Privacy policy.

1. Who we are and what this policy covers

Cadento, LLC (“Cadento,” “we,” “us”) runs this website (cadento.ai), the Cadento app (app.cadento.ai) and the done-for-you email campaigns we run for real estate agents and loan officers. This policy explains what information we collect, how we use it, who we share it with and the choices you have.

It covers two groups of people:

• Customers: the agents, loan officers and teams who use Cadento, and visitors to this website. In this policy, “you” means a customer unless we say otherwise.
• Contacts: the people on a customer’s list, such as past clients, who receive emails the customer approves. Section 10 is written for them.

For contacts, we work on our customer’s behalf. The customer decides who is on their list and approves every email that goes out, and we handle contact information only to provide our service to that customer. For customers’ own account information, Cadento is responsible.

2. Information we collect

From customers

• Account details: your name, email address, company or brokerage, and the details of anyone else who has access to your account.
• Business and compliance details: your business mailing address, email signature, brokerage name, license and NMLS details, licensed states, and other details your emails must carry.
• Your writing: the sample emails you share so drafts sound like you, and the changes you make to drafts before you send them.
• Your decisions: your approvals, edits and settings, and the statements you make about who is on your list and why they expect to hear from you.
• Mailbox connection: the sign-in token that lets Cadento send from your Gmail or Outlook, and the mailbox address when your provider shares it (section 5). If you connect a CRM, its sign-in is held for us by Nango (section 6).
• Payment details: what you bought and whether it’s paid. Card details go straight to Stripe, our payment processor. We don’t receive or store card numbers.
• Sign-in: your password is handled by our sign-in provider, Supabase. We don’t store it ourselves.
• What you send us: emails to support, and lists or files you send us to import.

About contacts

When a customer imports a list, from a spreadsheet, a CRM or a file they send us, we receive what it holds. That is usually:

• names, email addresses, phone numbers, company and job title;
• notes, and dates such as a closing or purchase date and when the customer last contacted the person;
• whether the person opted out, bounced or should not be contacted, and the customer’s basis for emailing them, such as an existing relationship.

While Cadento works, it also creates and stores:

• the emails drafted for each person, the emails sent, and their status;
• outcomes such as replied, opted out or bounced, and, for customers who connect Outlook, the text of a contact’s reply (section 5);
• account context from a connected CRM (section 6);
• research findings, only for customers who have turned research on (section 7).

From website visitors

This website sets no cookies and runs no analytics. Our hosting provider, Cloudflare, processes the technical information that comes with every web request, such as your IP address and browser type, to deliver and protect the site. The site’s fonts load from Google Fonts, so your browser sends the same kind of request information to Google.

3. How we use information

We use information to:

• Run campaigns: clean each list, decide who hears from you first, draft each email, check it with Compliance Mode, send it from your inbox once you approve it, stop a person’s emails when they reply, opt out or bounce, and report the results.
• Run the other Cadento features you use, such as daily drafts, CRM imports and notes logged back to your CRM.
• Make drafts sound like you, using your sample emails and your own edits. These are used only for your drafts.
• Look after your account: send account emails such as sign-in invitations and password resets, answer support requests and bill for our services.
• Keep the service working and lawful: keep it secure, find and fix problems, prevent misuse, keep the records the law requires and enforce our Terms of service.

Our promise about contact information. We use contact information only to run the customer’s campaign and the Cadento features that customer uses. We never sell it, never share it for advertising and never use it to market anyone else, including Cadento. We don’t use customers’ lists, writing or emails to train AI models.

4. Done-for-you campaigns and staff access

With a done-for-you campaign, Cadento staff do much of the work inside your account. Staff with admin rights can:

• import a list you send us into your account, running the same cleanup as your own import, and record who confirmed that you may email the people on it, and how;
• start, pause, resume and end your campaign, change its settings, add contacts to it and start drafting;
• see your account’s basic details, your campaign and its progress, and the copy of every email Cadento has sent from your account, to check on the campaign and answer your questions.

Only Cadento staff we choose have admin rights, and the server checks those rights on every request. Staff don’t approve emails for you: nothing in a campaign sends until you approve it in your account. Campaign changes and imports made by staff appear in your account’s activity feed. People who maintain the service may also access the database directly when they need to fix a problem.

If you send us your list as a file, we use it only to import it into your account, and we don’t keep the file longer than we need it for the import and any questions about it.

5. Gmail and Outlook connections

Cadento sends emails from your own mailbox. You connect it once, on Google’s or Microsoft’s own sign-in screen. The sign-in token that results is encrypted before we store it.

Gmail (Google)

Cadento asks Google for one permission, gmail.send. We use it only to send the emails you approve inside Cadento, from your own account. With this permission Cadento can’t read, search, change or delete anything in your mailbox, so it doesn’t see replies, opt-out requests or bounces. If you use Gmail, you record those in Cadento yourself.

Cadento’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we do not use Google user data for advertising, we do not sell it, and we do not transfer it to others except as necessary to provide or improve Cadento’s sending feature, to comply with applicable law, or as part of a merger or acquisition. We do not allow humans to read this data unless we have your consent for specific messages, it is necessary for security or to comply with law, or the data is aggregated and anonymized.

Google user data and AI. Cadento uses an AI model to draft emails. Drafting works from the information described in section 7, such as contact records, account context and sample emails. Google user data is never used as input to any AI or machine learning model. Because Cadento holds only the gmail.send permission, it has no access to your inbox, messages, contacts or any other Google content, so no Google user data, whether raw, aggregated, anonymized or derived, is transferred to any AI provider, and none is used to create, train or improve any AI or machine learning model, ours or anyone else’s.

You can remove Cadento’s access at any time on your Google Account permissions page, or ask us to disconnect it. Cadento then can’t send from your account.

Outlook (Microsoft 365)

Cadento asks Microsoft for Mail.Send, to send email as you, and Mail.Read, to read your mail, plus the standard sign-in permissions (User.Read, openid, email, profile and offline_access) that let it identify your mailbox and stay connected.

What Cadento reads. Every few hours, Cadento checks your Sent Items and the mail you’ve received in every folder, including Archive, Junk and Deleted Items, going back a few days, or further if an earlier check didn’t complete. It looks at each message’s sender, recipients, subject, date and contents to find:

• replies from people on your list, which stop their remaining emails;
• opt-out requests, which put the person on your unsubscribe list (section 9);
• bounce notices, which flag the address and stop its emails;
• emails you sent a contact yourself from Outlook, which Cadento logs as a touch.

What Cadento keeps. Cadento acts only on messages that involve a contact on your list, matched by exact email address. For a reply from a contact, it saves what the person wrote, without the earlier quoted thread, in that contact’s notes, so you have it in one place and the next draft can respond to it. For an email you sent by hand, it logs the date, not the text. It also keeps an identifier for each message it has checked, so no message is processed twice. Mail from anyone else isn’t saved, with one exception: when someone asks to unsubscribe from an address that isn’t on your list, Cadento uses the unsubscribe link quoted in their message to opt out the right contact, or, if there is none, shows you their address in your activity feed so you can record it.

You can remove Cadento’s access at any time in your Microsoft account’s app permissions, your organization’s IT administrator can remove it, or you can ask us to disconnect it.

6. CRM connections

If you connect a CRM, such as HubSpot, Salesforce or LeadConnector, you sign in to it through Nango, a service that holds the CRM sign-in for us and connects Cadento to your CRM. Cadento then:

• imports your contacts (name, email address, phone number, company, job title, last-contact date and, where the CRM provides them, do-not-contact flags), and can check again on a schedule for new ones;
• reads and stores account context for your imported contacts, such as their company, open and won deals, and recent notes, and uses it when drafting;
• can add a note to the contact’s record in your CRM when an email goes out, so it shows on their timeline.

You can disconnect your CRM in Cadento at any time. Contacts you’ve already imported stay in your account until you delete them.

7. AI drafting

Cadento drafts emails with Anthropic’s Claude models, through Anthropic’s commercial API. Cadento connects to Anthropic directly, without AI aggregators, gateways or model hubs. To draft an email, we send Anthropic:

• the contact’s record: their name, company, title, notes (including any reply text saved from Outlook), dates and the other details on their row;
• account context from your CRM, if you’ve connected one;
• your business details, sample emails, recent edits and the compliance rules for your emails;
• for campaign emails, which email in the person’s series this is, with short summaries of the earlier ones.

We also use Anthropic to check that drafts sound like you, and to answer the questions you ask the app’s assistant, including questions about a CRM account.

Research. Research is an optional feature that stays off unless it’s added to your account, and it’s never used for campaign emails. When it’s on and you run it, the AI model searches the public web for information about a contact and their company, and we store what it finds, with its sources, on the contact’s record, where it can be used in that contact’s drafts outside a campaign.

Anthropic’s commercial terms say it does not train its models on content sent through its API. We don’t train any AI model of our own on your information or your contacts’ information.

8. Who we share information with

We share information only with the service providers that help us run Cadento, only as needed for that work, and they are bound to protect it.

We may also share information:

• within a customer’s account, with the other people who have access to that account;
• when the law requires it, or to protect the rights, property or safety of Cadento, our customers or others;
• as part of a merger, acquisition or sale of assets, under the protections of this policy and, for Google user data, the Limited Use requirements in section 5.

We don’t sell personal information, and we don’t share it for targeted or cross-context behavioral advertising.

9. The unsubscribe list

Each customer account has its own unsubscribe list. An address goes on it when:

• the person uses the unsubscribe link in an email, which is recorded immediately;
• they reply asking to stop (on Outlook, Cadento detects most of these; on Gmail, the customer records them);
• an imported list marks them as opted out or not to be contacted; or
• the customer marks them as opted out.

Cadento checks the list before every send and won’t email an address on it. The address stays on the list even if the contact is deleted and imported again. The list belongs to that customer’s account: an opt-out stops emails from that customer through Cadento, and it isn’t shared with other customers. We keep the list for as long as the customer’s account exists.

10. If you got an email sent through Cadento

The email came from one of our customers, from their own email account. They chose to write to you and approved the email, and any reply you send goes to them.

• To stop these emails, use the unsubscribe link at the bottom of the email. It works right away, and you won’t get more emails from that sender through Cadento. The page asks you to confirm with one button, so a mail scanner opening the link can’t unsubscribe you by accident. You can also reply “unsubscribe” to the sender.
• What we hold about you is what the sender gave us, or what Cadento created while working for them, as described in section 2.
• No tracking. Cadento adds no open-tracking pixels and no click-tracking links to the emails it sends. The unsubscribe page uses no cookies and no scripts.
• Questions or requests about your information can go to the sender, or to us at support@cadento.ai. Because we hold this information for the sender, we’ll usually work with them to answer your request.

11. How long we keep information

• Account and contact information: for as long as the account is open or as needed to provide the service. You can delete contacts at any time. After an account closes, we delete or anonymize its information, except what we must keep, as described here, or must keep to comply with the law.
• Copies of sent emails: we keep a full copy of every email Cadento sends from a customer’s account, as sent, with its signature, disclosures and footer, the sending address and the send details, for at least 24 months after it’s sent. Advertising record-keeping rules, such as Regulation N for mortgage advertising, can require this. The copy is kept even if the contact is later deleted. Customers can download it but can’t change or delete it.
• Campaign records: a campaign’s summary and each contact’s outcome stay with the account, even if a contact is later deleted.
• The unsubscribe list: for as long as the customer’s account exists (section 9).
• Mailbox sign-in tokens: until the mailbox is reconnected, we remove the token at your request, or the account closes. A token stops working as soon as you remove Cadento’s access at Google or Microsoft.
• CRM connections: until you disconnect the CRM or the account closes.
• Backups and logs: our database provider keeps backups, and our hosting provider keeps technical logs, for a limited time. Copies in them are removed as they expire. Logs can include an email address or subject line when something goes wrong.

12. Security

• This website and the Cadento app are served only over encrypted (HTTPS) connections.
• Mailbox sign-in tokens are encrypted before they’re stored, with a key kept apart from the database.
• Each customer’s data is kept separate in the database, so one customer can’t see another’s.
• Staff admin rights are checked by the server on every request, and access is refused if the check can’t be completed.
• The copies of sent emails can’t be changed or deleted by customers.
• Unsubscribe links are signed so they can’t be guessed, and the unsubscribe page never shows who a link belongs to.

No system is perfectly secure. If a security breach affects your information, we’ll tell you as the law requires.

13. Cookies and browser storage

• This website sets no cookies and uses no analytics, advertising or tracking tools. It loads fonts from Google Fonts (section 2).
• The Cadento app keeps you signed in by storing a sign-in token in your browser’s local storage, and remembers a few display choices, such as light or dark mode, the same way. It sets no advertising or analytics cookies. The app loads its sign-in code from esm.sh, a public code server, which receives standard request information such as your IP address.
• The unsubscribe page uses no cookies and no scripts.

14. Your choices and rights

Customers

• Get a copy: you can download the copies of every email sent from your account in the app’s settings, and a campaign’s summary and each contact’s outcome when it ends. For anything else, email us.
• Correct: update your details in the app’s settings, or ask us.
• Delete: delete contacts at any time. To close your account and delete its information, email us. Some information is kept for the periods in section 11.
• Disconnect: remove Cadento’s access to your mailbox as described in section 5, and disconnect your CRM in the app.

Privacy rights under state law

Depending on where you live, for example in California, you may have the right to know what personal information we hold about you, to get a copy of it, to correct it, to delete it, and to opt out of its sale or its use for targeted advertising. We don’t sell personal information or use it for targeted advertising. To make a request, email support@cadento.ai. We’ll confirm your identity before we act on a request, you may use an authorized agent, and we won’t treat you differently for using these rights.

Contacts

If you’re on a customer’s list, see section 10. Requests about information a customer gave us are handled with that customer.

15. Children

Cadento is a business service for adults and isn’t directed to anyone under 18. We don’t knowingly collect information from children. If you believe we hold a child’s information, contact us and we’ll delete it.

16. Where information is processed

Cadento is a United States company, and its service is meant for customers in the United States. Information may be stored and processed in the United States and in other countries where our service providers operate.

17. Changes to this policy

We may update this policy. When we do, we’ll post the new version here with a new effective date and, where appropriate, tell customers by email or in the app. This version replaces the policy last updated August 7, 2026.

18. Contact us

Questions about this policy or your information: support@cadento.ai, Cadento, LLC.