Privacy policy

1. Introduction

This Privacy Policy explains how Part Central Limited, trading as Cady ("we," "our," or "us"), collects, uses, discloses, and safeguards your personal data when you use our company workspace, web app, agent connection, and website ("Services"). We are committed to protecting your privacy and complying with applicable data protection laws, including the UK General Data Protection Regulation (UK GDPR) and the EU General Data Protection Regulation (EU GDPR).

Part Central Limited acts as controller for account administration, billing, security, support, and its own communications. When we process personal data in your company workspace on your company’s instructions, we act as processor under our Data Processing Agreement. Your company is responsible for its purposes, lawful basis, and notices for that processing.

Our Services support companies and their authorised founders, owners, and operators, including solo founders. Business contact details, CRM records, project notes, and files can be personal data even when used for business purposes.

2. Our Contact Information

If you have any questions about this Privacy Policy or our data protection practices, or if you wish to exercise your data protection rights, please contact us:

• Data Controller: Part Central Limited, trading as Cady
• Entity Details: Company 15296116, England and Wales; registered office: Apartment 22, 23 Albert Embankment, London, England, SE1 7GG
• Data Protection Email: data@cadyworks.com
• EU Representative (Article 27 EU GDPR): Mr Eric Shen, Kirjokansi 1 A 25, 02100 Espoo, Finland; team@cadyworks.com. People in the EEA and EEA supervisory authorities may contact our representative, in addition to or instead of us, about any matter concerning our processing of personal data.

We are established in the United Kingdom, so we have not appointed a UK representative. We have not appointed a data protection officer. data@cadyworks.com reaches the people responsible for data protection.

3. Data We Receive Through Your AI Agent Connection

You can connect your own AI agent, such as ChatGPT or Claude, to Cady using the Model Context Protocol (MCP). You approve each connection by signing in to Cady and consenting to the scopes the agent requests. Connection permissions control technical access; they do not establish consent or another lawful basis for processing other people’s personal data.

3.1 What We Receive

When your agent calls a Cady tool, we receive:

• Tool requests: The arguments and content your agent sends to Cady to read or change company records on your behalf.
• Connection records: The approved scopes, the client that was approved, and records of when the connection was created, used, refreshed, or revoked.

We do not receive your conversation with your agent, other than what your agent sends to Cady in a tool request.

3.2 What Your Agent Receives

Tool responses may include company records and personal data relevant to your request. Your agent provider processes those responses under its own terms, your account settings with that provider, and its privacy policy.

3.3 Other Integrations

Your chosen agent may separately connect to email, calendar, document or other services. Cady does not gain access to those accounts merely because you connect that agent; Cady receives the content the agent submits in a tool call. Our own account, invitation, support and notice emails are separate flows described below.

3.4 Mailbox, Calendar and File Connections

If your company connects a Google or Microsoft account to Cady, Cady itself accesses that account with the permissions shown on the provider’s consent screen. Depending on the features you choose, that means: reading messages to find replies, opt-outs and bounces to mail Cady sent for your company, for up to the last 30 days of mail; sending messages your company has approved; reading and writing calendar events; and reading, creating and updating files in Google Drive or Microsoft OneDrive.

For Google, the permissions are Gmail (read, change and send mail, without permanent deletion), Google Calendar events, and Google Drive (read-only access, plus per-file access to files Cady works on). For Microsoft, they are Outlook mail (read, write and send), calendar (read and write) and OneDrive files (read and write). We store the provider access credentials encrypted. When we read a mailbox to find replies and bounces, we do not store the message bodies; we record the outcome (a reply, an opt-out or a bounce), the sender or recipient address, the time and a reference to the message in your company’s CRM.

We use this data only to provide these features to your company, as processing on your instructions under our Data Processing Agreement, which covers these connections. Google and Microsoft provide the accounts you connect; they are not our sub-processors for this. Messages that do not match mail Cady sent for your company are read only to check that and are not kept. We do not sell it or use it for advertising. You can disconnect an account at any time in Cady settings, or in your Google or Microsoft account. Cady’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

4. How We Use Your Data and Our Commitment to Data Protection

4.1 We Do NOT Sell Your Data

We do not sell personal data or share it for cross-context behavioural advertising. We disclose data only for the purposes described in this notice, including authorised service delivery and your instructions.

4.2 Purpose Limitation

We use company workspace data on your instructions to deliver the requested Services, including the purposes below. Separately, we process account, billing, security, support, and our own communication data for the controller purposes and lawful bases described in this Policy.

• Maintaining company context, working records, roles, and access permissions
• Planning and tracking company work in Projects
• Managing company contacts and relationships in the CRM
• Storing and organising company files
• On the Pro plan, sharing selected files with outside parties through Datarooms
• Recording approvals and receipts for consequential actions
• Delivering requested records to your chosen AI agent

4.3 GDPR Lawful Basis

For processing where we are controller, we rely on the following bases, subject to applicable law:

• Accounts and service administration: legitimate interests in supplying and administering our business service for company representatives, assessed against their rights; performance of our contract where the customer is an individual sole trader.
• Billing and tax: contract for individual customers or legitimate interests in administering the company customer relationship for representatives; legal obligations for required accounting and tax records.
• Security and abuse prevention: legitimate interests in protecting users, confidential content and the service, using necessary and proportionate information; legal obligation where a specific applicable law requires a particular activity.
• Support and enquiries: legitimate interests in responding and resolving service issues, or performance of a contract with the individual where necessary for that contract. Workspace content supplied for customer-directed support remains subject to the DPA for that processing.
• Standard guest agreement and claims: performance of the access contract accepted by the individual guest where necessary; legitimate interests in retaining limited evidence to establish, exercise or defend legal claims.
• Our marketing: consent where required, or legitimate interests for legally permitted business communications after assessing the impact on recipients. Individuals may object to direct marketing at any time; consent may be withdrawn without affecting earlier lawful processing. We do not treat service use or a guest code as marketing consent.

Workspace personal data may come from you, other members of your company, your connected agents, or public sources. Your company must assess its lawful basis, give required privacy information to affected people (including where data is obtained indirectly), and honour applicable objections and communication rules before contacting them or sharing their data. Public availability does not remove these responsibilities.

5. What Personal Data We Collect

We collect various categories of personal data, including:

• Identity and Contact Data: Your name and email address.
• Account Data: Your sign-in records, including your password (stored only as a salted hash), one-time email verification and password-reset codes (stored only in hashed form and valid for 5 minutes), passkey public keys and credential identifiers (we do not receive your private key or biometric data), and, if you choose to sign in with Google, Microsoft or GitHub, the account identifier, name and email address that provider returns. Also session records, company memberships and roles, marketing opt-in preferences and account settings.
• Company Data: Company name and other company details you provide.
• Agent Integration Data: Tool arguments and context you select or submit through your chosen agent host, tool responses, authenticated connection details, and request metadata, as described in Section 3. Connecting a host does not give Cady automatic access to every conversation in that host.
• Workspace Content Data: Projects, CRM records, files, and other business information and documents you, your company’s members, or your agents submit or upload.
• Dataroom Guest Data: When your company shares a dataroom with an outside party, that person’s email address, one-time code verification records, acceptance of Cady’s standard guest terms and any separately accepted customer terms, the relevant terms versions, acceptance time and share/session reference, and records of views and downloads.
• Financial Data: Payment card details are entered directly with Stripe through Stripe Checkout or the Stripe Customer Portal; we do not receive or store full card details. We receive billing contact details, billing address, tax identifiers, subscription status, and invoice records from Stripe.
• Technical Data: IP address, browser type, and device information needed to deliver and secure the Services. In security and access records we generally store a keyed hash of the IP address rather than the address itself.
• Security Check Data: On company sign-up and dataroom code request pages only, Cloudflare Turnstile checks whether a request comes from a person. It processes technical information to assess whether traffic is automated; this may be personal data.
• Usage Data: Information about how you use our Services, including feature usage and performance data.

We collect this data from you, from other members of your company (for example when they invite you), from your connected agents, from Google, Microsoft or GitHub if you sign in with them, from Stripe for billing, and from our own systems when you use the Services. You need to give us your email address to create and use an account; without it we cannot provide the Services. Other information is optional unless a feature you choose needs it.

6. AI Processing and Automated Decision-Making

Cady uses Cloudflare Workers AI and Vectorize for some AI and search features; most AI analysis, research and drafting is performed by the agent you choose to connect:

• How Data is Used: Cady stores, organises, and returns company records. Any AI analysis, research, or drafting is performed by the AI agent you choose to connect.
• Your chosen agent: When you connect Cady to ChatGPT, Claude, or another agent host, tool responses may include company records and personal data relevant to your request. That host processes the responses under its own terms, account settings, and privacy policy. A provider you select and contract with independently is not a Cady-engaged subprocessor merely because you connect it. Our DPA does not replace your agreement with that provider, but it continues to govern our own processing and authorised disclosure.
• No solely automated decisions: We do not make decisions about you based solely on automated processing, including profiling, that produce legal or similarly significant effects. Agents connected to Cady act on your company’s instructions, within the permissions your company sets, and consequential actions can require a person’s review.
• Your Rights: Where applicable law provides rights relating to decisions based solely on automated processing, those rights apply subject to its conditions, including safeguards such as human intervention. Contact us if you have concerns.

7. Data Sharing and Disclosure

We do not sell your personal data. We do not share your data for advertising purposes.

We may share data with:

• Cloud Hosting: Cloudflare hosts our website and the Cady app (Cloudflare Workers), our databases (Cloudflare D1), and stored files (Cloudflare R2). Each company’s main server is in the US or the EU, as shown in its settings (see International Data Transfers). Cloudflare Workers AI and Vectorize support AI and search features.
• Email Delivery: Our configured email delivery service receives the recipient address and message content needed to send verification and password-reset codes, invitations, guest access messages and account notices. We send these emails using Cloudflare Email Sending.
• Website Email Subscriptions: When website email delivery is enabled, we use EmailOctopus to manage requested Field Notes and early-access email subscriptions, including email confirmation, unsubscribe preferences and delivery status. Only the address and subscription information needed for the selected purpose are shared; signing up does not create a Cady app account.
• Payment Processors: Stripe for secure payment processing, subscription billing and invoicing, and for tax where we are required to charge it.
• Password Safety Check: When you set a password, we check it against the Have I Been Pwned Pwned Passwords range service (api.pwnedpasswords.com) to refuse passwords known from data breaches. We send only the first five characters of the password’s SHA-1 hash, never the password, your email address or any account detail; the service returns the matching hash suffixes and we compare them ourselves. If the service is unavailable or slow, the check is skipped.
• Support Email: Support and data-protection correspondence is routed through our email services to our support inbox. Email to team@, data@ and legal@cadyworks.com is forwarded by Cloudflare Email Routing to the Part Central Limited mailbox, which is hosted on Google Workspace (Google Cloud EMEA Limited), with processing on Google infrastructure that includes the United States.
• Your Company and Its Agents: Members of your company, according to their roles, and the AI agents they connect, within the scopes they approve.
• Dataroom Guests: Outside parties your company chooses to share specific files with, after they verify their email address.
• Operational Monitoring: Limited service-health, security and usage information for operating the service. Pseudonymised identifiers remain personal data. Application logs are kept within Cloudflare. Better Stack checks our public endpoints for our status page at status.cadyworks.com and does not receive customer personal data.
• Legal Requirements: When required by law or legal process.
• Customer References: With your organisation's permission under our Terms of Service, we may display your organisation's name and logo on our website. This identifies your company, not any individual. We do not publish the names, photos or roles of individual users as customer references without their separate, explicit consent, and either can be withdrawn at any time by emailing data@cadyworks.com.

8. Data Security

Company workspace access is company-scoped. Requests without an authorised company context fail closed. We implement security measures including:

• Encryption in transit (TLS) and automatic AES-256 encryption at rest for D1 and R2, as documented by Cloudflare. Provider encryption is not end-to-end encryption against Cady or the storage provider
• Sign-in with a passkey, a password or a Google, Microsoft or GitHub account, with email verification; company roles and permissions; and passkey review for designated consequential actions
• Security testing and review of access controls and application changes. We do not claim SOC 2 or ISO 27001 certification, or a completed independent penetration test, unless identified with its actual scope and date
• Incident response procedures for data breaches

If a personal data breach affects data we control, we will notify the ICO or other competent supervisory authority within 72 hours of becoming aware of it where the law requires, and tell affected people without undue delay where the breach is likely to result in a high risk to them. If it affects workspace data we process for a customer, we notify that customer without undue delay under our Data Processing Agreement.

9. Your Data Protection Rights

Depending on the processing, your location, and applicable legal conditions, you may have the following rights:

• Access: Request copies of your personal data
• Rectification: Request correction of inaccurate data
• Erasure: Request deletion of your data
• Restriction: Request restriction of processing
• Data Portability: Request transfer of your data
• Objection: Object to processing based on legitimate interests. You have an absolute right to object to use of your personal data for direct marketing, including related profiling. Use the opt-out in the message or contact data@cadyworks.com; we will stop that marketing processing.
• Withdraw Consent: Withdraw consent where it is the lawful basis. You can also revoke your AI agent connections in your Cady settings.
• United States state rights: US rights vary by state and processing role. Where applicable law provides them, you may request access, correction, deletion or a copy; opt out of sale or sharing, targeted advertising or certain profiling; or appeal a request decision. Tell us your state and the account or company concerned. We assess requests for our own controller data, and route workspace requests to the relevant customer and assist it. We do not discriminate for exercising applicable rights, and accept authorised-agent requests where required, subject to appropriate verification.

Admins may request a company export; an individual may request account closure, and an Admin may request company deletion. Contact data@cadyworks.com if the relevant in-app control is unavailable. Workspace closure, subscription cancellation and an individual’s statutory rights request are handled separately. A workspace cancellation period does not automatically postpone an individual’s rights request. For workspace content we process for a customer, we assist that customer with the request rather than independently deciding its lawful purposes.

To exercise rights or raise a data-protection complaint, contact us at data@cadyworks.com.

We will acknowledge a data-protection complaint within 30 days, investigate without undue delay, keep you informed and communicate the outcome. This does not extend any shorter deadline for a rights request or prevent you contacting a regulator. You can also complain to the relevant supervisory authority, including the Information Commissioner's Office (ICO) in the UK at www.ico.org.uk, or the data protection authority in the EEA country where you live or work or where you think an infringement took place. Applicable United States law may also provide a complaint route to your state attorney general or privacy regulator.

10. Revoking AI Agent Connections

You can revoke an AI agent’s access to Cady at any time:

• Cady Settings: Revoke the connection from your Cady account settings
• Your agent host: Remove the Cady connection in your agent’s own settings

Revocation withdraws the connection’s authority for subsequent requests. Active transfers and delegated jobs stop at their next required authority check. Data already received by an agent or guest is not recalled or remotely erased by revocation; requests concerning those copies may also need to go to the recipient.

11. Data Retention

We keep personal data only for its stated purpose and the periods below. We may retain a limited record longer where an identified legal obligation or an actual legal claim requires it; access is restricted, the reason and review date are recorded, and deletion follows when that reason ends. These exceptions do not permit indefinite retention of the whole workspace.

Customer workspace content, temporary exports, recovery copies and customer-directed access history follow the DPA Retention Schedule: the applicable service and exit periods, workspace deletion carried out by our operators after the cancellation window and any retrieval period (earlier where law or a valid instruction requires, including at the end of applicable Data Act retrieval), recovery-copy expiry no later than 35 days from creation, ordinary operational logs up to 30 days, security logs up to 90 days, and guest access history up to 90 days unless another justified period is agreed. An individual rights request is assessed separately and is not automatically delayed by the 30-day company-closure cancellation window.

For our own controller purposes, we retain active account and membership records during the relationship and remove or minimise them within 30 days after their operational purpose ends. We retain limited evidence of our contract and standard guest terms acceptance, including the accepted version, party, time and relevant share reference, for six years after that contract or guest access ends for legal claims. This is a claims-retention policy; that acceptance evidence excludes routine views, downloads and access logs, which follow their shorter schedule unless a separate, documented lawful exception applies. Customer-specific NDA evidence is processed on the customer’s instructions.

Support correspondence is retained for up to 12 months after the matter closes, unless a shorter period is appropriate or a specific ongoing incident, claim or legal duty requires longer. Website waitlist and Field Notes records separately contain an email address, signup time, purpose-specific consent receipt and delivery/recovery status. When you arrive through a campaign link, we also save its bounded source, medium, campaign, content and term labels with your signup to understand which posts bring signups. We do not store the full referring URL or use browser storage for these labels. Waitlist consent is for confirmation and early-access invitations; newsletter consent is for Field Notes. Neither subscribes you to the other. You can unsubscribe using the link in an email or contact data@cadyworks.com. We stop eligibility on opt-out and keep the minimum hashed address, purpose and date needed to respect it, so a later import or repeated signup cannot override your preference. Signup eligibility expires after 12 months. Plaintext records that have not been sent to the email provider can then be removed; records needed to resolve an uncertain provider request or complete provider unsubscribe are restricted to that recovery purpose and removed once it is reconciled. Provider opt-outs, bounces and complaints are reconciled with our subscription records. Website signup abuse prevention uses short-lived rate-limit keys; signup records do not store IP addresses. Relevant invoices, credit notes and supporting accounting records are ordinarily retained for six years from the end of the relevant company financial year, or longer where law requires.

Authentication credentials expire or are revoked under their security rules. We do not retain usable sign-in codes or session authority merely to prove contract acceptance. Backup data awaiting expiry is unavailable for ordinary use, and any restore reapplies deletions and revocations before access resumes. We do not use a storage lock as an independent reason to refuse a valid erasure request.

12. International Data Transfers

Your company’s main server is in the US or the EU. It is set when the company is created, and you can see it in settings. We and our sub-processors may process personal data in other countries, including the United States. For example, requests, AI features, search, queues, email, support and monitoring may run on our providers’ global networks, and Stripe has international operations. Our sub-processors and their locations are listed on our Subprocessor List.

We are based in the United Kingdom. Transfers of personal data from the EEA to us rely on the European Commission’s adequacy decision for the UK, and transfers from the UK to the EEA rely on the UK’s adequacy regulations for the EEA.

When we transfer personal data from the UK or the EEA to a country without an adequacy decision, we use a recognised safeguard, such as:

• the EU Standard Contractual Clauses;
• the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses;
• the EU-US Data Privacy Framework and its UK Extension, where the recipient is certified.

For more information about these safeguards, contact data@cadyworks.com.

13. Children's Privacy

Our account service is intended for business users aged 18 or over. Customers must not use it to provide a service directed to children without our written agreement and appropriate safeguards. Age restrictions on account holders do not mean that every record uploaded by a customer is necessarily about an adult.

14. Changes to This Policy

We may update this Policy from time to time. Significant changes will be communicated via email and posted on our website. Our Cookie Policy explains the cookies and similar storage we use.