PRIVACY POLICY

Effective Date: 19th August 2026

1. INTRODUCTION TO CADUNO'S DATA COMMITMENT

Caduno is built on a simple idea: the reasoning behind a project decision is worth more than the decision itself, and it should never be lost in a thread. We are committed to handling the project information entrusted to us carefully, transparently, and in a way that reflects how architecture and construction teams actually work. This Privacy Policy explains how Caduno collects, uses, discloses and protects information relating to our platform, our website and the people who use them. Caduno is operated by Caduno App, based in Queensland, Australia. We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. The Information Privacy Act 2009 (Qld) applies to Queensland government agencies rather than private businesses, and does not apply to Caduno merely because we are based here. This Policy is governed by the laws of Queensland, Australia.

2. INFORMATION WE COLLECT

We collect what we reasonably need to run the platform, and no more. Account information includes your name, business email address, telephone number, job title, organisation, credentials and authentication data, and the projects and permissions you have been given. Communications includes support requests, enquiries, demo bookings and waitlist submissions, and our correspondence with you. Technical information is collected automatically when you use Caduno and includes your IP address, browser and device type, pages and screens viewed, session times, server and application logs, authentication events and cookie identifiers. Usage information covers which features you use and the actions you take within a workspace - creating, editing, commenting on, resolving or exporting a record. Because Caduno exists to maintain a reliable record of what was decided and why, that record necessarily identifies who did what and when. Caduno is currently provided at no charge and we do not collect payment details. When paid subscriptions are introduced we will collect billing information - your billing contact, plan and subscription details, invoices and payment status - and we will never store full card numbers, which will be handled directly by our payment provider. We do not seek sensitive information, and we ask that you do not place it in the platform unless it is genuinely necessary for the project.

3. PROJECT DATA AND CUSTOMER CONTROL

Caduno handles two distinct categories of information, and the difference matters. Account Data is what we collect to run our business and provide the service - we decide what is collected and why, and we are responsible for it. Customer Content, also called Project Data, is what a firm and its authorised users upload to or create in Caduno: project communications, messages, comments, files, drawings, documents, attachments, records, project contacts, project history and associated metadata. The subscribing firm controls its Customer Content - what goes in, who can see it, and how long it stays. We hold and process it on that firm's behalf so we can provide the service. We do not claim ownership of Customer Content, and we do not treat it as a general data source for our own commercial use; ownership and licensing sit in our Terms of Service. Project material frequently contains details about people who have no Caduno account - a site contact named in an RFI, a client's address on a drawing. Where that happens, the firm that placed the information in Caduno is responsible for having collected it lawfully and for meeting its own obligations to that individual. We are responsible for holding it securely and using it only to provide and support the service.

4. HOW WE USE YOUR INFORMATION

We use information to establish and administer accounts, authenticate users, and operate the platform and its collaboration features. Your name, role, organisation and activity are visible to others in your workspace or project - that is inherent to a collaboration tool and to the audit trail Caduno is designed to produce. We use information to store, index and display Customer Content so firms can use it; to provide external access to the consultants, clients and certifiers a firm has invited; to provide support and respond to enquiries; to arrange and conduct demonstrations; to protect the platform against misuse, fraud and unauthorised access; to monitor reliability and diagnose faults; to analyse product usage, at an aggregate or de-identified level wherever practicable, so we can improve Caduno; and to comply with our legal obligations. Once paid subscriptions are introduced, we will also use information to manage subscriptions, invoicing and payment. Uploading Customer Content to Caduno does not give us a general right to use it for our own purposes - our use is limited to what is necessary to provide, secure, support and operate the service, to comply with the law, and to whatever the firm has separately instructed.

5. AI-ASSISTED FEATURES

Caduno includes features that use artificial intelligence to help teams work with project information: summarising records and project correspondence, identifying actions and follow-ups, drafting content for a user to review, retrieving information from a workspace, and contextual search. To provide these, we process the material the feature needs, which can include messages, records, files, documents, comments and metadata. Two limits apply. Access follows permissions - an AI feature operates within the permissions of the user invoking it, never surfaces material that user could not otherwise open, and never crosses between different firms' workspaces. Processing follows purpose - we process content to deliver the requested output, not to build a profile of anyone. We use third-party AI providers to deliver this functionality, which means relevant content is transmitted to and processed by those providers on our behalf. Our AI provider is Anthropic PBC, based in the United States, accessed through the Anthropic API. Your content is not used to train AI models. Under Anthropic's Commercial Terms, which govern API access, inputs and outputs from the API are not used for model training by default. Anthropic deletes API inputs and outputs from its systems within 30 days of receipt or generation, other than where longer retention is required by law, to enforce its usage policy, or where we have agreed otherwise. Content flagged by Anthropic's automated trust and safety systems may be retained for up to two years. We do not train any model of our own on Customer Content. AI output can be incomplete or wrong; summaries and suggestions are aids, not authoritative project records, and should be reviewed by a person before being relied on. Our AI features are assistive - they summarise, retrieve and suggest, and a person decides what to do. We do not use them to make decisions that could significantly affect an individual's rights or interests. From 10 December 2026, new transparency requirements apply to certain automated decision-making, and we will update this Policy before that date if any feature falls within them.

6. SHARING AND DISCLOSURE OF INFORMATION

We do not sell personal information, and we do not disclose it to third parties for their own marketing purposes. Within the platform, information is visible to others with access to the same workspace, project or record, to workspace administrators, and to external collaborators a firm has invited. Outside it, we share information with the service providers who make Caduno work - cloud hosting and infrastructure, database and backend services, authentication, email delivery, AI processing, analytics and error monitoring, demo scheduling, and customer support. Once paid subscriptions are introduced, this will also include payment processing. Each has access only to what it needs, is required to protect it, and may use it only to provide services to us. We may also disclose information to our professional advisers under confidentiality; where required or authorised by an Australian law or a court or tribunal order, in which case we will notify the affected firm first where we are legally able to; and to parties involved in a merger, acquisition, financing or sale of our business, subject to appropriate protections and on the basis that any acquirer handles information consistently with this Policy.

7. SECURITY, OVERSEAS PROCESSING AND RETENTION

We take reasonable steps to protect information from misuse, interference, loss and unauthorised access, including role-based access controls and project-scoped permissions, secure credential handling, support for multi-factor authentication, encryption in transit, logical separation of each firm's workspace, audit logging and security monitoring, regular backups, restricted administrative access, and assessment of providers before we engage them. No internet-based service can be completely secure, and we do not represent that our systems are impenetrable. Project records, files and account data are held in our database, authentication and storage layer, which is hosted in Australia (Sydney). Some processing occurs in the United States: our AI provider, Anthropic PBC, processes Ask Caduno requests there, and certain providers are United States companies whose personnel may access systems from that country for support, maintenance and security purposes. Backups, logs and edge function execution may also occur outside the primary region. Where we engage a provider that may handle personal information outside Australia, we require contractual commitments to handle it consistently with the Australian Privacy Principles, restrict their use of it to providing services to us, and select Australian data residency where it is offered and commercially reasonable. We keep information only as long as reasonably required for the purposes above, to meet our contractual commitments, and to comply with legal obligations - Customer Content for as long as a workspace is active and for 90 days after it closes, as set out in our Terms of Service, deleted data until encrypted backups expire on their ordinary cycle, and security logs for a period appropriate to incident investigation. Where an account is deactivated we may retain what is necessary to keep the project record intact, because a project history that loses the identity of the person who made a decision is no longer a reliable record. If we suspect a data breach we will act promptly to contain and assess it, and where the Notifiable Data Breaches scheme applies we will notify the OAIC and affected individuals as required.

8. YOUR RIGHTS, CHOICES AND CONTACT

You can ask us what personal information we hold about you, ask us to correct it if it is wrong or out of date, and ask us to delete it. We may need to verify your identity first, and there are limited circumstances in which we may decline - if we do, we will explain why in writing. Where the information sits inside Customer Content controlled by a firm, we cannot unilaterally change or delete it, because doing so could destroy a record other project parties are entitled to rely on; in those cases we will refer your request to that firm and assist them to respond. Your organisation, not Caduno, controls your workspace access, your permissions, and much of the information about your use of the platform, so concerns about how a workspace is administered should go to your organisation first. We send service communications that are part of the platform and cannot be switched off while you hold an account, and marketing communications only where permitted under the Spam Act 2003 (Cth), each with a working unsubscribe link. We use cookies for sign-in, session security, preferences and analytics, and we do not use advertising cookies or cross-site tracking pixels. Caduno is a professional platform and is not directed at children. If you believe we have mishandled your information, contact us and we will investigate and respond; if you are not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or 1300 363 992. We may update this Policy as our product and obligations change, and the effective date above shows when it was last revised.

Caduno App

Queensland, Australia.

hello@cadunoapp.com