Draft for lawyer review. This notice is not in effect yet. Items in highlighted [brackets] are still to be decided.
Privacy notice
Last updated: [date]
Cadena LLC (“Cadena”, “we”) is a Pennsylvania company. We set up and run back-office work for small businesses: invoices, emails, forms and records. This notice explains what data we handle, why we handle it, where it is stored, and how you can get it exported or deleted.
It covers two things:
- this website, cadenadesk.com;
- the work we do for our clients (the businesses we work for), and the data about their customers that comes with it.
This website
- No forms, no cookies, no ad trackers. This site doesn’t ask for your name or email, and it doesn’t set cookies. [Update this line if analytics are ever added.]
- Server logs. Like any website, our server notes a few technical facts about each visit, such as the IP address, the browser and the page asked for. We use them only to keep the site working and safe, and we delete them after [X] days.
What we collect from clients
About you (our client) and your staff
- Contact and billing details: names, email addresses, phone numbers and business address.
- Your business profile: services, prices, the way you like to word things, and who can approve actions.
- Log-ins for accounts you connect, such as a vendor portal username and password. We store these encrypted.
- Records of what Cadena did: drafts, the approval queue, approvals and rejections, and a log with times.
- Basic technical logs, such as the IP addresses and times of visits to our approval page.
About your customers, only as needed to do the work
- Names, job addresses and contact details that appear on jobs, invoices or payment requests.
- Job and invoice details: PO or job numbers, line items, amounts and dates.
- Email messages and drafts we handle for you. [Confirm: does the server keep full email text, or only drafts and summaries?]
We don’t ask for Social Security numbers, bank account numbers or health information. Please don’t send them to us unless a task truly needs them.
Why we use it
We use this data only to:
- do the work in your service agreement: prepare drafts, ask for your approval, send or submit what you approve, and keep the log;
- bill you;
- help you and fix problems;
- keep the service secure;
- meet our legal duties.
What we never do
- We do not sell your data or your customers’ data.
- We do not use your data or your customers’ data to train AI.
- Cadena’s server does not send your data to any AI company.
The AI work happens inside your own ChatGPT Business account, under your own agreement with OpenAI. OpenAI says that by default it does not use ChatGPT Business data for training. You can check this in your account’s data settings.
Where it is stored, and who helps us
Cadena’s server and database are run by Hetzner Online GmbH in a data center in Germany (EU), on open-source software (Coolify, PostgreSQL).
| Company | What it does | Where |
|---|---|---|
| Hetzner Online GmbH | Hosts Cadena’s server, database and daily backups | Germany |
| OpenAI | Runs ChatGPT in your account. You hold the account and the contract with OpenAI. | Under OpenAI’s terms |
| Runs Gmail and the script in your mailbox. You hold the account. | Under Google’s terms | |
| [Backup storage provider] | Encrypted backup copies kept off site. [Publish this row only once off-site backups exist.] | [Location] |
| [Other provider, if any] | [For example, Cloudflare for the domain, or a payment processor] | [Location] |
When you approve a submission, the details go to the service you chose, such as a vendor portal. That service’s own privacy terms then apply.
How long we keep it
- While you are a client: as long as the work needs it.
- Log-ins: deleted within [X] days after the service ends, or right away if you take back access.
- Everything else: deleted within [X] days after the service ends, or after we send your export if you ask for one.
- Backups: copies are written over on a rolling basis within [7] days. [Add the off-site backup period.]
- Billing records: kept for [7] years for taxes and accounting.
How we protect it
- Log-ins are stored encrypted. Data travels over encrypted connections (HTTPS).
- The server sits behind a firewall. Admin access needs a security key that only Cadena’s owner has, and the admin dashboard is not on the public internet.
- Nothing is sent or submitted without your approval, and every action is logged.
- The server and database are backed up every day.
- If we learn that someone got into your data without permission, we will tell you quickly and help you tell anyone affected.
No system is perfectly safe, but we work to keep these protections in place and up to date.
Your choices: export and deletion
Clients can ask us at any time to:
- export their data, as [CSV/JSON] files;
- correct their data;
- delete their data.
We will answer within [30] days. Deleting some data may stop the work that depends on it.
Your customers: if one of your customers asks about their data, we will help you answer. Customers can also contact us directly, and we will pass the request to you.
Contact
Cadena LLC. Contact details are coming soon.
We may update this notice. If we make a big change, we will email clients before it takes effect.