Privacy Policy
Last updated: [date of publishing]
This policy covers the personal data Caderly collects for itself: from people who visit caderly.app, sign up, or sign in. Hasan Kagalwala is responsible for that data.
Employee data your company puts into its workspace is different. Your employer decides what goes in and why, and we only process it on their behalf under our Data Processing Agreement. If you have a question about that data, ask your employer first.
What we collect, and why
| What | Examples | Why we need it |
|---|---|---|
| Sign-up details | Name, work email, company name, workspace address, time zone, weekend days | To create the workspace and confirm the email address is real |
| Account details | Email, hashed password (we never see or store it in readable form), role | To let you sign in and decide what you can see |
| Sign-in and security records | IP address, browser, time of sign-in, failed attempts, changes made | To keep accounts safe, lock out repeated wrong passwords, and keep the audit log your Admins rely on |
| Messages to us | Emails to [Contact email] | To answer you |
We don't use advertising trackers, analytics cookies or third-party marketing tools. Caderly sets one essential cookie that keeps you signed in, and it is deleted when you sign out or your session ends.
Who we share it with
We share it with no one except the services needed to run Caderly:
- [Server location / hosting]: stores the service and its backups.
- [Email provider]: delivers sign-up, invite, password-reset and notification emails.
We also disclose data if the law requires it. We don't sell personal data.
Where it is stored
On our server in [Server location]. If that is outside your country, we protect the transfer as described in the Data Processing Agreement.
How long we keep it
- A sign-up whose email isn't confirmed within 24 hours is deleted.
- Account details are kept while the workspace exists.
- Sign-in and security records: at least 1 year, then deleted.
- When a workspace closes, its data is deleted after 30 days, and backups age out within a further 30 days.
How we protect it
Traffic is encrypted with HTTPS. Passwords are hashed with BCrypt. Sensitive employee fields are encrypted in the database. Each company's data is kept separate both in the application and by row-level security in the database. 5 wrong passwords lock an account for 15 minutes. Backups run every night.
Your rights
You can ask to see, correct, export or delete the personal data we hold about you, or object to how we use it. Email [Contact email]. We'll reply within 30 days. If your question is about employee data in your company's workspace, we'll pass it to your employer and help them respond. You can also complain to your local data protection authority, such as the UAE Data Office.
Children
Caderly is for organisations and isn't meant for anyone under 18.
Changes
We'll post changes here and email workspace Admins about material ones.
Contact
Hasan Kagalwala, [Postal address], [Contact email]