Privacy Policy

Privacy Policy

Last updated: October 12, 2026

This Privacy Policy explains how Cdaeris Agency (“Cdaeris”, “we”, “us”) handles personal information across everything we run:

  • the cdaeris.com website, including our store and booking forms;
  • our consulting and advisory services;
  • Cadence — our meetings, tasks, time and business-reporting application at cadence.cdaeris.com;
  • Ascend — our learning platform and client portal at ascend.cdaeris.com.

1. Two different roles — please read this first

Not all data we touch is the same kind of data, and the difference matters to your rights and to our obligations.

  • Data we control (Part A). Information about you that we collect and decide how to use — website enquiries, marketing contacts, account records, billing, and how our products are used. For this data Cdaeris is the controller (in some laws, “business”).
  • Customer Data we process for you (Part B). Business records that a customer organisation puts into, or connects to, Cadence or Ascend — their tickets, invoices, tasks, meeting notes, employee time, contact lists, applicant records and similar. We handle that data only on that organisation’s instructions, for the purpose of running the product for them. For this data Cdaeris is a processor (in some laws, “service provider”), and the customer organisation is the controller.

If your employer or a company you deal with gave your information to Cadence or Ascend, that organisation — not Cdaeris — decides what happens to it. We will help you reach them, and Part B explains what we do and do not do with it.

Part C applies to both.

Part A — Data we control

2. Website visitors, enquiries and customers

We collect what you give us through forms, bookings, checkout and correspondence. Typically:

  • name, email address, phone number and company name;
  • appointment and booking details;
  • the content of your enquiry or message;
  • order and purchase details if you buy through our store;
  • newsletter and event sign-ups.

Our website runs on WordPress with WooCommerce. Standard server, cache and security logs — including IP address, browser user agent and request time — are generated automatically and used to keep the site running and defended.

3. Account holders in Cadence and Ascend

To give you an account we hold identity and access records: your name, email address, the organisation you belong to, your role and permission level, your preferences, and authentication records held by our identity providers. Sign-in is handled by Clerk and, for Cdaeris staff and some client accounts, by Microsoft Entra ID. We do not store your password.

In Ascend we also hold your learning record: enrolments, lesson and course progress, quiz results, completions and any certificate issued to you.

4. Billing

Subscription and purchase payments are processed by Stripe, and website store orders may also be processed by PayPal. Those providers handle your card or account details directly. Cdaeris never receives or stores full payment card numbers. We keep the records we need to run the account and meet our tax and accounting obligations: what was bought, when, the amount, tax, and the status of the payment.

5. Cookies, analytics and tracking on cdaeris.com

Our website uses cookies and similar technologies for the following purposes:

  • Necessary — session, checkout and shopping-cart cookies set by WordPress and WooCommerce; caching cookies set by LiteSpeed Cache; security cookies set by Wordfence.
  • Analytics — Google Analytics 4 (measurement ID G-HG2TX1VNEY), loaded client-side, to understand which pages are used and how visitors move through the site. We also use Rank Math connected to Google Search Console, which reports aggregate search queries and positions rather than individual people.
  • Functional — Jetpack, for site features and statistics.

You can refuse or delete cookies in your browser settings, and you can opt out of Google Analytics using Google’s browser add-on. Blocking necessary cookies will break checkout and sign-in.

Cadence and Ascend do not run advertising or cross-site tracking cookies. They set only the cookies needed to keep you signed in and to remember your interface preferences.

6. Product usage analytics inside Cadence

So that we can see which parts of the product are actually used, support customers, and prioritise development, Cadence records a usage event for each signed-in page view and for a small set of key actions (for example completing a task, concluding a meeting, logging time). Each event stores your email address, your display name, whether you are Cdaeris staff or a client user, the area and page path, the action, and the time. This is first-party product telemetry — not advertising, and not shared with any analytics vendor.

7. How we use Part A data, and why we are allowed to

  • To provide what you asked for — answer enquiries, manage bookings, deliver consulting, run your account, deliver courses, issue certificates. Basis: performance of a contract, or your request.
  • To bill and keep records — invoicing, tax, accounting, dispute resolution. Basis: contract and legal obligation.
  • To operate, secure and improve our products — diagnostics, abuse prevention, capacity planning, product decisions. Basis: our legitimate business interests.
  • To send marketing — newsletters, offers and event invitations. Basis: your consent, or an existing business relationship where the law allows it. Every marketing message carries an unsubscribe link, and unsubscribing does not affect service messages about your account.

We do not sell personal information, and we do not share it for cross-context behavioural advertising.

Part B — Customer Data we process for you

8. What this covers

When an organisation subscribes to Cadence or Ascend, it puts its own business records into the product and may authorise the product to read records out of systems it already uses. Cdaeris processes all of that only to provide the product to that organisation, on its instructions.

In Cadence, Customer Data typically includes:

  • Created in the product: tasks and task notes, meetings, agendas, issues, headlines, goals and milestones, scorecard metrics and measurements, dashboards, business plans, time entries, client and contact records, and any file or image attached to them.
  • Read from systems the customer connects, at the customer’s direction: ConnectWise Manage and Datto Autotask (tickets, agreements, time entries, contacts, companies); QuickBooks Online and QuickBooks Desktop (invoices, billing items, accounts, financial reports); IT Glue and SharePoint (documentation); JazzHR (job applicants and hiring stages); Google Analytics 4 and Google Search Console (aggregate website reporting; and which of the customer’s own pages Google has indexed and what they rank for); Microsoft 365 via Microsoft Graph (mail, calendar, Planner tasks, Teams messages, SharePoint documents); and LinkedIn (a company Page’s own posts, publishing to that Page, publishing to a member’s own profile at that member’s request, and engagement figures for posts published through Cadence — see section 19).

Connections are made by an administrator of the customer organisation, using that organisation’s own credentials, and can be revoked by that administrator at any time. Access is read-only except where a feature plainly requires otherwise, which brings us to the next point.

9. Two things worth calling out plainly

Sending email as you. Cadence’s client-conversation feature sends email through Microsoft 365 using delegated permission for the signed-in user. Messages therefore leave from that user’s own mailbox and appear in their Sent Items. Cadence does not send mail from a user’s mailbox except when that user, or a workflow they configured, asks it to.

Meeting summaries and transcripts. If a customer connects Granola, Cadence retrieves the summary and the full transcript of matching meetings and stores them against the meeting record. When a meeting is concluded, its content is frozen into a snapshot for the historical record. Recording or transcribing a conversation carries legal obligations that vary by province and state, and consent is sometimes required from every participant. Responsibility for obtaining that consent rests with the customer organisation running the meeting, not with Cdaeris.

10. Ascend organisations and learner visibility

Where an organisation buys Ascend for its people, an organisation administrator can see the membership and learning progress of the learners in that organisation — enrolments, completion status and certificates. If your employer pays for your Ascend access, assume your progress is visible to them.

11. Artificial intelligence features

Some features send Customer Data to an AI provider to generate a result. We use Anthropic (Claude) for task prioritisation scoring, generating metric and report definitions, importing business-plan documents, and drafting social and advocacy content. We plan to add WalterWrites, an AI text-rewriting service, to produce an alternative version of draft social content alongside the original. It is not in use yet: no content is sent to WalterWrites today, and we will update this policy before that changes. It will receive only draft text a person has written or approved, never content read from LinkedIn.

  • Only the content needed for the request is sent.
  • Cdaeris does not train any model on Customer Data, and we use these providers under terms that do not permit them to train their models on data we submit through their APIs.
  • AI output can be wrong. It is presented as a draft or a suggestion for a person to review, and it is not used to make any decision about an individual that has legal or similarly significant effect.

12. Our commitments on Customer Data

  • We process it only to provide and support the product, and only on the customer’s instructions.
  • We do not sell it, rent it, or use it for advertising.
  • We do not use it for our own commercial purposes, including product development, other than aggregated and de-identified operational statistics that cannot identify any person or organisation.
  • We keep each customer’s data logically separated and access-controlled within the product.
  • Cdaeris staff access it only as needed for support, troubleshooting or as the customer instructs. Administrators can use a support impersonation feature to view the application as another user in order to reproduce a problem; use of it is recorded and visibly indicated in the interface.
  • We use subprocessors only as listed in section 13, and hold them to equivalent obligations.
  • We will tell the customer without undue delay if we become aware of a personal data breach affecting their Customer Data, and assist them in meeting their own notification duties.
  • If an individual asks us directly to access, correct or delete Customer Data, we will refer them to the customer organisation and support that organisation’s response rather than acting unilaterally.
  • On termination we return or delete Customer Data as set out in section 16.

Customers who need these commitments in a signed contract, with the detail their own regulator or auditor expects, can request a Data Processing Agreement from us at growth@cdaeris.com.

Part C — Applies to everything

13. Service providers and subprocessors

We rely on the following providers. This list is current as at the date at the top of this policy, and we will update it here when it changes.

Provider What it does for us Where
Vercel Application hosting for Cadence and Ascend United States
Neon Managed PostgreSQL database United States
Clerk Authentication, organisations and memberships United States
Microsoft Entra ID sign-in; Microsoft 365 and Graph; sending email from a customer’s own mailbox where they have chosen that Canada / United States
Resend Transactional email Cadence sends as itself — notifications, invitations and access requests United States
Anthropic AI features (see section 11) United States
WalterWrites AI rewriting of draft social content (planned; not yet in use — see section 11) United States
Liveblocks Real-time collaborative editing of meeting and agenda content United States
Trigger.dev Scheduled and background job processing United States
Granola Meeting summaries and transcripts, where connected United States
Cloudflare DRM-protected course video delivery for Ascend Global edge network
Stripe Subscription and purchase payment processing United States
PayPal Website store payment processing United States
ActiveCampaign Email marketing and contact management United States
Zapier Automated transfers between our tools United States
Google Calendar for bookings; Analytics and Search Console for site measurement United States
Automattic (Jetpack), LiteSpeed, Wordfence Website features, caching and security United States

Systems that a customer connects to Cadence — such as ConnectWise, Autotask, QuickBooks, IT Glue, JazzHR or LinkedIn — are that customer’s own vendors, not our subprocessors. We read from them under the customer’s own credentials and authorisation.

We may also disclose information where we are legally required to, to enforce our terms, or in connection with a merger or sale of the business — in which case we will require the recipient to honour this policy.

14. Where your data is held, and transfers

Cdaeris is based in British Columbia, Canada. Our products are hosted with providers operating primarily in the United States, and the providers listed above may process data there or in other countries. Data held outside Canada is subject to the laws of the country it is held in, including lawful access requests by that country’s authorities. Where we transfer personal data out of the UK, EEA or Switzerland we rely on the applicable transfer mechanism, including Standard Contractual Clauses.

15. Security

We take reasonable technical and organisational measures to protect information, including:

  • encryption in transit (HTTPS/TLS) for all our web properties;
  • encryption at rest by our database and storage providers;
  • additional application-level AES-256-GCM encryption for the most sensitive values we hold — the credentials and OAuth refresh tokens customers use to connect their own systems;
  • role-based access control and per-customer access gating inside the products;
  • single sign-on with multi-factor authentication available for staff and client accounts;
  • DRM and signed, expiring URLs for Ascend course video.

No system can be guaranteed completely secure. Keep your credentials confidential and tell us promptly if you believe an account has been compromised.

16. How long we keep things

  • Enquiries and marketing contacts — until you unsubscribe or ask us to delete them, and then removed from active use.
  • Account records — for as long as the account is active.
  • Billing and tax records — for the period Canadian tax law requires, currently six years.
  • Product usage analytics — retained as an operational log; we do not use it after it stops being useful for support and product decisions.
  • Customer Data — for as long as the subscription is active. After termination we keep it for 30 days so the customer can export it, then delete it from live systems. Residual copies in encrypted backups age out within 90 days.
  • Figures copied from a connected system — when an administrator disconnects a tool, nothing further is read from it from that moment. The connection, including its encrypted credential, moves to the workspace’s Trash, where an administrator can delete it at once with “Delete now”; otherwise it is destroyed automatically at the end of the recovery window described below. The figures already copied are held for that workspace’s recovery window — at least 30 days, longer if the administrator has chosen longer — so that reconnecting within it resumes rather than starting again. At the end of that window they are destroyed automatically. What is kept is the organisation’s own configuration, which contains no data from the connected system.

We may keep information longer where we must for legal, tax or dispute-resolution reasons.

17. Your rights

Subject to the law that applies to you, you can ask us to:

  • confirm what personal information we hold about you and give you access to it;
  • correct information that is wrong or incomplete;
  • delete information we no longer need to keep;
  • stop sending you marketing;
  • withdraw a consent you previously gave;
  • provide your information in a portable form, or explain how we handled it.

Write to growth@cdaeris.com. We will respond within the time the applicable law allows — 30 days under Canada’s PIPEDA and British Columbia’s PIPA. We may need to verify who you are first, and we will not discriminate against you for exercising a right.

If your request concerns Customer Data — data your employer or a company you deal with placed in Cadence or Ascend — we will pass your request to that organisation and support their response. They, not we, decide the outcome.

If you are unhappy with how we handled a privacy matter you may complain to the Office of the Privacy Commissioner of Canada, or to the Office of the Information and Privacy Commissioner for British Columbia. Individuals in the UK or EEA may complain to their own supervisory authority.

18. Google API data

Where a customer connects Google, Cdaeris’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Connecting Google is one sign-in that grants two read-only scopes: Google Analytics, under which we retrieve only aggregate report data and the list of properties the connected account can see; and Google Search Console, under which we retrieve which of the customer’s own pages Google has indexed and what they rank for, to report on a site they own. We never request write access, never use Google user data for advertising, and never transfer it to a third party except as needed to provide the reporting the customer asked for. We read no other Google service through this connection — in particular not Gmail, Drive or Contacts. A connection can be revoked at any time from inside Cadence or from the Google account’s own third-party access settings; the figures already retrieved are then held and destroyed as described in section 16. The connector-specific detail, including the scope names shown on the consent screen, is at cadence.cdaeris.com/privacy.

19. LinkedIn data

Cadence connects to LinkedIn in two ways, and each is started by a person signing in to LinkedIn and approving the permissions shown on LinkedIn’s own consent screen. Our use of data obtained from LinkedIn’s APIs follows the LinkedIn API Terms of Use.

A member’s own profile. A Cadence user can connect their own LinkedIn account so that posts they approve are published to their profile. This asks for openid, profile and w_member_social. From the sign-in we keep only the member’s LinkedIn identifier and name — not their email address, photo, connections, feed or messages. We read nothing else from the member’s account. For posts published through Cadence we read the post’s engagement figures (impressions, members reached, reactions, comments and reposts) so the member can see how their posts did.

A company Page. An administrator of a LinkedIn Page can connect that Page to their organisation’s Cadence workspace. This asks for rw_organization_admin, r_organization_social (to read that Page’s own recent posts) and w_organization_social (to publish a post as that Page). rw_organization_admin is the Page-administration permission LinkedIn grants our application; Cadence uses it only to list the Pages the member administers, and their names, so they can choose one. Cadence never changes a Page’s settings or administrators.

What Cadence does with it.

  • A Page’s recent posts are shown inside that organisation’s workspace so its people can choose to reshare them to their own profile, with a comment of their own.
  • Nothing is published to LinkedIn unless a person approved it. A reshare a person approves is published at the next time they set aside for reshares. A post the person writes is published when they click Post, or at their scheduled time only if they turned automatic posting on. A post as a Page can only be approved by an administrator of that organisation’s workspace.
  • LinkedIn data is visible only inside the workspace of the organisation that connected it, and is never shown to, or used for, any other customer.
  • We do not sell LinkedIn data, use it for advertising or sales targeting, build profiles of members from it, or use it to train any AI model. Content read from LinkedIn is not sent to our AI providers: the drafting feature in section 11 learns only from posts the person wrote or approved as their own, and the Page post composer does not use AI at all.

Storage and security. LinkedIn access and refresh tokens are encrypted with AES-256-GCM before they are stored, and are never shown on any screen. The text of a Page post a person reshares, and the engagement figures of posts published through Cadence, are kept as part of that workspace’s post history and handled as Customer Data under section 16.

Revoking access.

  • A member can disconnect their LinkedIn account in Cadence at any time; their tokens are deleted at that moment.
  • An administrator can disconnect a Page under Settings › Connections; nothing further is read or published from that moment, and the encrypted token is destroyed as described in section 16 (at once with “Delete now”, otherwise at the end of the recovery window).
  • Either can also be revoked from LinkedIn, under Settings › Data privacy › Permitted services.
  • To have LinkedIn data deleted sooner, write to the address in section 23.

20. Children

Our website, products and services are intended for business use by people aged 18 or over. We do not knowingly collect personal information from children. If you believe a child has given us information, contact us and we will delete it.

21. Third-party websites

Our website and products link to services we do not control. We are not responsible for their privacy practices — review their policies separately.

22. Changes to this policy

We may update this policy. The revision date at the top always shows the current version, and the provider list in section 13 is maintained here. If a change materially reduces the protection given to Customer Data, we will notify affected subscribing organisations by email at least 30 days before it takes effect.

23. Contact us

Cdaeris Agency
Privacy enquiries and rights requests: growth@cdaeris.com
British Columbia, Canada
Website: cdaeris.com

Related document: Terms of Service.