This policy describes how Cascand ("Cascand," "we," "us") handles information when you use our website at https://cascand.io and the Cascand application (together, the "Service"). It applies to the person who signs up for Cascand and to anyone else at an organization who uses an account. It does not apply to the customers, prospects, or contacts of a Cascand user, whose information we hold on that user's behalf as described below.

If a term in this policy is unclear, our Terms of Service and Security page provide more detail. If those documents ever conflict on a factual point, this policy and the actual behavior of the Service control.

1. Information we collect

We collect information in three ways: what you give us directly, what we receive from systems you choose to connect, and what our own systems generate while operating the Service.

a. Account and business information you provide

Your name, work email address, and password, when you create an account.
Information about your business that you type in during setup or afterward: your company, what you sell, who you sell to, your competitive landscape, and similar business context.
Records you import, such as a spreadsheet of your existing customers and prospects.
Anything you type into Cascand describing your work, your relationships, or an update on a deal.
Messages you send us, such as a support request.

b. Information from systems you connect

Cascand's core function depends on connecting to systems you already use. Before you connect anything, we tell you plainly what access a given connection requires, and you decide whether to grant it. Depending on what you connect, this can include:

Email. Not every message in a connected mailbox becomes part of your Cascand data. Only messages sent or received by the specific work address or addresses you tell us represent your Cascand correspondence are read in, along with the metadata needed to associate a reply with the right person and thread. A connected mailbox is never treated as fully authorized simply because it was connected. You can add, revoke, or change which addresses count as your Cascand correspondence at any time, and revoking one takes effect immediately for anything new.
Calendar. Meeting times and attendee information, used to understand your schedule and to book meetings you approve.
Customer relationship management systems. Contacts, companies, deals, and related records, kept in sync with your Cascand account.
LinkedIn (through a connectivity provider). Connection requests, messages, and related activity that you send or that are sent on your behalf with your one-click approval. Cascand never sees or stores your LinkedIn password.
Spreadsheets you connect or import. Rows of contact, company, and deal information you choose to bring in.

You control every one of these connections. Disconnecting a system stops Cascand from pulling in anything new from it. Historical data already brought in through that connection is handled as described in Section 5, Retention, below.

c. Information we generate

To do its job, Cascand creates its own records from the information above:

A recommendation of what to work on next, and why, based on your business, your relationships, and what happened before.
Drafted messages, proposed meeting times, and proposed updates to a connected customer relationship management system. Messages, meeting bookings and invitations wait for your approval before they go out, and an approved send or booking is also logged to a connected system as an activity.
A record of what Cascand decided, what you approved or changed, and what happened afterward, kept so you can see why a recommendation was made and so we can improve future recommendations.
Preferences you state, and patterns Cascand records from your outcomes and feedback, such as which channels and signals tend to work for you.

d. Payment information

If you subscribe to a paid plan, our payment processor collects your billing details directly. We do not store your full card number. We receive limited billing status, such as whether a payment succeeded, from our payment processor.

e. Information collected automatically

Our marketing website (https://cascand.io) does not use advertising or tracking cookies. It records a small number of first-party events, such as which page loaded, so we can tell whether the site is working, without setting a tracking cookie or sharing this information with an advertising company. See our Cookie Policy for detail.

The Cascand application keeps you signed in using your browser's local storage rather than a cookie. This includes your session token and a small amount of information about which account you are acting on behalf of. It stays on your device and is not shared with anyone else.

2. How we use information

We use the information described above to:

Operate the Service: understand your business, decide what deserves attention next, prepare work, and carry out what you approve.
Maintain and secure the Service, including detecting and stopping misuse.
Communicate with you about your account, respond to support requests, and, if you agree to receive them, tell you about product updates.
Bill you for a paid plan and keep accurate records of that billing relationship.
Improve the Service. Where we learn something general from how the Service performs, such as which channel tends to get a reply faster, that improvement is not built by handing your customers' identities to anyone outside your own account, and it does not change what the recommendation engine can see for another customer.
Meet a legal obligation, or protect the rights, property, or safety of Cascand, our users, or others.

We do not sell your personal information or your business information, and we do not use it to serve you advertising.

3. Artificial intelligence

Cascand uses large language models from a small number of outside providers to draft messages, interpret free text you write, and help research a company or contact. Based on the commercial terms those providers currently publish, content we send them through our business accounts with them is not used to train their general, publicly released models, and is retained by them only briefly for abuse monitoring and safety review, not for building a permanent dataset. We review these terms periodically, since a provider's own policy can change, and we will update this section if it does.

A recommendation, a drafted message, or a research finding produced this way is a starting point for you, never a final action. Anything consequential, a message actually sent, a meeting actually booked, a record actually updated in your other systems, waits for you to approve it.

4. How we share information

We share information only in these circumstances:

With systems you connect. If you approve a message, a meeting, or a customer relationship management update, we send it to the system you connected, because that is the point of connecting it.
With service providers who help us run Cascand. Our hosting, database, payment, and language-model providers process information on our behalf, under agreements that limit what they may do with it. Our current Subprocessors page lists who they are.
For legal reasons. If required by law, legal process, or to protect against fraud or harm.
In a business transfer. If Cascand is acquired or its assets are transferred, information may transfer as part of that transaction, subject to this policy or a successor policy that offers comparable protection.

We never share your customer or business information with another Cascand customer, and we do not let one account's data influence what another account sees about a different company or person.

5. Retention

We keep account and business data for as long as your account is active, so the Service keeps working the way you expect. Some records exist specifically to prove what happened and when, such as an approval you gave or a security-relevant event; those records are kept as a permanent, tamper-evident log rather than deleted, since altering or removing them would defeat their purpose. Today we do not have an automated process that deletes data on a fixed schedule; if you close your account, contact us and we will address your specific request as described below.

6. Your choices

Export. You can request an export of the data in your account at any time. Some very large tables may be capped in a single export; we will tell you plainly if that happened and help with the rest on request.
Anonymize identifying details. You can ask us to remove the name, email address, and LinkedIn address on the people and companies in your account. This does not delete the record of decisions and activity built around those records, since that record is what proves what happened and often needs to survive independently of any one person's identity. Free-text notes you or Cascand wrote about a person or company may still contain their name even after this step; we are working to close that gap.
Disconnect a system. Disconnecting a mailbox, calendar, customer relationship management system, or LinkedIn stops Cascand from pulling in anything new from it and revokes its access at the source where the provider supports that.
Change which email addresses represent you. Add or revoke an authorized address at any time from your integration settings.
Unsubscribe. Every outbound email Cascand helps send on your behalf includes a one-click opt-out for the recipient. Once someone opts out, our systems will not let a future message reach them again through Cascand, even if they are rediscovered later.
Close your account. Contact us at sales@cascand.io and we will help.

7. Your rights under applicable privacy law

Depending on where you live, you may have rights to know what personal information we hold about you, to correct it, to delete it, to receive a copy of it, or to opt out of certain uses. This can include rights available under laws in California, Colorado, Connecticut, Virginia, Utah, Texas, and other states, as well as similar laws elsewhere. To exercise a right under a law that applies to you, contact us at sales@cascand.io and we will respond as that law requires. We will not discriminate against you for exercising these rights.

8. Children

Cascand is a business tool and is not directed to, and should not be used by, anyone under 18. We do not knowingly collect personal information from children.

9. International data

Cascand is a United States company and our systems run in the United States. If you use Cascand from outside the United States, you understand that your information will be transferred to, stored, and processed in the United States, which may have different data protection laws than your own country.

10. Security

We describe the specific controls we have in place on our Security page. We encourage you to read it.

11. Changes to this policy

We will update the date at the top of this page when we make a change. If a change is material, meaning it would meaningfully affect how you'd expect your information to be used, we will tell current customers directly, such as by email, before it takes effect.

12. Contact us

Questions about this policy, or a request under Section 6 or 7 above, can be sent to sales@cascand.io. We currently handle privacy requests through this address rather than a separate mailbox; if that changes, we will update this page.

What Cascand collects, why, and what you can do about it.