Privacy Policy

This Privacy Policy describes how we collect, use, and share information when you use the Cuadre websites and cloud service (the “Service”). Read it with our Terms & Conditions at /terms.

If you use Cuadre on behalf of an organization, that organization typically decides what Customer Data to upload. In that case, Cuadre processes Customer Data to provide the Service to the organization, and the organization’s own privacy notices may also apply to workers, partners, and vendors whose data is uploaded.

2.1 Account and organization data

• Name, email, password credentials (hashed/managed via our auth stack)
• Organization name, membership, roles, invitations
• Profile settings and language preference
• Support/communications you send us

2.2 Customer Data

• Property / project records, expenses, income, categories, settlement and capital fields
• Payroll / labor / attendance-related records you enter
• Uploaded receipts, documents, and photos
• Optional messages/media sent into the Service via integrations (e.g. WhatsApp) when enabled
• AI extraction outputs derived from your media (subject to human review before ledger reliance)

2.3 Usage and device data

• Approximate product usage metrics and diagnostics
• Standard server/security logs
• Site analytics (e.g. Vercel Analytics) on the marketing/app site

We do not ask for payment card data in-product while billing remains a stub; if paid plans launch, payment data will be handled by a payment processor under its terms.

• Provide, secure, maintain, and support the Service
• Authenticate users and manage organizations
• Process uploads and run assistive AI extraction you enable
• Apply product retention rules (including media purge after property close/sale)
• Communicate about the Service (transactional email such as verification, invites, password reset)
• Improve reliability and understand aggregate usage
• Comply with law and enforce our Terms

Assistive AI (including vision models) may process receipt/document images to suggest fields. Outputs can be wrong. Humans in your organization should review before relying on extracted values. AI inference may be performed by Cuadre and subprocessors (local models in some environments; cloud model gateways in others). Whether any vendor uses prompts/outputs to train foundation models is subject to vendor contracts — treat training policy as pending counsel confirmation.

After a property is marked CLOSED or SOLD (or equivalent terminal status), associated media objects may be automatically deleted from object storage after a retain window. The product default is thirty (30) days (MEDIA_RETAIN_DAYS_AFTER_CLOSE), configurable by Cuadre operations policy. Export records you need for legal/tax retention before purge. Ledger metadata may outlive media files depending on product behavior.

We share information with:

• Infrastructure subprocessors needed to run the Service (categories include: Postgres hosting such as Neon; application hosting such as Vercel; object storage such as AWS S3 or Cloudflare R2; email delivery; optional job/queue providers; optional WhatsApp/SMS providers such as Twilio; AI inference providers/gateways)
• Organization admins and members according to roles your org configures
• Professional advisors / authorities when required by law or to protect rights and safety
• Successors in a merger, acquisition, or asset transfer (with notice where required)

We do not sell personal information for money. We do not claim “no sharing” under every advertising law definition while site analytics may run — a dedicated Cookie Policy and subprocessors list should refine this.

• Org admins can invite/remove members and manage much Customer Data in-product
• You may request access, correction, or deletion of personal data we control by contacting us (see Contact). We may need to verify the request and will explain if an exception applies
• California residents may have additional rights under CCPA/CPRA when thresholds apply; we provide this notice as a hook and do not claim certified CCPA compliance
• If GDPR applies to you in the future, additional rights may apply; we do not claim GDPR readiness today

We use organizational and technical measures appropriate to a multi-tenant SaaS product (including organization-scoped access controls). No method of transmission or storage is perfectly secure.

The Service is operated with US-centric infrastructure today. If you access from other countries, your information may be processed in the United States and other locations where our providers operate. Transfer mechanisms for EU/UK data (e.g. SCCs) will be addressed in a DPA when offered.

The Service is for business use by adults (18+). We do not knowingly collect personal information from children.

We may update this Privacy Policy by posting a new version and updating the “Last updated” date. Material changes may also be called out in-product or by email to org admins when practical.

Privacy questions: [TBD: privacy@getcuadre.com or confirmed inbox] · Website: https://getcuadre.com · Operator: Cuadre (getcuadre.com) — legal entity name to be updated.