Privacy Notice

For the account information of the people who sign in to Cadenance, we act as a data controller.

For the business data we read from systems you connect — your Shopify store, Amazon Seller Central, WooCommerce store, QuickBooks Online or Xero organisation, and any files you upload — we act as a data processor on your behalf. You decide what to connect and you can disconnect at any time.

Account data

Your email address, a hashed password (never the password itself), your workspace name and settings, your role, and — if you enable two-factor authentication — an encrypted TOTP secret. We also keep an audit log of security-relevant actions such as sign-ins, permission changes and billing events, together with the IP address the action came from.

Data from a connected Shopify store

With your permission, Cadenance reads products, inventory levels and locations, orders and fulfilments, and — where Shopify Payments is in use — payment disputes. From orders we store only the commercial line-item detail we need to compute demand, margin and cash: order identifier and date, SKU, product title, quantity, unit price, discount, tax and refund amounts.

We do not collect your customers’ names, email addresses, phone numbers, shipping addresses or payment details. Our order query does not request those fields from Shopify, so they never reach our systems. Cadenance analyses what was sold, not who bought it.

Data from other systems you connect

From Amazon Seller Central and WooCommerce we read the equivalent order, product and inventory data. From QuickBooks Online and Xero we read account-level financial totals only — your cash balance, accounts payable and accounts receivable — not individual transactions or contact records.

Files you upload

If you upload spreadsheets or CSVs, we process whatever they contain. Please do not include personal data you do not need us to have; Cadenance only requires SKUs, dates, quantities, costs and prices.

Product analytics

We use PostHog to understand which features are used, so we can improve them. This records page views and feature events tied to your account. It does not record your business data.

We use connected-store data solely to produce the analysis you asked for: replenishment recommendations, risk scores, returns and dispute analysis, the weekly CFO brief, and answers from the AI copilot. We use account data to operate and secure the service, and to bill you. We use analytics data to improve the product.

Where GDPR applies, we rely on performance of a contract for operating the service and billing, and on our legitimate interests in securing the service and improving the product. Where we process personal data on your behalf, your instructions and our Data Processing Addendum govern that processing.

We do not sell your data, and we do not use your business data to train AI models. Where the AI copilot or the weekly brief calls a third-party model provider, the relevant excerpt of your data is sent to generate that answer and is not used by us or the provider to train models.

We share data only with the small set of infrastructure providers needed to run the service — hosting, email delivery, payment processing, error monitoring and AI inference. Each is listed, with what it processes and where, on our subprocessors page. We may also disclose data where we are legally required to, or to protect the rights and safety of our users.

Card details are handled entirely by Stripe. Cadenance never sees or stores card numbers. If you install through the Shopify App Store, billing runs through Shopify and appears on your Shopify invoice.

Data is stored in the United States. All traffic is encrypted in transit with TLS, and data is encrypted at rest. Access tokens for connected systems and two-factor secrets are additionally encrypted with a separate key before being written to the database. Access to production systems is limited to personnel who need it. More detail is on our security page.

If you are in the EEA or UK, transfers to the United States are made under the European Commission’s Standard Contractual Clauses, which form part of our Data Processing Addendum.

Historical sales, inventory, returns and dispute records are retained for the period included in your plan, after which older records are deleted automatically. Account records and audit logs are kept for as long as your account is open.

When you disconnect a store, we stop reading from it and delete the stored access token. When you delete your account, we delete your workspace data; where other people still belong to the workspace, we remove and anonymise your personal details instead of deleting the shared workspace. If a Shopify store uninstalls Cadenance, we delete that store’s connection records in response to Shopify’s mandatory redaction webhook.

You can access, correct, export or delete your data. Export and deletion are available to you directly, without contacting us, from Settings → Security in the app. Depending on where you live you may also have the right to object to or restrict processing, to withdraw consent, and to complain to your data protection authority.

If you are a shopper rather than a merchant and want to know what a store holds about you, contact the store directly — they are the controller of that data. Where a store passes us a Shopify data request or redaction request about you, we act on it.

Cadenance is a business tool and is not directed to children. We do not knowingly collect personal data from anyone under 16.

If we make a material change we will update the date at the top of this page and, where the change materially affects you, notify account administrators by email.

We will execute a Data Processing Addendum with you before processing personal data on your behalf, in accordance with GDPR Article 28.

Request DPA

Privacy questions: privacy@cadenance.com. Security reports: security@cadenance.com.