Who we are
Cadi is a software service operated by Cadi Software Ltd (company number 17174156, registered in England and Wales) (“we”, “us”, “our”). Our registered office is Unit 4, Grovelands, Hemel Hempstead HP2 7TE. You can contact us at support@cadi.cleaning.
We are the data controller for the personal data you give us when you visit cadi.cleaning, join the waitlist, take the quiz or use Cadi.
What data we collect
We collect and process the following categories of personal data:
- Waitlist and enquiries — your email address, and anything else you send us, such as your name and company when you ask for a Cadi Connect demo
- Quiz answers — if you give us your email on the quiz result, we keep your answers and result with it
- Account information — your name, email address and password (hashed)
- Business information — your business name, address and trading details
- Financial data — invoices, payments, expenses and the transactions in bank statements you choose to upload
- Customer & staff data — names, contact details, addresses and job history for the customers you add, and details and compliance documents for the staff you add
- Compliance documents — insurance, DBS and other certificates you upload, with their dates
- Payment information — billing details processed via Stripe (we do not store card numbers)
- Technical data — error reports from the app, and the browser and device information that comes with them
How we use your data
We use your personal data to:
- Provide and maintain the Cadi service, including Cadi Connect
- Contact you about the waitlist, and invite you in when a place opens
- Respond to demo requests and questions
- Process subscription payments via Stripe
- Send service emails, such as account, billing and important updates
- Find and fix errors in the app
Our lawful basis is contract performance (providing the service you signed up for), your consent (for the waitlist and quiz emails, which you can withdraw at any time using the unsubscribe link) and our legitimate interest in keeping the service secure and working.
Support access to your account
If you ask us to help with something that requires it — for example, emailing us your customer list and asking us to import it for you — a member of our team may securely sign in to your account to complete that specific task. We only ever do this to carry out something you have asked us to do.
Any such access is limited to the task you requested, our staff are bound by confidentiality, and every sign-in of this kind is logged in our systems. The lawful basis is your explicit request and contract performance. You can ask us at any time what access has taken place, and you never have to share your password with us.
Bank statements
Cadi does not connect to your bank. Bank data only reaches Cadi when you export a statement from your bank and upload it. We use the transactions in it to categorise your income and costs, match payments to invoices and estimate what to set aside for tax.
We never have your bank login details, and we cannot move money or make payments.
Cadi Connect
If you use Cadi Connect, the facilities companies and managing agents you work with, or who find you, can see your business details, your compliance documents and their dates, your Cadi Score, and the work they have given you.
They cannot see your other customers, your prices, your invoices, your bank statements, your staff or your reports. In the same way, a cleaning business sees only the work a facilities company has given it.
Scheduler — maps, geocoding and weather
The Scheduler displays customer locations on small route maps and uses weather forecasts to flag rain-affected jobs. To do this we send limited data to three external services:
- postcodes.io — your customers’ postcodes are sent to this free UK postcode lookup service to convert them into map coordinates. No customer name or contact details are sent. Results are cached locally in your browser so each unique postcode is only sent once per device.
- Carto / OpenStreetMap — the map tiles themselves are served by CARTO using OpenStreetMap data. Your IP address and the map area you’re viewing reach these providers (a normal consequence of loading any map).
- Met Office DataHub — we request weather forecasts for the postcode areas you have jobs in. Only the postcode is sent; no customer identity is attached.
None of these services receive financial data or anything Cadi marks as sensitive.
Direct debit collection
If you enable customer direct debit collection, we use GoCardless (FCA FRN 597190) as the payment processor. Your customers’ bank details are entered directly with GoCardless — Cadi never sees them. GoCardless is the controller for the bank details they collect; their privacy policy is at gocardless.com/legal/privacy.
AI processing
Some features (conversational onboarding, the service builder, customer import, statement categorisation, money insights and your monthly plan) use AI models provided by Anthropic. When you use these features, the relevant content you provide is sent to Anthropic for processing.
Anthropic processes this data as our data processor under their commercial terms, does not train on it, and retains it only for the duration needed to return a response (plus short-term abuse-monitoring caches). No passwords or payment card details are ever sent to Anthropic.
Error reports
When something goes wrong in the app, an error report is sent to Sentry (EU region) so we can fix it. Reports include what failed and technical details about your browser. We have switched off session recording, and personal details are stripped from reports before they are sent.
Sub-processors
We share data with these processors solely to provide the service:
- Supabase — database, authentication, file storage and server functions (EU region)
- Vercel — website and application hosting
- Stripe — subscription billing
- GoCardless — customer direct debit collection (when enabled)
- Anthropic — AI features
- Resend — transactional email (welcome, billing, reports)
- Loops — the waitlist, quiz and demo request emails
- Sentry — error reports (EU region)
We do not sell your data to third parties. We do not use it for advertising.
Data retention
We retain your data for as long as your account is active. If you delete your account from Settings, we begin erasure within 7 days and complete it within 30 days, except where retention is required by law (specifically: HMRC requires you keep tax records for 5 years and 10 months from the end of the relevant tax year — anonymised tax-relevant records may be retained for this period).
Waitlist, quiz and demo request details are kept until you unsubscribe or ask us to delete them.
Server logs are retained for 30 days for security and operational purposes.
International transfers
Our primary data store is hosted in the EU (Ireland). Some sub-processors (Anthropic, Stripe, Vercel, Resend and Loops) process data in the United States. These transfers rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses as the safeguard.
Security
We protect your data with: TLS 1.2+ encryption in transit, AES-256 encryption at rest, row-level isolation between businesses, single-sign-on for staff access, principle-of-least-privilege for internal access, and regular dependency updates.
If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and you without undue delay.
Your rights
Under UK GDPR you have the right to:
- Access the personal data we hold about you
- Correct inaccurate data
- Request deletion of your data (“right to be forgotten”)
- Object to or restrict processing
- Data portability
- Withdraw consent to marketing emails at any time
- Lodge a complaint with the ICO (ico.org.uk)
To exercise any of these rights, contact us at support@cadi.cleaning.
Audit log
Cadi keeps an internal log of sensitive actions taken on your account — customer archives and erasures, SAR exports, job deletions, bulk round changes, and invoice payment events. This log is private to you and is provided so you can demonstrate accountability if asked by the ICO or a customer. We never use it for advertising or share it outside your account.
Cookies
Cadi uses only essential cookies, for signing you in and keeping your session secure. We do not use analytics, advertising or session-recording cookies. The cadi.cleaning website saves your quiz progress in your browser so you can pick up where you left off; it stays on your device and isn’t sent to us unless you give us your email.
Changes to this policy
We may update this policy from time to time. We will notify you by email of any material changes. Continued use of Cadi after changes constitutes acceptance.
Questions? Email support@cadi.cleaning · Terms & Conditions