Privacy policy

Scope

In this Policy, “customer” means the business or organization that uses Cascayd, including its authorized users. “Customer website” means a website operated by a customer where Cascayd is installed. The “loader” is the Cascayd script or tag installed on a customer website to send website measurement and interaction data to Cascayd.

This Privacy Policy explains how Cascayd collects, uses, shares, and protects personal information when you visit cascayd.app, use app.cascayd.app, contact us, or use our services. It covers Cascayd’s own processing for its website, app, accounts, support, and service administration. It also covers customer-directed processing when a customer uses Cascayd’s loader, CRM connections, campaign tools, or analytics features on its own website. Third-party websites, applications, and integrations may have their own privacy policies.

Our roles

Cascayd Pty Ltd is based in Victoria, Australia. For the Cascayd website, app, account, and related support, Cascayd decides how information is used to operate and improve the Service. When a customer deploys the loader on its website or connects customer CRM, campaign, or analytics accounts, the customer decides why visitor and related customer data is processed. The customer is responsible for its own website privacy notice and for obtaining consent where required before installing or using the loader. Cascayd does not automatically manage consent for customers.

Customer visitor data is tenant-separated and available only to the customer whose site generated it, customer-authorized integrations, authorized service providers, and authorized Cascayd personnel who need access for support, debugging, security, or service operation. If you are a visitor to a customer website, direct privacy requests about that website’s data to the customer first; Cascayd will route and assist with the request as appropriate.

Information we collect

• Account, contact, and authentication data, such as your name, work email, company, login details, support correspondence, preferences, and account records.
• Onboarding data, such as your website URL and ideal customer profile (ICP) configuration.
• Customer CRM, campaign, and analytics data, including contacts, lifecycle stages, deal and revenue records, campaign context, and connected-account configuration. What we receive depends on the permissions you or the customer authorize.
• Pseudonymous visitor and session IDs from customer sites, URLs and paths, referrer, UTM and ad-click context, timestamps, viewport and operating-system information, pageviews, scroll, click, form, interaction, field-engagement, and success signals, and recognized contact fields when a visitor submits a form.
• Customer website HTML, content, structure, layout, and assets used for website analysis.
• Third-party enrichment data and automated marketing or attribution scoring, when requested by a customer.
• Analytics and diagnostics from Google Analytics, PostHog, Microsoft Clarity, Vercel Analytics, Cascayd systems, and crash-reporting tools. Where applicable, authenticated PostHog events may include a user ID, email, name, page URL, user agent, and error message or stack.
• If a customer continues to a paid plan after the one-week no-card trial, Stripe processes payment-card details on Cascayd’s behalf. Cascayd may retain non-card billing identifiers and plan status needed to associate the paid plan with the account. Cascayd does not store full card numbers or CVCs.

The Loader is intended to collect website-usage and marketing-attribution information, not sensitive personal information. Because customer websites and forms are configured by each customer, Cascayd may receive sensitive information incidentally if a visitor enters it into a field that is sent to Cascayd. For example, a visitor could include sensitive information in a free-text “Where did you hear about us?” response. Customers should configure their websites, forms, and Loader settings so that sensitive information is not sent to Cascayd.

How we collect information

• Directly from you when you create an account, complete onboarding, contact support, or otherwise provide information to Cascayd.
• Automatically from the Cascayd app, customer sites, and loader as they are used, including through analytics, diagnostics, and similar technologies.
• From customer-authorized integrations and enrichment providers, based on the permissions and configuration selected by the customer.

How we use information

We use information to:

• provide, authenticate, secure, support, maintain, and operate the Service;
• connect touchpoints and produce attribution, campaign, CRM, pipeline, and revenue reports;
• provide customer-requested Apollo-, Parallel-, or Bedrock-style enrichment and automated scoring only for marketing and attribution analysis, not high-impact decisions;
• support debugging, maintenance, performance monitoring, abuse prevention, security, analytics, and diagnostics;
• send service, account, and important operational communications;
• administer paid plans through Stripe where applicable, including associating non-card billing identifiers and plan status with an account;
• comply with law and enforce our agreements.

Cascayd currently does not use customer data to build third-party advertising audiences, use customer visitor or CRM data for cross-customer benchmarking, or use customer data to train Cascayd’s own AI models. These statements may change as the Service changes, and this Policy will be updated where appropriate.

Cascayd does not sell personal information.

Legal bases and choices

We process information as permitted by applicable law. Depending on the context, processing may rely on contract or service delivery, legitimate operational interests, legal obligations, or consent where required. The customer controls notice and consent choices for its customer websites.

How we share information

We may share information with:

• authorized service providers that support hosting, storage, authentication, analytics, enrichment, AI or automated analysis, diagnostics, support, and other operations;
• customer-authorized CRM, campaign, analytics, enrichment, and other integrations;
• Cascayd personnel who need access for support, debugging, security, or service operation;
• authorities, advisors, or other parties when required by law, for safety, to protect rights, or to investigate abuse;
• a successor or buyer if Cascayd is involved in a merger, acquisition, financing, reorganization, or sale of assets;
• other parties directed by you or a customer, or with your consent where applicable.

Cascayd does not sell personal information or use it to build third-party advertising audiences.

Retention

We retain information as needed to provide, secure, support, administer, and improve the Service, meet legal obligations, resolve disputes, and maintain necessary records. Verified customer deletion requests will be honored, subject to legal or security records, dispute needs, and normal backup and log overwrite cycles. No fixed public deletion timeframe is currently promised.

International processing

Cascayd is based in Australia, and Cascayd or its service providers may process information outside Australia. Locations and safeguards depend on the service and applicable requirements. Further information may be provided where appropriate.

Your rights and controls

• You can manage browser storage and analytics controls through browser settings and available service controls. Blocking analytics or the loader may affect site functionality, attribution continuity, or measurement.
• Where applicable, you may request access to, correction or deletion of, or object to processing of personal information, and withdraw consent. You may also complain about our handling of information.
• Contact support@cascayd.app for a request or complaint. We may ask for information needed to verify your identity and will respond as required by applicable law. Where applicable, you may escalate a complaint to the Office of the Australian Information Commissioner (OAIC).
• For visitor or CRM data collected for a customer, contact that customer first. The customer controls the relevant notice and choices; Cascayd will route the request and assist as appropriate. Requests about Cascayd’s website, app, account, or direct interactions can be handled directly by Cascayd.

Security

We use reasonable administrative, technical, and organizational safeguards appropriate to the risks of processing information. Access is limited on a need-to-know basis. No method of transmission or storage can be guaranteed to be absolutely secure.

Children

The Service is intended for businesses and is not directed to children. We do not knowingly collect personal information from children in a way prohibited by applicable law. Contact us if you believe a child has provided personal information.

Changes to this Policy

We may update this Privacy Policy as the Service or legal requirements change. We will post the updated version and change the date at the top. If a change is material, we will provide additional notice where required. Your continued use of the Service after the updated Policy becomes effective means the updated Policy applies.

Contact

Privacy questions and requests can be sent to Cascayd Pty Ltd at support@cascayd.app.