1. Who is responsible for what
Cadence Labs Ltd, registered in England and Wales at 2 Ravenscroft Yard, Shoreditch, London EC2A 3QP, provides the Cadence service.
Where you are a customer — you signed up, you are billed, you administer a workspace — we are the data controller for your account information, and this policy describes what we do with it.
Where you are an end user of a customer's product and that customer sends us events about your behaviour, we are a data processor. We hold that data on their behalf, under their instructions and our data processing agreement. If you want your data corrected or removed, the customer is the right place to ask; if you contact us we will forward your request to them within five working days.
2. What we collect
2.1 From customers
- Account data — name, work email, password hash, workspace name, role and the identity provider you sign in with
- Billing data — company name, billing address, VAT number and the last four digits and expiry of the payment card. Full card numbers are handled by Stripe and never reach our servers
- Product usage — which features you use in Cadence itself, so we can tell what to improve. We run this on our own Cadence workspace
- Support correspondence — tickets, chat transcripts and any attachments you send us
2.2 On behalf of customers
- Event data — the event names, properties and identifiers a customer chooses to send from their product
- Device and session context — browser, operating system, screen size, referrer, and a coarse location derived from IP at city level. The IP address itself is discarded after derivation and never stored
- Session recordings — only where the customer has explicitly enabled session replay, with input values masked in the browser before transmission
We do not buy data from third parties, we do not enrich event data with outside sources, and we do not operate an advertising network.
3. Why we process it, and on what basis
- To provide the service — performance of a contract. Without this data there is no product
- To bill you — performance of a contract and our legal obligation to keep tax records
- To keep the service secure — legitimate interest in preventing abuse, fraud and unauthorised access
- To improve the product — legitimate interest, using aggregated usage data about Cadence itself
- To send product email — legitimate interest for service notices; consent for anything marketing, withdrawable in one click
We do not sell personal data, and we do not share it for cross-context behavioural advertising as those terms are defined under the CCPA and its successors.
4. Who we share it with
Only the sub-processors we need to run the service. The current list, with each provider's purpose and location, is published on our security page and we give 30 days' notice before adding to it.
We will disclose data to law enforcement only where legally compelled. Where we are permitted to tell you, we will, before disclosing, and we publish a transparency report twice a year.
If Cadence is acquired, data may transfer to the acquirer under the same commitments. You will be notified at least 30 days beforehand and can export and delete everything before the transfer completes.
5. How long we keep it
- Event data — for the retention window on the workspace plan: 90 days on Free, 12 months on Team, 24 months on Business, and up to 7 years on Enterprise
- Session recordings — 30 days by default, configurable up to 12 months
- Account data — while the account is open, then 30 days
- Billing records — 7 years, because tax law requires it
- Backups — 35 days, encrypted, in the same region as the primary data
When a workspace is deleted it goes read-only for 30 days, then is removed from primary storage, and is purged from backups within a further 35 days.
6. Where it is stored
Workspaces are pinned to a region at creation. EU workspaces are processed and stored in Frankfurt, US workspaces in Northern Virginia. Data does not cross regions — including backups, log aggregation and support tooling.
Where a transfer outside the UK or EEA is unavoidable, it is covered by the 2021 Standard Contractual Clauses with the UK International Data Transfer Addendum, plus a transfer impact assessment we will share on request.
7. Your rights
Under UK and EU data protection law you can ask us to give you a copy of your data, correct it, delete it, restrict how we use it, or object to processing based on legitimate interest. Where processing is based on consent you can withdraw it at any time without affecting what came before.
Write to privacy@cadence.dev. We respond within 30 days, free of charge, and we will not ask you why. If you are unhappy with the outcome you can complain to the UK Information Commissioner's Office or your local supervisory authority.
Californian residents have equivalent rights to know, delete, correct and opt out, and we will not discriminate against you for exercising them.
8. Cookies
On this website we set one strictly necessary cookie for your session, and nothing else until you tell us otherwise. There is no advertising pixel on this site.
Inside a customer's product, the Cadence SDK sets a first-party cookie holding a random anonymous identifier. It contains no personal data, is not readable across domains, and the customer controls whether it is set at all — cookieless mode is one setting away.
9. Children
Cadence is a business tool and is not directed at children. We do not knowingly collect data about anyone under 16. If you believe a customer is sending us such data, tell us and we will investigate with them.
10. Changes to this policy
We keep an archive of every version. Material changes are announced in the product and by email at least 30 days before they take effect, so you have time to object or leave.
11. Contact
Data protection questions: privacy@cadence.dev. Our Data Protection Officer can be reached at the same address, marked for their attention. Postal mail reaches us at Cadence Labs Ltd, 2 Ravenscroft Yard, Shoreditch, London EC2A 3QP, United Kingdom.
Our EU representative under Article 27 is Cadence Labs GmbH, Prenzlauer Allee 186, 10405 Berlin, Germany.