Privacy Policy
Casccade is software that businesses use to talk to their customers: a contact list, conversations, calendars, forms, payments and automations. Each business has its own account. This page says what Casccade keeps, why, and how to have it deleted.
Who is who
The business that uses Casccade decides what to collect from its own customers and what to do with it. Casccade stores and processes that data for the business and on its instructions. If you are a customer of a business that uses Casccade, that business's own privacy policy also applies to you, and you can ask it directly about your data.
What we keep
- People who use Casccade: name, email address and password (stored only as a one-way hash), the accounts they belong to, and a record of important actions they take.
- A business's customers: what the business enters or collects through Casccade, such as names, emails, phone numbers, form answers, appointments, messages and payment status. Card numbers are handled by Stripe and never reach Casccade.
- Technical records: logs needed to run, secure and repair the service.
Facebook and Instagram
A business can press "Connect with Facebook" and choose which of its Facebook Pages and Instagram accounts Casccade may use. For those Pages, Casccade keeps:
- the Page's id and name, and the linked Instagram account's id and username;
- an access token for each Page, kept encrypted and never shown in a web browser;
- the Facebook user id of the person who connected the Page;
- messages that people send to the Page or the Instagram account, and the business's replies;
- answers to the business's Facebook and Instagram lead forms.
Casccade uses this only to show the messages and leads to the business that connected the Page, to send that business's replies, and to run the automations that business set up. Casccade does not sell this data, does not use it for advertising, and does not share it with anyone other than the business that connected the Page and the service providers listed below.
A business, or a member of its team, can press "Connect with Google" and sign in with their own Google account. Casccade asks Google only for what each part needs, and keeps:
- the Google account's email address, to show which account is connected;
- an access token for that account, kept encrypted and never shown in a web browser;
- Google Calendar (permission "View and edit events on all your calendars"): the start and end time and the title of events on the connected calendar, read only to keep those times from being offered for booking; Casccade also adds the business's own Casccade appointments to that calendar and removes them when they are cancelled;
- Google Ads (permission to manage Google Ads accounts): which Google Ads accounts the person can reach and the account the business picks, its conversion actions, and the conversions Casccade sends to it: the ad click identifier captured when a visitor arrived from an ad, the conversion action, the time and the value. No email address or phone number is sent to Google Ads.
Casccade uses this only for the business that connected it, as described above. Casccade does not sell it, does not use it for advertising, does not use it to train any AI model, and does not let anyone read it except where the business asks us to help, for security, or where the law requires it.
Casccade's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Disconnecting Google in Casccade retires the stored token and revokes Casccade's access at Google (unless the same Google account is still connected to another part of Casccade, which keeps working until it is disconnected too). You can also remove Casccade at any time in your Google Account under "Third-party apps and services".
Why we keep it
To provide the service the business signed up for, to keep it secure, to send the emails and texts the business asks Casccade to send, and to meet legal duties.
Who else handles it
Service providers that run parts of Casccade for us, under contract: our server and network providers, Amazon Web Services (email delivery), Google (calendars and advertising conversions a business connects), Stripe (payments) and the text-message providers a business chooses. They may use the data only to provide their service to us.
How long we keep it
For as long as the business keeps its Casccade account, or until the business deletes it. When a business disconnects a Facebook Page, Casccade tells Facebook first and then deletes that Page's token and connection. Messages and leads already received stay in the business's account until the business deletes them. Backups are kept for a short period and then replaced.
Deleting your data
- If you connected a Facebook Page: remove Casccade in your Facebook settings under "Business integrations" (or "Apps and websites"). Facebook tells Casccade, and Casccade deletes the Pages you connected, their tokens and any connection still waiting. Facebook shows you a confirmation code you can use to check the result.
- If you are a customer of a business: ask that business. It can delete your contact, conversations and form answers in Casccade.
- Anything else: email [email protected].
Security
Connections use HTTPS. Access tokens and provider keys are kept encrypted. Each business can see only its own data.
Changes
If this policy changes, the new version is published on this page with a new date.
Contact
Questions about privacy: [email protected].