Privacy notice

Who we are

Cadence Standard Ltd, a company registered in England and Wales, number 17246762, runs Cadence Resolve. We are the controller for the details you send us when you apply for a pilot, for this site's analytics if you agree to them, and for the sign-in and security records we keep to run the service (sign-in requests, sessions and error logs). For what your team puts into the product, your employer is the controller and we process it on their behalf, under the data processing agreement that comes with the pilot. If you use the product on your own account rather than through an employer, we are the controller for what you enter. Contact us through cadencestandard.com/contact.

If you apply for a pilot

What we hold

Your name, work email, company, job title and the answers you gave about your site and the problem you would point the pilot at.

Why

To reply to your application and judge whether we can help. The lawful basis is our legitimate interest in responding to a business enquiry you sent us, together with the agreement you give on the form.

How long

Deleted from our live database 90 days after you apply, or sooner if you ask. Copies in our encrypted backups and our database host's point-in-time history are gone within a further 30 days. If we start working together, what we need moves into the pilot agreement instead.

Anything else

We store a one-way hash of the address the form was submitted from, purely to stop the form being flooded. The address itself is never stored by us. The form's spam check (Cloudflare Turnstile) sees your address as part of running that check.

If you use the product

What we hold

Your email address and, if you add one, your name. The content your team enters: incident descriptions, causes and the evidence behind them, corrective actions, coaching conversations and change plans (which can name colleagues and how they feel about a change). And a record of who did what: who verified a cause, closed a case, gave an effectiveness verdict, invited or removed someone, and when.

Why

To provide the service to your employer, who decides what goes into it.

How long

Coaching conversations on closed cases, including change-plan conversations, are deleted automatically after a year. Cases, causes and actions are kept until the workspace is deleted. An admin can download everything the workspace holds at any time. On request we delete it from the live database within seven days. Encrypted backup copies roll off within 30 days, and our database host keeps a point-in-time history for up to 30 days.

Sign-in and security records

Sign-in links expire after 15 minutes and sessions after 7 days. The records of them are deleted when your workspace is deleted. Error logs are kept by our hosting provider for up to 7 days. The service itself keeps only a short note of the most recent error of each kind, with email addresses removed.

Who else sees it

• Cloudflare, which hosts the application and the database.
• Anthropic, which runs the three AI features: the investigation coach (it sees the case and its conversation), the change-plan coach (it sees the plan, including any colleagues named in it), and the check for repeat problems (it compares a new incident's description with your workspace's closed ones). Its commercial terms exclude training on API data. Email addresses are not sent to it.
• Resend, which delivers our email: sign-in links, invitations, check-date reminders (which include the action's description), and pilot application notifications and acknowledgements.
• Stripe, which takes card payments for the Team plan. When an admin starts checkout it receives their email address and a reference to the workspace. Card details are entered on Stripe's own page and never reach us.
• GitHub, whose build service runs our nightly backup: it exports the database, encrypts it there straight away, and keeps the encrypted copy for 30 days.

We do not sell personal data and we do not share it for advertising.

Analytics

This site counts page views only if you agree to it, and only if a collector is configured for this deployment. There is no advertising network, no cookie used for tracking, and no profile built about you. Events carry a page path and a small set of fixed values, never anything you typed.

Your rights

You can ask for a copy of your data, ask us to correct it, ask us to delete it, or object to how we use it. Write to us and we will act within one month. If we use the product on your employer's behalf, we will point you at them first, since they decide what is stored.

You can also complain to the Information Commissioner's Office at ico.org.uk.