Meet Caddi in personADVISE AIOct 20–22AI for Mid-Sized LawNov 5Legal InnovatorsNov 17–18

Privacy Notice

Last updated August 25, 2026

Introduction

This Privacy Notice ("Notice") for Caddi Technologies, Inc. (doing business as Caddi) ("we," "us," or "our"), describes how and why we might access, collect, store, use, and share your personal information when you use our services ("Services"), including when you: (i) visit our website at https://www.trycaddi.com/ or any website of ours that links to this Privacy Notice; (ii) use our Caddi workflow automation platform; (iii) engage with us in other related ways, including any sales, marketing, or events; or (iv) register and use our AI Products (as defined below). Please read this Notice carefully. By using our Services you agree to our privacy practices described in this Notice.

‍

Our Role

We provide workflow automation services to business customers. Our relationship to personal information depends on how it reaches us.

Where we collect information directly from you, such as when you create an account, contact us, or visit our website, we determine how that information is used and this Notice describes those practices.

Where our business customers use the Services to record their own workflows, connect their own systems, and run automations, the content processed through the Services is controlled by that customer, not by us. That content may include personal information about the customer's own clients, employees, or contacts. We process it on the customer's behalf and in accordance with our agreement with them. If you are an individual whose information appears in a customer's workflow content, please direct privacy requests to that customer, who is responsible for providing notice and obtaining any consents required.

For accounts not covered by a Data Processing Addendum or a written agreement restricting this use, we also use that content to develop and improve our machine learning models, as described under Artificial Intelligence-Based Products below.

Customers who have entered into a Data Processing Addendum with us are subject to the terms of that agreement, which governs our processing of their content and controls over any conflicting provision of this Notice.

‍

Territorial Scope

The Services are offered solely to users located in the United States. We do not offer or direct the Services to individuals in the European Economic Area, the United Kingdom, or Switzerland.

‍

Personal Information We Collect

"Personal information" is information that identifies, relates to, or describes, directly or indirectly, you as an individual, such as your name, email address, telephone number, home address, or payment information.

The personal information that we collect depends on the context of your interactions with us and the Services, the choices you make, and the products and features you use. The personal information we collect may include the following:

  • names;
  • email addresses;
  • phone numbers;
  • billing addresses;
  • debit/credit card numbers;
  • job titles;
  • mailing addresses;
  • usernames; and
  • authentication data.

Account passwords for the Caddi platform are handled by our identity provider and are not stored by us. Where you connect a third-party system that requires credentials, we store the credentials or tokens needed to operate that connection, which in some cases may include passwords or API keys. These are encrypted at rest and used to provide the Services.

We do not intentionally collect sensitive personal information for our own purposes, and you should not provide us with information such as social security numbers. Content that our business customers process through the Services may contain financial account information, communications content, or other categories treated as sensitive under applicable law. Where that occurs, we process that content on the customer's behalf as described under Our Role above, and only for the purposes described in this Notice.

You should not give us any information or data, whether personally identifiable or not, that you do not have the right to give to us.

‍

Recordings and Workflow Content

When you use the Caddi Recorder or otherwise create automations, we collect the recordings, audio, screen content, prompts, conversations, instructions, and configuration data you provide, together with records generated through your use of the Services. These may contain personal information about you and about third parties. Additional detail on the Caddi Recorder is set out in the Addendum at the end of this Notice.

‍

Connected Systems

When you connect a third-party system to the Services, we store the credentials or tokens required for that connection, and we access, retrieve, and write data in that system to provide the Services. This may include the contents of records and documents in the system as well as structural and configuration metadata about it. Data residing in your connected systems remains under your control.

‍

Payment Information

We may collect data necessary to process your payment if you choose to make purchases, such as your payment instrument number and the security code associated with your payment instrument. All payment data is handled and stored by Stripe. You may find their privacy notice here: https://stripe.com/privacy.

‍

Single Sign-On

Our Services allow you to register and log in using a Google account or, for organizations that have configured it, your organization's SAML identity provider. Authentication is handled by our identity provider, Auth0. Where you sign in this way, we receive certain profile information from your identity provider, which typically includes your name, email address, and profile picture. We use that information only for the purposes described in this Notice.

‍

Information We Automatically Collect

When you use our website, we automatically collect certain information about your device, including information about your web browser, IP address, time zone, and some of the cookies that are installed on your device. Additionally, as you browse the Services, we collect information about the individual web pages or products that you view and use, what websites or search terms referred you to the Services, and information about how you interact with the Services. We refer to this automatically collected information in connection with your use of the website as "Device Information".

We may collect Device Information using any of the following technologies:

  • "Cookies" are data files that are placed on your device or computer and often include an anonymous unique identifier. For more information about cookies, and how to disable cookies, visit http://www.allaboutcookies.org. The information generated by the cookie about your use of the website (including your IP address) will be transmitted to and stored by Google. To learn more about Google Analytics and how you can opt out, visit https://tools.google.com/dlpage/gaoptout.
  • "Log files" track actions occurring on the website, and collect data including your IP address, browser type, Internet service provider, referring/exit pages, and date/time stamps.
  • "Web beacons", "tags", and "pixels" are electronic files used to record information about how you browse the website.

We use both session Cookies (which expire once you close your web browser) and persistent Cookies (which stay on your device until you delete them). To make it easier for you to understand why we need them, the Cookies we use on our website can be grouped into the following categories:

  • Strictly Necessary: These Cookies are necessary for the website to work properly. They include any essential authentication and authorization Cookies for our website.
  • Functional: These Cookies enable technical performance and allow us to remember the choices you make while browsing our website, including any preferences you set. They also include sign-in and authentication Cookies and IDs that enable you to return without additional sign-in.
  • Performance/Analytics: These Cookies allow us to collect certain information about how you navigate the portions of the Services running on your device. They help us understand which areas you use and what we can do to improve them.
  • Targeting: These Cookies are used to deliver relevant information related to our website to an identified machine or other device (not a named or otherwise identifiable person) which has previously been used to visit our website. Some of these types of Cookies on our website are operated by third parties with our permission and are used to identify advertising sources that are effectively driving customers to our website.

We use the Device Information that we collect to help us to improve and optimize our Services (for example, by generating analytics about how individuals browse and interact with the website and to assess the success of our marketing and advertising campaigns).

Cookies can be controlled, blocked, or restricted through your web browser settings. Information on how to do this can be found within the Help section of your browser. All Cookies are browser specific. Therefore, if you use multiple browsers or devices to access websites, you will need to manage your Cookie preferences across these environments.

Find out how to manage Cookies on popular browsers:

‍

How We Use Your Personal Information

We use your personal information for the following purposes and as otherwise described in this Notice or at the time of collection:

  • To provide, operate, secure, and improve the Services, including exchanging data with the systems you connect;
  • To process transactions;
  • To improve customer service (your information helps us to more effectively respond to your customer service requests and support needs);
  • To send periodic emails (the email address you provide may be used to send you information and updates pertaining to your purchases, in addition to receiving occasional company news, updates, related product or service information);
  • To develop and improve our machine learning models, as described under Artificial Intelligence-Based Products below;
  • To enforce our terms, conditions, and policies for business purposes;
  • To comply with legal requirements; and
  • For any other purpose with your consent.

‍

Marketing Messages

You may sign up to receive email marketing messages from us. You may opt out at any time by clicking the "unsubscribe" button in the emails you receive. Please note that even if you opt out of receiving the foregoing emails, we may still send you a response to any "Contact Us" request as well as administrative emails (for example, in connection with a details update request) or other emails that are necessary to facilitate your use of the Services.

‍

How We Share Your Personal Information

Service providers. We engage service providers to deliver the Services, including cloud infrastructure and hosting, database and document storage, workflow orchestration, secrets management, authentication, monitoring and observability, AI model inference, payment processing, and customer support. These providers process information on our behalf under written agreement. A current list of our subprocessors is maintained at https://trust.trycaddi.com. Customers with a Data Processing Addendum receive notice of new subprocessors in accordance with that agreement.

Connected integrations. We share your personal information to link your Caddi account to third parties for the purpose of automation integrations, and we transmit data to and from those systems to provide the Services.

Legal and protective disclosures. We may share your personal information to comply with applicable laws, rules, and regulations, to respond to a subpoena, search warrant, or other lawful request for information we receive, or to otherwise protect our rights. We reserve the right at all times to disclose any information as necessary to satisfy any law, rule, or regulation, to avoid liability, or to protect our rights or property.

Business transfers. We may disclose your personal information as part of a corporate business transaction, such as a merger or acquisition, divestiture, or sale of company assets, as part of financing, or in the event of insolvency, bankruptcy, or receivership. In these cases, personal information could be transferred to third parties as a business asset.

We do not sell your personal information, and we do not make customer content available to third parties for their own model development.

‍

Artificial Intelligence-Based Products

As part of our Services, we offer products, features, or tools powered by artificial intelligence, machine learning, or similar technologies (collectively, "AI Products"). These tools are designed to enhance your experience and provide you with innovative solutions. Please note that we do not directly control any data that our business customers pass through our AI Products.

Our AI Products are designed for the following functions:

  • Video analysis
  • Image analysis
  • AI development
  • AI automation
  • AI applications
  • Text analysis

Model development. We do not use the contents of your connected systems to develop AI or machine learning models. This exclusion covers the records, documents, messages, and data we read from or write to those systems, and any data derived from that content. For accounts not covered by a Data Processing Addendum or other written agreement restricting this use, we may use other customer content, such as your prompts, instructions, feedback, and interactions with Caddi, to train, retrain, fine-tune, evaluate, benchmark, and otherwise improve machine learning models. Processing connected-system content to execute, troubleshoot, and improve the operation of your own automations is service operation, not model development, and where Google user data is involved remains subject to the Google API Services section. We do not sell customer content and do not make it available to third parties for their own model development.

‍

Google API Services

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data to develop, train, or improve generalized AI or machine learning models. We do not transfer Google user data to third parties except as necessary to provide or improve the Services, to comply with applicable law, or as part of a merger, acquisition, or sale of assets with notice to you. We do not allow humans to read Google user data except with your affirmative agreement, for security purposes such as investigating abuse, to comply with applicable law, or where the data has been aggregated and anonymized.

‍

Data Security

We have implemented measures designed to secure your personal information from accidental loss and from unauthorized access, use, alteration, and disclosure. All information you provide to us is stored on our secure servers behind firewalls. Information about our security program, including our SOC 2 Type II report and other compliance documentation, is available at https://trust.trycaddi.com.

The safety and security of your information also depends on you. Where we have given you (or where you have chosen) a password for access to certain parts of our Services, you are responsible for keeping this password confidential. We ask you not to share your password with anyone. Please note the information you share in public areas may be viewed by any user of the website.

Unfortunately, the transmission of information via the internet is not completely secure. Although we do our best to protect your personal information, we cannot at all times guarantee the security of your personal information transmitted to our website. Any transmission of personal information is at your own risk. We are not responsible for circumvention of any privacy settings or security measures contained on the website.

‍

Data Retention

We keep your personal information only for as long as necessary for the purposes set out in this Notice, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements). Our standard retention periods are:

  • Workflow execution artifacts: 30 days.
  • Recordings: removed from active storage immediately upon deletion in the Caddi dashboard, and purged from encrypted backups within 30 days.
  • Logs and traces: 365 days, to meet SOC 2 retention requirements.
  • Account and billing records: as required by applicable tax and accounting law.
  • Other personal information: deleted within 90 days of account termination.

Retention periods for certain categories vary by service plan, and customers with a Data Processing Addendum are subject to the retention terms of that agreement.

When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize such information, or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.

‍

Differences by Service Plan

Certain data handling configurations, including observability and tracing routing and retention periods, vary by service plan. Encryption, access controls, tenant isolation, and monitoring are applied uniformly across all plans. Customers on plans with a Data Processing Addendum may have additional configuration entitlements as set out in that agreement.

‍

Account Information and Your Choices

If you would like to review or change the information in your account or terminate your account, you may log into your account settings and update your user account. Upon your request to terminate your account, we will deactivate or delete your account and information from our active databases. However, we may retain some information in our files to prevent fraud, troubleshoot problems, assist with any investigations, enforce our legal terms, and comply with applicable legal requirements.

Depending on where you live, you may have rights to request access to, correction of, or deletion of the personal information we hold about you. To make a request, email us at contact@trycaddi.com with your name, the email address associated with your Caddi account, and a description of your request. We will verify your identity before acting on a request and will respond as required by applicable law. If your information reached us through a business customer's use of the Services, please direct your request to that customer.

‍

Third Party Links

At our discretion, we may include or offer third party products or services on the website. These third party sites have separate and independent privacy policies. We therefore have no responsibility or liability for the content and activities of these linked sites.

‍

Updates to this Notice

We may update this Notice from time to time, and we will provide notice of any such changes as required by law. The date the Notice was last updated is identified at the top of the page. We will notify you of changes to this Notice by updating the "last updated" date and posting the updated Notice on the website. We may email or otherwise communicate reminders about this Notice, but you should check our website periodically to see the current Notice and any changes we have made to it.

‍

Children's Privacy

Our Services are not intended for children under age 18. If we learn that we have inadvertently collected personal information from anyone under the age of 18, we will delete it. If you believe that we have collected personal information from anyone under the age of 18, please contact us using the contact information at the bottom of this Notice. By using the Services, you represent that you are at least 18 or that you are the parent or guardian of such a minor.

‍

California "Shine the Light" Law

California Civil Code Section 1798.83 permits users of our website that are California residents to request certain information regarding our disclosure of the information you provide through the website to third parties for their direct marketing purposes. To make such a request, please contact us at the information provided below.

‍

Questions

If you have questions or comments about this notice, you may email us at contact@trycaddi.com or contact us by post at:

Caddi Technologies, Inc.

1522 Western Ave

Suite 24111
Seattle, Washington 98101

United States

‍

‍

Caddi Recorder Chrome Extension Addendum

Last updated August 23, 2026

This section of our Notice applies to the "Caddi Recorder" Chrome Extension ("Extension"). The Extension only captures data while you have an active recording session. Specifically, it records:

  • Visual content – HTML/DOM and pixel data of the tabs you choose to record.
  • Interaction events – mouse clicks, element selectors, cursor coordinates, scrolls, URL changes, and keystrokes. Input fields identified by the browser as password fields are masked. Other fields, including payment fields that are not marked as password inputs, may be captured, and you should avoid entering sensitive values during a recording session.
  • Metadata – timestamps, tab ID, and browser window dimensions.

No additional data is captured when recording is paused or stopped.

‍

Chrome Permissions

The Extension requests the minimum scope of permissions required to provide its single functionality. The Extension complies with the applicable Chrome Web Store Program Policies by restricting data collection to a single, user-initiated purpose, encrypting sensitive data, and clearly disclosing practices herein.

‍

How Your Data Is Used By The Extension

Captured data is processed to generate an automation script inside your Caddi workspace, and as described in the Artificial Intelligence-Based Products section of this Notice. It is not used for advertising, profiling, or resale.

‍

How We Transmit Your Captured Data

Your captured data is transmitted and stored using the following:

  • In transit: TLS 1.2+ (HTTPS/WSS).
  • At rest: AES-256 encryption in AWS.
  • Access controls: Strict IAM roles; recordings accessible only to the workspace that created them. See our SOC 2 and other compliance information at https://trust.trycaddi.com.

‍

Retention and Deletion of Captured Data

Deleting a recording in the Caddi dashboard removes all copies of the video, audio, and metadata from active storage immediately and from encrypted backups within 30 days. Logs and traces are stored for 365 days to meet our SOC 2 retention requirements. Where a recording has been used for model development as described in the Artificial Intelligence-Based Products section, deletion removes the recording and excludes it from future use, but does not require us to modify or delete models already developed.

‍

Recording Consent

You are responsible for obtaining all consents and giving all notices required by applicable law before recording a session, including from any person whose voice, communications, image, or data is captured in the recording. This includes any consent required under federal and state wiretapping, eavesdropping, and communications privacy laws.

‍

Caddi Recorder Service Providers

Recording payloads are transmitted to and processed by our service providers, including cloud infrastructure and hosting, storage and key management, and AI model inference providers. A current list of our subprocessors is maintained at https://trust.trycaddi.com. Aggregated, non-identifiable telemetry (for example, "feature used" counters) may be shared with analytics providers; this telemetry never contains screen content or user credentials.

‍