What we receive, why we use it, and who controls it.

Metatheria, LLC, doing business as Clark Management Consulting (collectively, “Metatheria,” “we,” “us,” or “our”), provides Open Case Management (“OCM”). This notice applies when we determine how personal information is handled through this website, customer administration, billing, support, and a Metatheria-hosted OCM deployment.

Each customer organization controls the client, matter, staff, and other operational records entered into its OCM instance. For that information, we act on the organization’s instructions under our agreement with it. A request about those records should ordinarily go first to that organization.

The mobile privacy policy describes information handled specifically by the iPhone, iPad, and Android apps.

Information you provide

• Name, organization, work email, telephone number, staff count, current system, and message submitted through the contact form.
• Customer-administrator identity, email, organization, role, account, subscription, and service-configuration information.
• Support correspondence and diagnostic information you choose to provide.
• Payment and transaction details supplied to Stripe. We receive transaction identifiers, status, plan, and billing contact information; Stripe receives payment-card details.

Information generated through use

• IP address, user agent, request time, requested URL, security events, and operational logs.
• An opaque, essential session identifier stored in a secure browser cookie for signed-in customer administration.
• Aggregate or cookieless website measurements and a contact-submission event that is sent without form fields.
• On public marketing pages, session-replay events such as clicks, scrolling, navigation, viewport, and page-layout changes. Visible text, form values, images, network data, and console logs are blocked in the browser before replay data is sent.
• Provisioning, subscription, audit, and support records needed to operate a customer service.

Customer-controlled OCM data

A hosted OCM instance may contain client and contact information, case or matter records, documents, activities, notes, communications, audit data, and other information selected by the customer. The customer decides what is entered, who may access it, applicable retention, and which optional integrations are enabled.

• Respond to inquiries, provide demonstrations, establish accounts, and communicate about requested services.
• Authenticate users; provision, host, secure, back up, maintain, support, bill for, and improve the service.
• Detect abuse, investigate incidents, enforce agreements, preserve service integrity, and comply with law.
• Measure site reliability and basic engagement without building advertising profiles.
• Use customer-controlled OCM data only to provide and support the service, follow the customer’s instructions, or meet legal obligations.

We do not sell personal information, use customer case data for advertising, or use customer case data to train a general-purpose model. We do not add a contact-form submitter to an automated marketing sequence merely because the form was submitted.

The customer-account area uses a strictly necessary, HttpOnly, Secure, SameSite session cookie. The public site uses Vercel Analytics and Speed Insights for aggregate performance and usage measurement. We also use a PostHog session replay on public marketing pages to understand usability and troubleshoot errors. It does not run in the customer-account area, honors Global Privacy Control and Do Not Track signals, does not create person profiles, and uses memory-only browser storage. The contact form may use Cloudflare Turnstile to distinguish legitimate submissions from abuse. We do not currently use advertising pixels or cross-site behavioral tracking.

Blocking the essential session cookie prevents sign-in. Browser controls may limit other storage or requests. If we introduce nonessential tracking, we will update this notice and implement consent controls where required.

We may disclose information:

• To service providers working under contract to provide hosting, security, email, payment, database, infrastructure, or support functions.
• To integrations that a customer selects and configures, including identity, communications, document, or AI providers.
• To professional advisers, auditors, insurers, or a transaction successor subject to appropriate confidentiality and legal restrictions.
• When reasonably necessary to comply with law, protect rights or safety, prevent fraud or abuse, or establish and defend legal claims.

The current general provider list appears on our subprocessor page. A customer’s order, configuration, or data-processing addendum may identify additional or more specific providers.

We retain information only as long as reasonably necessary for the purpose collected, the customer agreement, legitimate operational and security needs, applicable limitation periods, and legal, tax, audit, professional, or dispute obligations. Retention differs by record type and customer instruction. Expired authentication material and operational copies may remain temporarily in logs or backups.

We use administrative, technical, and physical safeguards appropriate to the information and service, including encrypted transport, access controls, protected credentials, logging, isolation of hosted customer instances, and backups. No method of transmission or storage is risk-free. Security concerns may be reported under ourvulnerability disclosure policy.

Depending on applicable law and our role, you may request access, correction, deletion, restriction, portability, or information about disclosure; object to or withdraw consent for certain processing; or appeal a denied request. We may verify identity, ask you to work through the customer organization that controls the record, and retain information when an exception applies.

Send a request to alex@clarkmanagementconsulting.com. We will not discriminate against a person for exercising an applicable privacy right. Authorized agents should identify their authority and the person represented.

OCM is a professional case-management service and is not directed to children. We do not knowingly collect personal information directly from children through this website. Customer organizations remain responsible for the lawful handling of any minor’s information placed in their OCM instance.

Information may be processed in the United States and other locations where a listed provider operates, subject to contractual and legal safeguards. We may update this notice to reflect changed practices or law. Material changes will be identified by a revised date and, when appropriate, additional notice.