Privacy Policy

Summary of key points

• We collect the personal data you provide (such as your name and email) and a limited amount of technical data collected automatically.
• We do not process sensitive personal data.
• We do not sell or share your data, run no advertising, and use no third-party analytics or tracking.
• We rely on valid legal bases — chiefly performing our contract with you, our legitimate interests, your consent, and legal obligations.
• You can review, change, or delete your account and data at any time in Settings, or by contacting us.

1. What information do we collect?

Personal information you provide. We collect the personal information you give us when you register, use the Services, or contact us, which may include:

• names;
• email addresses;
• passwords (if you sign in with an email and password);
• contact or authentication data;
• contact preferences (such as your notification settings).

Content you create. We store the boards, lists, cards, comments, checklists, and images you create or upload in order to provide the Services.

Sensitive information. We do not collect or process sensitive (special-category) personal information.

Payment data. If you subscribe to Pro, your payment is processed by Stripe. We do not collect or store your card number or security code — Stripe handles and stores all payment data. See Stripe's privacy notice.

Social login data.If you register using Google, we receive your name, email address, and profile picture from Google, as described in "How do we handle your social logins?" below. We do not use Facebook, X, or other social networks.

Information collected automatically. When you use the Services, we automatically collect limited technical data through our hosting and backend — such as your IP address, browser type, device and operating system, access dates and times, approximate (coarse) location derived from your IP, and diagnostic log data. This is used to operate and secure the Services, not to profile you. We run no analytics or tracking.

Information from other sources. When you sign in with Google, we receive your name, email, and profile picture from Google. When someone invites you to a board, we receive your email (and sometimes your name) from the person who invited you. We do not buy personal data, collect it from data brokers, or obtain it from any third party for advertising or marketing.

Google API Services. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

2. How do we process your information?

We process your personal information to:

• create your account and authenticate you;
• provide, operate, and maintain the Services;
• enable collaboration and sharing between users;
• send you notifications and communications you have enabled;
• process payments and manage subscriptions;
• keep the Services secure and prevent fraud or abuse;
• respond to your enquiries and provide support;
• comply with our legal obligations.

We do not use your data for advertising, we do not sell it, and we run no third-party tracking or analytics.

3. What legal bases do we rely on? (EU/UK)

If you are in the EU or UK, we only process your personal information when we have a valid legal basis:

• Performance of a contract — to provide the Services you signed up for.
• Legitimate interests — to keep the Services secure, operational, and improving, where not overridden by your rights.
• Consent — for optional notifications and any future product emails; you can withdraw consent at any time.
• Legal obligations — for example, retaining payment records to meet tax and accounting law.

4. When and with whom do we share your information?

We share personal information only with the service providers that help us run the Services, each acting as a processor under a data-processing agreement:

• Supabase — database, authentication, and file storage (EU region, Frankfurt, Germany).
• Vercel — application hosting.
• Stripe — payment processing for Pro subscriptions.
• Resend — sending transactional emails (invites, notifications).
• Google — sign-in, if you choose to use it.

Business transfers. We may share or transfer your information in connection with a merger, sale of assets, financing, or acquisition of all or part of our business. We do not otherwise sell or share your personal information.

5. How do we handle your social logins?

If you choose to register or sign in using Google, we receive basic profile information from Google — your name, email address, and profile picture. We use this only to create and operate your account. We do not control, and are not responsible for, how Google uses your data; please review Google's own privacy policy.

6. How long do we keep your information?

We keep your personal information for as long as your account is active. When you delete your account, your profile and the boards you own are permanently deleted, your uploaded files are removed, and your invitation records are deleted. Residual copies in encrypted backups are purged within 30 days. Content you contributed to boards owned by others is retained but disassociated from your identity. We keep payment and transaction records longer where tax and accounting law requires.

7. How do we keep your information safe?

We use appropriate technical and organisational measures to protect your data, including encryption in transit, encryption at rest, strict row-level access controls, and delegated authentication. If you sign in with a password, it is stored only as a salted hash, never in plain text. Payment card details never reach our servers. No system is perfectly secure, so we cannot guarantee absolute security, but we take reasonable steps to protect your information and will notify you and the relevant authority of a qualifying data breach as required by law.

8. What are your privacy rights?

Depending on where you live, you may have the right to access, correct, delete, restrict, or object to the processing of your personal data, to data portability, and to withdraw consent. You can exercise most of these directly in Settings (including deleting your account), or by contacting us at privacy@cadenceflows.com or via cadenceflows.com/contact. We will respond in accordance with applicable law.

If you are in the EEA or UK and believe we have processed your data unlawfully, you also have the right to complain to your local data protection authority — in Bulgaria, the Commission for Personal Data Protection (КЗЛД).

9. Controls for Do-Not-Track features

Because there is no finalised industry standard for Do-Not-Track ("DNT") signals, we do not currently respond to them. Since we run no tracking or analytics, there is nothing for a DNT signal to opt out of.

10. US state privacy rights

Residents of certain US states (including California, Colorado, Connecticut, Texas, Virginia, and others) may have rights to know, access, correct, delete, and obtain a copy of their personal data, and to opt out of its sale, sharing, or use for targeted advertising. We do not sell or share personal data, and we do not use it for targeted advertising or profiling. To exercise these rights, contact us at privacy@cadenceflows.com or via cadenceflows.com/contact. If we decline a request, you may appeal by emailing the same address.

11. Other regions

If you are in Switzerland, Canada, Australia, or New Zealand, you have rights under your local privacy laws, including rights to access and correct your personal information and to complain to your local authority. Contact us to exercise these rights.

12. Collaboration and sharing

Cadence is a collaboration tool, so some information is visible to others by design:

• Shared boards. When you invite someone to a board, or add cards, comments, or other content to a shared board, your name and the content you contribute are visible to the other members of that board.
• Public links. If a board owner creates a public link for a board, its contents become viewable — in read-only form — by anyone who has the link, without an account. Only create public links for content you are comfortable making public. A public link can be revoked at any time, which permanently disables it.
• Deleting your account. When you delete your account, the boards you own and your personal profile are permanently deleted. Content you contributed to boards owned by others may remain on those boards but is disassociated from your identity.

13. Do we update this policy?

Yes. We may update this policy from time to time. We will update the date above and, for material changes, notify you in the app or by email.

14. How can you contact us?

For questions about this policy or your data, email privacy@cadenceflows.com, use cadenceflows.com/contact, or write to us at Denis Lazarov, Sofia 1000, Bulgaria.

15. Review, update, or delete your data

To review, update, or delete your personal information, use the controls in Settings (including account deletion), or contact us at privacy@cadenceflows.com.