This policy explains what Study Cadenza Inc. ("Cadenza", "we") collects when you use Cadenza Notebook, why, who else handles it, how long we keep it, and what you can do about it. It is written to be read, not skimmed past. If anything is unclear, ask our privacy officer (section 11).
1The short version
- Your uploads and everything made from them are private to you. No other user can see them, and we never sell them.
- To write your lessons and grade your practice, we send the text of your files to OpenAI in the United States. OpenAI does not use it to train its models. It may keep it for up to 30 days to check for abuse, then deletes it.
- Your data is stored in Canada (Montréal) and processed in Canada and the United States.
- We email you marketing only if you ticked the box, and you can unsubscribe any time.
- You can see, download, correct and delete your data. Deleting your account erases it.
2What we collect and why
| What | Why | Where it comes from |
|---|---|---|
| Email address | To create your account, send your sign-in codes, and send messages about your account and plan | You |
| First and last name | To address you in the app and in emails | You |
| Your choices: whether you agreed to the terms and when; whether you want marketing email | To prove you agreed, and to email you only if you said yes | You |
| Courses: names, codes, terms, start dates, weeks, assessments (titles, dates, times, rooms, weights) | To build your course calendar and weekly plan | You, and read from your syllabus |
| Uploaded files (PDF, Word, PowerPoint, images) and the text we extract from them | To make your lessons, questions and flashcards | You |
| Course content you send from Canvas with the Send to Cadenza extension: syllabus, modules, files, pages, assignment briefs and rubrics | To build that course in Cadenza and make your lessons, questions and flashcards | Your school's Canvas, read with your own login when you click Import |
| What Cadenza makes: lessons, concepts, questions, flashcards | To show them to you | Made by AI from your files |
| Your practice: your answers, whether they were right, feedback, when you read a lesson | To grade you, show your confidence and readiness scores, and choose what to practise next | You, and graded partly by AI |
| Usage records: when you signed up and signed in, how many courses and files you have, when AI jobs ran and how many units of AI work they used, errors | To run the Service, keep costs and abuse in check, fix problems and see how Cadenza is used | Created by the Service |
| Technical data: IP address, browser and device type, in server logs | Security and fixing errors | Your device |
| Payment records (once paid plans launch; not available yet): plan, price, dates, status, last 4 digits of a card | To bill you and provide your plan. We never see your full card number | Stripe or Apple |
| Referrals, if you invite a friend or join with a friend's code: your code, when you agreed to the Affiliate Terms, who referred whom, when the friend's first lesson was built, and a hash of the friend's email address (not the address itself) | To give each free month once, and to show you how many friends joined | You and the Service |
| A Front Row access request: the email address you type on the Front Row page, and when | To tell you when you can use Front Row. Nothing else is sent to it | You, without an account |
| Sign-in with Google or Apple, if you use it (Apple not available yet): name, email (with Apple, possibly a private relay address), an account ID | To sign you in | Google or Apple |
Files can contain more than you think. If a file you upload contains other people's names or information (a class list, a group project), it is processed like the rest of the file. Please upload only what you need to study.
The Send to Cadenza browser extension. When you click Import in the extension, it reads the courses you open on your school's Canvas, with your own login in your own browser, and sends them to your Cadenza account. It reads course material only: the syllabus, modules, files, pages, assignment briefs and rubrics. It never reads class lists, grades, discussions or messages, never sends your Canvas password or login to us, and reads nothing until you have agreed in the extension and clicked Import. What it sends is private to your account, is never shared with other students and is never used to train AI. The use of information received from the extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. Cadenza works with Canvas LMS and is not affiliated with Instructure or your school.
Google user data. If you sign in with Google, we receive your name, email address and Google account ID, and nothing else from your Google account. We use them only to create your account and sign you in. We do not sell them, share them with anyone except Supabase (which runs our sign-in), use them for advertising, or use them to train AI. They are deleted when you delete your account. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
We do not use advertising or tracking cookies. We use only the cookies needed to keep you signed in, and one that remembers which way you signed in last (Google, Apple or email, nothing else) for up to a year, so the sign-in page can point you to it. A friend's link sets one more, holding only their code, for up to 30 days, so the free month reaches you if you sign up later. To see which pages are visited, we use Vercel Web Analytics, run by our host Vercel, which counts visits without cookies.
3How AI is used
Cadenza uses AI to read your syllabus and files, write lessons, questions and flashcards, and grade written answers. What it writes can be wrong; check it against your course material.
Your confidence and readiness scores are calculated from your practice answers. They are a profile of what you know, used only to show you where you stand and to pick your next practice. They are not shared with anyone and no decision about you (such as your access to Cadenza) is made from them. If you want to know how a score was worked out, ask us and we will explain what it used.
4Who else handles your data
We use these service providers to run Cadenza. Each one may use your data only to provide its service to us, under a written agreement that requires protection at least equal to this policy.
| Provider | What it does for us | What it receives | Where |
|---|---|---|---|
| Supabase | Database, sign-in, file storage | Everything listed in section 2 | Canada (AWS Montréal) |
| Vercel | Hosts the website and app, runs our code, and counts page visits (Web Analytics, no cookies) | Everything passing between your device and Cadenza; server logs; anonymous visit counts | United States |
| OpenAI | AI that reads your files and writes and grades | The text of your files, images of scanned pages, your written answers | United States |
| Resend | Sends sign-in codes and email | Your email address and the email | United States |
| Stripe (not in use yet) | Card payments on the web | Name, email, payment details | Canada and United States |
| Sign in with Google, if you use it | Google tells us your name, email and a Google account ID; Google learns that you use Cadenza | United States | |
| Apple (not in use yet) | iOS in-app purchase, Sign in with Apple | Apple handles payment; we receive a purchase record | United States |
Stripe and Apple are not in use yet. They will receive data only once the features that use them launch: paid plans, in-app purchase and Sign in with Apple. This policy describes how they will work then.
OpenAI does not use data sent through its API to train its models. OpenAI keeps it for up to 30 days for abuse monitoring, then deletes it. We ask OpenAI not to store responses (store: false).
We do not sell or rent your personal information, and we do not share it for advertising. We disclose it to others only: to the providers above; if the law requires it (for example a valid court order); to protect someone's safety or investigate fraud or a security incident; or to a business that takes over Cadenza, which must keep this policy, and we will tell you first.
Outside your province and Canada. Data processed in the United States is subject to US law and may be accessed by US courts, law enforcement and national security authorities.
5Who at Cadenza can see your data
Only the people who run Cadenza, and only when needed. We look at an individual account's content only if you ask us to help with it, or to investigate abuse or a security problem.
Classes. If you join a class with your teacher's code, your teacher will see when you were last active and how long you spent on Cadenza this week, which lessons you've read, how you're doing in practice and which topics you find hard, and how many papers and companion questions you've started. They do not see what you write. Your own uploads, papers and chats stay private from your teacher and your classmates.
6Email
- Account email (sign-in codes, receipts, changes to these terms or your plan, security notices) is part of the Service; you cannot opt out while you have an account.
- Marketing email ("what's new in Cadenza Notebook") goes only to people who ticked the box at sign-up or in settings. We send no marketing email until we publish a mailing address, which Canada's anti-spam law requires in every such email. Once we do, every marketing email will come from Study Cadenza Inc. with that address and an unsubscribe link, which works within 10 business days at most (usually at once).
7How long we keep it
| Data | Kept until |
|---|---|
| Your account, courses, files and everything made from them | You delete them or your account |
| A single file you delete | Removed at once; the lesson already made from it stays until you delete or rebuild it |
| Database backups | We keep none, so deleted data is gone at once |
| Server logs | A short period, as set by our host (Vercel) |
| Data at OpenAI | Up to 30 days |
| Payment records (once paid plans launch) | As long as tax law requires |
| A record that you unsubscribed or deleted your account | As long as needed to respect it |
| A referral record and the hash of the friend's email | Kept after either account is deleted, without your name or address, so a free month is given only once |
| A Front Row access request | Until you are let in or ask us to delete it. It is not tied to an account, so deleting a Cadenza account does not remove it: write to us |
| Accounts not used for 24 months | Deleted after an email warning 30 days before |
8Your rights
You can:
- See and download your data. Your files and generated material are in the app. Download your profile, courses, lessons and practice as one JSON file in Settings → Privacy and Data → Download My Data, or from Export Data in the account menu. Ask us if you also want a copy of your original files.
- Correct it. Edit your name, courses, dates and weeks in the app, or ask us.
- Delete it. Delete a file in the app, a course in Edit Course → Delete Course, or your whole account in Settings → Privacy and Data → Delete Account. Deleting a course removes the course, its weeks, files, lessons, questions and practice history at once. Account deletion erases your files and every row about you immediately; we keep no backups.
- Withdraw consent. Unsubscribe from marketing, or stop using AI features by deleting your uploads. Without sending files to an AI provider, Cadenza cannot make lessons.
- Ask how a score or grade was produced (section 3).
- Complain. To us first (section 11). You can also complain to the Office of the Privacy Commissioner of Canada, or, if you live in Quebec, the Commission d'accès à l'information.
We answer requests within 30 days, free of charge. We may need to confirm it is you.
9Security
Every table in our database is locked so each account can reach only its own rows (row-level security), files are stored in a private bucket, data is encrypted in transit and at rest by our providers, sign-in uses one-time codes instead of passwords, and the key that bypasses these locks is used only on our servers. No system is perfectly secure. If a breach creates a real risk of significant harm to you, we will tell you and the privacy regulators as the law requires.
10Age
Cadenza is for people 13 and older. We do not knowingly collect information from anyone younger; if we learn we have, we delete the account.
11Contact and privacy officer
Our person in charge of the protection of personal information is our Privacy Officer, Wesley Meynen, reachable at [email protected].
12Changes
If we change this policy in a way that matters to you, for example a new provider that receives your files or a new use of your data, we will tell you by email and in the app at least 30 days before, and ask for your consent again where the law requires it.