Privacy Policy

1. Overview

Cadenova, Inc. ("Cadenova," "we," "us"), a Delaware corporation based in New York, NY, operates the website https://cadenova.com and its subdomains and the Cadenova software-as-a-service platform (collectively, the "Services"). This Privacy Policy describes how we collect, use, and protect your information when you interact with our Services. This is a unified policy covering both our public-facing website and our authenticated platform.

2. Information We Collect

2.1 Information You Provide

Category	Data Collected	Purpose
Account Registration	Name, work email, organization name, job title	Account creation, authentication, service provision
Newsletter Signup	Name, work email, company name, job title, phone number	Marketing communications, product updates
Payment Information	Billing name, billing address, last four digits of payment card, card brand, expiration date (full card details processed and stored by Stripe; Cadenova does not store full card numbers)	Payment processing and billing
Customer Content	Design sketches, product images, brand assets, collection plans, catalogs, sales records	Service provision; De-Identified Data creation (subject to opt-out per Terms of Service Section 5.4)
Customer Outputs	Line sheets, moodboards, digital samples, AI-generated imagery, and other work product created using the platform	Service provision (Customer owns all Outputs per Terms of Service Section 5.3)
Shopify Integration	Product catalog data, sales records, store metadata (no end-customer PII)	Service provision, demand forecasting
Support Inquiries	Name, email, message content	Customer support

2.2 Information Collected Automatically

Category	Data Collected	Tool(s)
Usage Analytics	Pages visited, features used, click patterns, time on page, referral source	Google Analytics (GA4), PostHog, Plerdy
Session Recordings — Marketing Site	Mouse movements, scrolling, clicks on cadenova.com public pages	Plerdy
Session Recordings — Web Application	In-app interactions, navigation flows, feature usage within the authenticated platform	PostHog
Device & Technical Data	IP address, browser type, OS, device identifiers	Server logs, GA4
Cookies	Session cookies, analytics cookies, preference cookies	See Cookie Policy

Session Recording Notice: Plerdy (marketing site) and PostHog (web application) record user sessions to improve our Services. Recordings capture screen interactions but do not capture keyboard input in password, payment, or other sensitive fields. You may opt out via your browser's Do Not Track setting or by contacting [email protected].

2.3 Publicly Available Data

Separately from user data, Cadenova collects publicly available information from various public sources to train its models and generate trend forecasts. This collection focuses on commercial content, products, and styles. It does not involve collecting names, contact details, or behavioral profiles of private individuals. Publicly sourced materials are used for model training and analytical purposes and are not displayed or redistributed in their original form. Data collection is conducted in compliance with applicable law, including through authorized third-party data providers where appropriate.

3. How We Use Your Information

We use information to: provide and operate the Services; create De-Identified Data to improve our models (subject to the opt-out described in our Terms of Service); process payments; send marketing communications (with unsubscribe in every message); analyze usage to improve the Services; respond to support inquiries; detect and prevent fraud; and comply with legal obligations.

4. Third-Party Service Providers

We use third-party service providers to operate the Services. These providers process data on our behalf under contractual obligations to protect your information. We use service providers in the following categories:

• Cloud infrastructure and hosting

• Authentication and application infrastructure

• Payment processing (Stripe)

• Website and product analytics

• Session recording and UX analysis

• Email communications (marketing and transactional)

A detailed list of specific sub-processors, including their names, purposes, data categories processed, and processing locations, is available upon request at [email protected]. We will notify affected Customers at least thirty (30) days before adding new sub-processors that handle Customer Content.

5. Your Rights and Choices

You may:

(a) opt out of De-Identified Data usage by contacting [email protected] (see Terms of Service Section 5.4);

(b) unsubscribe from marketing emails via the link in any message or by contacting us;

(c) opt out of session recordings via your browser's Do Not Track setting or by contacting us;

(d) manage cookie preferences through our consent banner or your browser settings; and

(e) request access to, correction of, or deletion of your personal data by contacting [email protected].

5.1 For EEA/UK Residents

If you are located in the European Economic Area or United Kingdom, you have rights under the GDPR including access, rectification, erasure, restriction of processing, data portability, objection to processing, and withdrawal of consent. Contact [email protected] to exercise these rights. We will respond within thirty (30) days. You may also lodge a complaint with your local data protection authority. Where Cadenova processes Customer Content on behalf of a Customer, Cadenova acts as a data processor and the Customer is the data controller. Cadenova is prepared to enter into Data Processing Agreements (DPAs) with Customers as required.

5.2 For California Residents

California residents have rights under the CCPA/CPRA including the right to know what personal information is collected (names, email addresses, job titles, IP addresses, device identifiers, usage data, and any other information linked to an identifiable individual), the right to request deletion of such information, and the right to opt out of the sale or sharing of personal information. Cadenova does not sell personal information. Contact [email protected] to exercise your rights.

6. Data Storage and Security

All data is stored on servers located in the United States. We implement commercially reasonable safeguards including encryption in transit (TLS 1.2+) and at rest, access controls, and regular security reviews. Our cloud infrastructure provider maintains SOC 2 Type II certification. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

If we expand to serve customers in other regions, we will update this policy to reflect any additional storage locations and applicable data transfer mechanisms.

7. Data Retention

We retain data as follows: account data for the duration of your account plus thirty (30) days; Customer Content and Customer Outputs for the subscription term plus thirty (30) days (subject to export rights under Terms of Service Section 5.5); newsletter data until you unsubscribe; analytics data per provider defaults (typically 14--26 months); session recordings for up to twelve (12) months; and De-Identified Data indefinitely.

8. Data Breach Notification

In the event of a breach involving unauthorized access to personal data, we will notify affected Customers without undue delay and in compliance with applicable law, and will cooperate with regulatory authorities as required.

9. Children's Privacy

The Services are not directed to individuals under 18. We do not knowingly collect personal information from children who use the Services. If you believe a child has provided us with personal information through the Services, contact [email protected] and we will take steps to delete such information.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated to registered users by email at least thirty (30) days in advance.

11. Contact

Cadenova, Inc.

New York, New York

Contact: [email protected]

Support: [email protected]