Privacy Policy

Effective date: July 15, 2026 · Last updated: July 15, 2026

Cadence (“Cadence”, the “Service”) is operated by Nimblestride (“we”, “us”, “our”). We are committed to protecting your personal information in accordance with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation. This policy explains what we collect, why, how we use and protect it, and your rights.

1. Who is responsible for your information

Nimblestride is the organization accountable for the personal information under its control. Questions, access requests, or complaints may be directed to our Privacy Officer at privacy@nimblestride.ca.

2. Information we collect

Registration information — the name and role you enter, your chosen agile framework, and your program-increment / sprint / cycle dates. This is used to generate your role-based guidance.
Mailbox connection (optional) — if you choose to connect a mailbox to receive daily emails, we collect the email address you provide and an OAuth authorization that permits us to send email on your behalf only. We request the minimum “send” permission (Gmail gmail.send / Microsoft Graph Mail.Send). We do not read, import, or store the contents of your mailbox.
Content you submit — impediments or questions you type into the Service to receive guidance.
Technical information — standard server logs (e.g., IP address, timestamps) used for security and reliability.
Privacy-preserving analytics — we keep aggregate usage counts (such as page visits, with obvious bots and automated crawlers excluded). To understand roughly where our users are, we derive a coarse, country-level location from your IP address at the moment of the request and immediately discard the IP — we do not store or log the IP address for this purpose, and we keep only the two-letter country code. We do not track precise location, and we do not use third-party advertising or cross-site tracking.

3. Why we collect it (purposes)

To provide the Service: generate role, gate, and cadence guidance and impediment analysis.
To send you the daily “action plan” emails you explicitly request when you connect a mailbox.
To secure, maintain, and improve the Service.
To comply with legal obligations.

We collect, use, and disclose personal information only for purposes a reasonable person would consider appropriate in the circumstances, and only with your consent (express or implied) unless the law permits otherwise.

4. Artificial intelligence & data residency

Guidance is generated using Anthropic’s Claude models accessed through Amazon Web Services (AWS) Bedrock in the Canada (Central) region (ca-central-1), so processing occurs within Canada. The information you submit is sent to the model to produce your guidance and is not used by us to train models. We do not use third-party general-purpose consumer AI services.

5. Service providers & disclosure

We use trusted service providers who process information on our behalf under contractual safeguards:

Amazon Web Services — hosting and AI inference (Canada region).
Microsoft (Graph API) and/or Google (Gmail API) — solely to send emails you request, using send-only authorization.

We do not sell your personal information or disclose it for advertising. We may disclose information if required by law or to protect our rights, users, or the public.

Google API Services — Limited Use disclosure

Cadence’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, data obtained through the Gmail gmail.send scope is used only to send emails you initiate through the Service; it is not used for advertising, is not sold or transferred to others except as necessary to provide the feature or comply with law, and is not read by humans except with your consent, for security, or as required by law.

6. Storage, retention & security

Data is stored on infrastructure located in Canada (ca-central-1).
Mailbox authorization tokens are encrypted at rest (AES-256-GCM); all traffic is protected in transit with TLS.
We retain personal information only as long as needed for the purposes above or as required by law. You may disconnect your mailbox at any time (including via the “unsubscribe” link in every email), which removes the stored send authorization.

7. Your rights (PIPEDA)

Access & correction — request a copy of, or correction to, the personal information we hold about you.
Withdraw consent — withdraw consent for the collection, use, or disclosure of your information, subject to legal or contractual restrictions.
Complain — contact our Privacy Officer, or the Office of the Privacy Commissioner of Canada.

8. Cookies & local storage

The Service uses your browser’s local storage to maintain your session (for example, to resume after signing in to a mailbox provider). We do not use third-party advertising or cross-site tracking cookies.

9. Children

The Service is intended for workplace use by individuals 18 years of age or older and is not directed to children.

10. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by the “Last updated” date above and, where appropriate, by notice within the Service.

11. Contact

Nimblestride — Privacy Officer · privacy@nimblestride.ca