This Privacy Policy explains how Asqria Labs, Inc., a Delaware corporation that operates Cadr (“Cadr,” “we,” “us,” or “our”), collects, uses, discloses, and protects information when you visit cadr.ai, create an account, or use the Cadr agent service (together, the “Service”). By using the Service, you agree to the practices described here.

1. Information we collect

Information you provide

Account details: your name, work email, company or business name, and answers to our onboarding questions (e.g., team size, use cases, approximate revenue band, monthly AI budget band).
Workspace content: instructions, goals, rules, skills, notes, files, and other content you or your teammates provide to configure or direct your agent.
Communications: messages you send to ping@cadr.ai, support chats, call recordings you schedule via Cal.com, and feedback.
Billing details: if and when paid plans launch, billing contact and payment information handled by our payment processor (we do not store full card numbers).

Information from connected tools

When you connect a third-party tool (for example Gmail, Slack, Google Drive, or other integrations offered through our integration partner Composio), we receive the OAuth tokens, scopes, account identifiers, and data those tools expose under the permissions you approve. This may include orders, inventory, messages, contacts, documents, analytics, and other data necessary to perform the tasks you assign to your AI employee. We only request the scopes required for the skills you enable, and you can disconnect a tool at any time from your workspace settings.

Information collected automatically

Usage & device data: pages visited, clicks, feature usage, referrer, approximate location (derived from IP), browser, operating system, and device type.
Log data: IP address, timestamps, request paths, error traces, and performance metrics.
Cookies & similar technologies: we use a small number of cookies and browser-storage items to keep you signed in, remember preferences (such as theme), and power analytics.

2. How we use information

Operate, maintain, and improve the Service and your agent’s performance.
Authenticate you, provision your workspace, and sync with the tools you connect.
Respond to support requests and communicate about changes, features, security, and billing.
Measure engagement and diagnose issues with product analytics and error monitoring.
Prevent fraud, abuse, and violations of our Terms; enforce our policies.
Comply with legal obligations and respond to lawful requests.

We do not sell your personal information, and we do not use your workspace content or data from connected tools to train foundation models for third parties.

3. AI models and prompt data

Your agent runs on large language models hosted by providers such as Anthropic and OpenAI. When a task runs, we transmit the minimum necessary prompt data, which may include content you authored and data fetched from your connected tools, to these providers to generate a response. We contractually require that these providers do not use your content to train their models. Model outputs may be imperfect; review anything sensitive before acting on it.

Your email

When you connect your own mailbox (Gmail, Outlook, or any IMAP mailbox) to Mail in Cadr, we copy your recent mail into your workspace so you can read, search, and answer it there, and we fetch older mail from your provider when you search for it or open it. We use your mail only for features you use yourself: showing your mail, sending, replying, and organizing it on your instruction, and, when you ask, having Cadr summarize a thread, draft a reply for you to check, or answer a question about a message. Any change made in Cadr goes to your provider. Cadr never sends or changes your mail without your confirmation.

Google user data

Cadr’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

We use Gmail data only to provide and improve the user-facing features described above, which you can see and use in Mail and in your chat with Cadr.
We do not use Gmail data to train, fine-tune, or improve any shared or general AI or machine learning model, ours or anyone else’s. When Cadr helps with your mail, the model reads it only to answer your request, under terms that forbid the model provider from training on it.
We do not use Gmail data for advertising, and we do not sell it or transfer it to data brokers.
No person at Cadr reads your Gmail data unless you have given us documented consent for specific messages (for example, to look into a support request), it is needed for security purposes such as investigating abuse, it is required by law, or the data has been aggregated and anonymized for internal operations.
We transfer Gmail data to others only as needed to provide these features (for example, to the service providers that host and process it for us), to comply with law, or as part of a merger or acquisition with notice to you.
You can disconnect your mailbox at any time. When you do, or when you ask us at ping@cadr.ai, we delete the mail we copied from it within 30 days.

4. How we share information

We share information only in the following cases:

Service providers & sub-processors who run infrastructure on our behalf, including Neon (database), Cloudflare (hosting and file storage), Composio (integration broker for third-party tools), Anthropic and OpenAI (model inference), PostHog (product analytics), and our email, hosting, and error-monitoring providers. Each is bound by a data-processing agreement.
Third-party tools you connect: data flows between Cadr and the tools you authorize, subject to each provider’s own privacy policy.
Within your organization: teammates invited to your workspace can see workspace content and activity relevant to their role.
Legal & safety: we may disclose information to comply with law, enforce our Terms, or protect the rights, property, or safety of Cadr, our users, or the public.
Business transfers: in connection with a merger, acquisition, financing, or sale of assets, with notice where required by law.

5. Data retention

We keep information for as long as your account is active and as needed to provide the Service. When you disconnect a tool, we delete the associated OAuth tokens promptly. When you delete your workspace or request account deletion, we remove your workspace content within 30 days, except where we must retain data to comply with legal, accounting, or security obligations, or in anonymized/aggregated form that cannot reasonably be linked back to you.

6. Security

We protect information with industry-standard controls, including TLS in transit, encryption at rest, scoped access credentials, audit logs, principle-of-least-privilege access, and regular security reviews. No system is perfectly secure. If we learn of a breach that materially affects your data, we will notify you as required by law.

7. Your choices and rights

Depending on where you live, you may have the right to:

access, correct, or delete the personal information we hold about you;
port your data in a commonly used format;
object to or restrict certain processing;
withdraw consent where we rely on it; and
lodge a complaint with your local data-protection authority (for example, under the GDPR or UK GDPR).

To exercise any of these rights, email ping@cadr.ai. We will respond within the timeframes required by applicable law. California residents can exercise CCPA/CPRA rights through the same address; we do not sell or share personal information as those terms are defined under California law.

8. International data transfers

Cadr is operated from the United States. If you access the Service from outside the United States, your information will be transferred to, stored, and processed in the United States and other jurisdictions where our service providers operate. Where required, we rely on Standard Contractual Clauses or equivalent safeguards for cross-border transfers.

9. Children

The Service is not directed to children under 16, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.

10. Third-party links

The Service may link to third-party websites or embed content from third parties (for example, Cal.com for scheduling). Their privacy practices are governed by their own policies.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date above and, for material changes, provide additional notice (for example, by email or an in-product banner). Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

12. Contact us

Questions, requests, or concerns? Email ping@cadr.ai. We read every message.