsky.social/about/support/privacy-policy
Bluesky Terms of Service: https://bsky.social/about/support/tos
Bluesky Community Guidelines: https://bsky.social/about/support/community-guidelines
Telegram
CASE Q publishes to Telegram chats and channels through the Telegram Bot API, using the CASE Q bot. CASE Q can post only where the client has added the bot and given it permission to post. Clients do not give us a bot token. The CASE Q bot token is held by us as the operator and is encrypted at rest.
Disconnecting a Telegram chat or channel in CASE Q cancels its queued posts and stops CASE Q from posting there. The client can also remove the bot from the chat or channel at any time.
What we store: the chat or channel ID and name, and the IDs and status of messages CASE Q posted. CASE Q does not store member lists, other people's messages or private chats.
Telegram's policies:
Telegram Privacy Policy: https://telegram.org/privacy
Telegram Terms of Service: https://telegram.org/tos
Telegram Bot Platform Developer Terms: https://telegram.org/tos/bot-developers
Media storage
Media for CASE Q is kept in private storage. Staff see it only through CASE Q while signed in. When a network fetches media itself (Instagram, Threads, and TikTok photos), CASE Q gives it a time-limited link that expires within 2 hours. For the other networks, CASE Q sends the file directly. When staff delete a media file that no post uses, CASE Q deletes it from storage.
Disconnecting an account
The client can ask us to disconnect any connected account at any time, and CASE staff can disconnect it in CASE Q. When an account is disconnected, CASE Q:
1. Cancels any posts still queued for that account, on every network
2. For X, YouTube, Instagram, Threads and TikTok, revokes the access token with the network
3. Deletes the stored access token, refresh token or other credential for that account (for Bluesky, the stored app password)
4. For YouTube, deletes the channel and video identifiers at the same time
5. For Telegram, stops posting to that chat or channel
Posts already published stay on the network until they are deleted there. You can also remove access yourself on the network: remove CASE Q in your Instagram, Threads, Google or TikTok settings, revoke the app in your X settings, delete the app password in Bluesky's settings, or remove the CASE Q bot from your Telegram chat or channel.
Retention and deletion
We keep CASE Q data only as long as needed to provide the service to the client. When we receive a written request, or when the client engagement ends, our staff delete that client's account and client data from CASE Q, including connected accounts, posts, captions, media files and Engage records. This is a manual process that we commit to completing within 30 days. Some data is deleted sooner:
Access and refresh tokens and other credentials are deleted straight away when the account is disconnected, when Meta reports a deauthorization, or when Google refuses a YouTube token.
YouTube API data (channel ID and name, video IDs and links) is deleted straight away on disconnect or a deletion request, well within 7 days. After a revocation through Google's settings, a daily cleanup deletes it once more than 30 days have passed since CASE Q detected the revocation.
Instagram and Threads data is deleted as soon as Meta sends a data deletion request, and in any case within 7 days.
Unused media files are deleted from storage when staff delete them.
All other account and client data is kept only as long as needed to provide the service, and deleted within 30 days of a written request or the end of the client engagement.
We may keep specific information longer only where the law requires it, and only for as long as it requires.
Backups: deleted data may remain in our encrypted backups, which roll off automatically within about 10 days. During that time it is not used or restored for any other purpose.
How to request deletion: email lee@caseglobalhq.com and tell us which account or data you want deleted. We will confirm and complete the deletion within the timelines above. Deleting data from CASE Q does not delete posts already published on a network. To remove a published post, delete it on that network.
Sharing
We do not sell personal information. We share information only with:
The social networks the client connects, when CASE Q publishes a post or checks its status and public counts
Service providers who run CASE Q for us, such as hosting, database, file storage and email providers. They process information only on our instructions, to provide their service to us, and must keep it secure and confidential.
OpenAI, as our AI service provider for Engage only, receiving only the text of public X posts and the client's tone and audience tags, as described under "AI-assisted drafting"
OSCodex, CASE Global's internal planning system, which receives post status and public performance counts for reporting to the client
Hostinger, as host of the case.global website, as described in Part 1
Authorities or others where the law requires it, or where needed to protect the security of CASE Q, our clients or the public
A buyer or successor, if our business is merged, acquired or sold. Any transfer of data received from Google APIs in that case will happen only after obtaining your explicit prior consent.
Security
We protect information with measures appropriate to the risk, including:
Access tokens, refresh tokens, app passwords and the Telegram bot token are encrypted at rest
Credentials are redacted from logs and stored error messages
Media is kept in private storage and shared with networks only through time-limited links
Encrypted (HTTPS) connections
Sign-in limited to authorised CASE staff
Staff access to client data only where needed
No system is completely secure. If a security incident affects personal information, we will tell affected clients and the relevant authorities where the law requires it.
International transfers
We are based in the United Arab Emirates. Our service providers (including Hostinger and OpenAI) and the social networks may process information in other countries, including the United States. When information is transferred outside the country where it was collected, we take steps required by applicable law to keep it protected, such as contractual safeguards with our service providers.
Your rights
Depending on where you live, data protection laws (including the UAE Personal Data Protection Law, the EU and UK General Data Protection Regulation, and similar laws) may give you the right to:
Access the personal information we hold about you
Correct inaccurate information
Delete your information
Object to or restrict how we use it
Receive a copy of your information in a portable format
Withdraw consent where we rely on consent
To use any of these rights, email lee@caseglobalhq.com. We will respond within 30 days, and handle deletion requests within the timelines under "Retention and deletion". If your information is held on behalf of a client, we may involve that client. You may also complain to your local data protection authority.
We process information to perform our client agreements, for our legitimate interest in running a secure service, to meet legal obligations, and with consent where an account is connected.
Children
CASE Q is a business tool used only by our staff, for business clients. It is not intended for anyone under 18. Our clients' audiences and followers do not sign up for or use CASE Q. We do not knowingly collect personal information from children.
Changes to this policy
We may update this policy. We will post the new version on this page with a new effective date and tell clients about significant changes. If we change how CASE Q uses data received from a network, such as Google user data, we will update this policy and ask for consent before using the data in the new way.
Contact
Operator: CASE CREATIVE CONSULTANTS L.L.C
Address: Office No. B-46, Business Bay, Bur Dubai, Dubai, United Arab Emirates (Parcel ID 346-475)
Email: lee@caseglobalhq.com
Please contact us with any questions or complaints about our privacy practices.