Privacy policy

This Privacy policy explains how Cadances (the Service) collects, uses and protects your personal data, and the rights you have. It applies to the Cadances website and application. We process your data lawfully and transparently under the General Data Protection Regulation (GDPR).

Who is responsible

The data controller is the company that publishes the Service, identified on our Legal notice. You can contact us about privacy through the Contact page or the email address shown there.

What data we collect

• Account data: your name or display name, email address and password (stored only in hashed form). If you sign in with Google, we receive your name and email address from your Google account; we never see your Google password. Google's own privacy policy governs their side of that sign-in.
• Subscription and billing data: your plan, billing period and payment status. Card details are handled directly by our payment providers; we do not store your full card number.
• Portfolio data: the holdings, transactions, dividends and settings you enter to use the Service.
• Connected account data: if you link a brokerage account, we receive your positions, balances and past transactions from that account through our broker connectivity provider. We never receive or store your brokerage login credentials.
• Import files: the broker export files you upload when you import transactions.
• Usage and technical data: log data such as your IP address, device and browser type, and how you interact with the Service, used to keep it secure and to improve it.
• Communications: messages you send us through the Contact page or support.

Why we use it, and our legal bases

• To provide the Service (create your account, store your portfolio, synchronise connected brokerage accounts, import your files, compute income, performance and tax analytics): performance of our contract with you.
• To process subscriptions and payments: performance of our contract and compliance with our legal (accounting) obligations.
• To secure and improve the Service and prevent fraud and abuse: our legitimate interest in a safe, reliable product.
• To send service messages such as billing or security notices: performance of our contract. Optional marketing messages, where offered, are sent only with your consent.
• To use non-essential cookies, analytics and advertising measurement: your consent, which you can withdraw at any time (see our Cookie policy).

Who we share it with

We do not sell your personal data. We share it only with service providers who process it on our behalf under contract, and only for the purposes described above:

• Vercel Inc. (United States) hosts the application.
• Supabase stores our database on Amazon Web Services servers in the European Union (Ireland).
• Stripe and PayPal process subscription payments.
• SnapTrade (operated by Passiv Inc., Canada) establishes the connection to your brokerage account, only if you choose to link one, and only for the accounts you authorise.
• Anthropic (United States) provides the AI service used by the file import when no built-in parser recognises your file. We send only the column headers and a small, clipped sample of rows from the file, never your name, email address or account identifiers, and the data is not used to train AI models.
• Resend (United States) delivers our transactional emails.
• Vercel Web Analytics measures site usage without cookies, and only after you consent to analytics.
• Meta Platforms Ireland Limited receives measurement data about your visit when you accept marketing cookies, so we can assess our advertising and reach people who have already visited the Service.

Our market data providers supply prices and dividend information to us; they receive no personal data about you. We may also disclose data where the law requires it or to protect our rights.

International transfers

We store your portfolio and account data in the European Union. Some providers process data outside the European Economic Area:

• Providers in the United States (such as Vercel, Stripe, PayPal, Anthropic, Resend and Meta) process data under appropriate safeguards: the European Commission's standard contractual clauses, or the EU-US Data Privacy Framework where the provider is certified.
• SnapTrade processes broker connection data in Canada, a country covered by a European Commission adequacy decision.

How long we keep it

• Account and portfolio data: kept while your account is active. When you delete your account, your account, portfolio and connected-account data are deleted immediately and permanently, and we instruct our broker connectivity provider to delete its connection data as well.
• Unpaid accounts: if a paid account remains unpaid, we notify you by email and delete the account data after the grace period stated in those emails.
• Billing records: kept for the period required by French accounting law, even after account deletion.
• Import files and AI mapping requests: files are processed to run your import and are not kept as such once the import completes; we keep technical metadata about AI mapping requests (model, token counts, cost), not the content of your file.
• Technical logs: kept for a short period for security and troubleshooting.

How we protect it

We use technical and organisational measures such as encryption in transit, hashed passwords, access controls and EU data hosting to protect your data. No system is perfectly secure, but we work to reduce risk and to respond promptly to any incident.

Your rights

Under the GDPR you have the right to access, correct, delete or export your data, to restrict or object to certain processing, and to withdraw consent at any time. You can exercise many of these directly in your account settings, or by contacting us, and we respond within the time limits set by law.

If you believe we have not handled your data properly, you have the right to lodge a complaint with your local data protection authority. In France this is the Commission Nationale de l'Informatique et des Libertés (CNIL).

Children

The Service is not intended for anyone under 18, and we do not knowingly collect data from children.

Changes

We may update this policy from time to time. If a change is significant, we will let you know. The "last updated" date above shows when it last changed.

Contact

For any privacy question or request, use the Contact page or the email address in our Legal notice.