Privacy Policy

1. Who we are

Cadence is operated by Benas Vaitelis, a private individual, Klaipėda, Lithuania. You can contact us about privacy at hello@cadenceflow.net.

2. Our role: controller and processor

• For account holders (the people who sign up and run a business on Cadence), we are the data controller.
• For the clients, students, parents and tutors that a business adds, the business is the data controller and we act as its data processor, handling that data only to provide the service and on the business's instructions. Businesses are responsible for having a lawful basis for that data and for informing the people concerned. Our processing terms are part of our Terms of Service.

3. Data we collect

• Account data: your name, business name, email address and password (stored only as a secure hash by our authentication provider).
• Business settings: billing email, phone, timezone, currency, reminder and invoicing preferences.
• Data you add: client and guardian names, email addresses and phone numbers; tutor details and pay rates; session dates, times and subjects; invoices and their line items.
• Payment data: card payments are handled entirely by Stripe. We never see or store card numbers. We store invoice payment status and Stripe reference IDs.
• Email records: when invoices and reminders were sent.
• Google Calendar connection (optional): if you connect Google Calendar, the Google account's email address and an access token that lets us manage a separate “Cadence” calendar we create in that account. We can only access calendars Cadence created, never your other events, and disconnecting in Settings deletes that calendar.
• Technical data: authentication cookies and standard server logs (such as IP address and browser type) used for security and to keep the service running.

4. Why we use it (legal bases)

• To provide the service: scheduling, invoicing, reminders and payments (performance of a contract).
• To keep the service secure and prevent fraud and abuse (legitimate interests).
• To meet legal obligations, such as tax and accounting rules (legal obligation).
• To contact you about your account: service and security messages. We do not send marketing emails without your consent.

5. Who we share data with

We use these service providers (sub-processors) to run Cadence. Each is bound by a data processing agreement:

• Supabase: Database, authentication and file storage (privacy policy)
• Stripe: Card payments between businesses and their clients; Connect onboarding (privacy policy)
• Resend: Sending invoice and reminder emails (privacy policy)
• Vercel: Hosting and running the application (privacy policy)
• Google (only if you connect Google Calendar): Adding sessions to your calendar: session subject, date and time, client name, and the tutor’s name and email for the invite (privacy policy)

Some of these providers may process data outside the European Economic Area. Where they do, transfers are protected by the European Commission's Standard Contractual Clauses or an equivalent safeguard. We never sell personal data or share it for advertising.

6. Cookies

We only use strictly necessary cookies that keep you signed in and protect your session. We do not use analytics, advertising or tracking cookies, so no cookie consent banner is needed. If that ever changes, we will ask for your consent first.

7. How long we keep data

• Account and business data is kept while your account is active.
• When you delete your account (Settings → Your data), your business and everything in it is deleted immediately. Encrypted backups held by our database provider are overwritten within their standard backup window.
• Invoices may be subject to accounting retention rules. As the controller of your business records, please export your data before deleting your account if you need to keep them.

8. Your rights

Depending on where you live, including under the EU/UK GDPR, you have the right to:

• access the personal data we hold about you and receive a copy (in the app: Settings → Your data → Export);
• correct inaccurate data (edit it directly in the app);
• have your data deleted (Settings → Your data → Delete account);
• restrict or object to certain processing, and data portability;
• withdraw consent where we rely on it;
• lodge a complaint with your local data protection authority.

If you are a client, student or parent of a business using Cadence, please contact that business first. They control your data, and we will help them respond. You can also email us at hello@cadenceflow.net.

9. Children

Cadence is a tool for businesses and is not directed at children. Businesses may store data about students who are minors. They are responsible for obtaining any consent required from parents or guardians.

10. Security

Data is encrypted in transit (HTTPS) and at rest. Access is restricted so each business can only ever see its own data. Card details never touch our servers. No system is perfectly secure; if a breach affects your personal data, we will notify you and the relevant authorities as the law requires.

11. Changes to this policy

We will post any changes on this page and update the date at the top. For significant changes, we will notify account holders by email before they take effect.