1. Who is responsible for your data
CADALYX is operated by the company identified below. For GDPR purposes, that company acts as controller for account, billing and service-use data processed to provide CADALYX.
2. Data we process
Account data: email address, password hash, preferred language, account verification state and workspace membership.
Service data: property identifiers, addresses or coordinates you submit, saved portfolio labels, assessment requests, reports, monitoring configuration and the resulting CADALYX records associated with your workspace.
Billing data: subscription status, plan, Stripe customer/subscription identifiers and billing events. Full payment-card details are handled by Stripe and are not stored by CADALYX.
Security and operations data: IP address, request timestamps, rate-limit state, authentication/session records and application logs needed to operate and secure the service.
UMA data: questions sent to CADALYX UMA and the bounded assessment/workspace context needed to answer them. CADALYX does not store a persistent product chat history in its database; requests may still be processed transiently by the configured AI provider and operational infrastructure.
3. Why we process data
We process data to create and operate your account, run assessments and reports, provide Portfolio/Monitoring/UMA, manage subscriptions, secure the service, respond to support or legal requests and meet accounting or regulatory obligations.
The main legal bases are performance of the service contract, legitimate interests in security and reliable operations, compliance with legal obligations and consent where the law requires it.
4. Providers and data recipients
CADALYX uses specialist service providers for hosting/infrastructure, payment processing, transactional email and — when enabled — AI processing. Providers receive only the data required for their role and act under their own terms and/or data-processing obligations.
Property intelligence also uses public or authoritative geospatial sources. Queries to those sources can include parcel geometry, coordinates or other location context needed to retrieve the requested data.
5. International transfers
Some infrastructure or service providers may process data outside Latvia or the EEA. Where GDPR requires it, the applicable provider and CADALYX rely on an appropriate transfer mechanism or safeguard.
6. Retention
Workspace assessments, reports and portfolio records are retained while needed to provide your account and its history, unless deleted through account lifecycle actions or retention is required by law.
Billing/accounting records may be retained for the period required by Latvian or EU law. Security and technical logs are retained only for operational, security and troubleshooting needs rather than as a permanent customer record.
7. Your rights
Depending on the legal basis and circumstances, you may request access, correction, deletion, restriction, portability or object to processing. You may also lodge a complaint with the Latvian Data State Inspectorate (Datu valsts inspekcija).
Account deletion is available through CADALYX account settings. Some billing or compliance records may remain where retention is legally required.
8. Automated analysis and decision support
CADALYX generates screening-level property intelligence from geospatial and Earth-observation data. CADALYX and UMA do not make a final legal, engineering, credit, insurance, valuation or planning decision on your behalf. The product is designed to support human review, not replace it.
9. Security
CADALYX uses access controls, workspace boundaries, request-rate limiting, encrypted transport, restricted administrative access and immutable assessment-revision patterns to reduce the risk of unauthorized access or record confusion. No online service can guarantee absolute security.
10. Changes to this policy
We may update this policy as CADALYX, its processors or legal obligations change. The current effective date is shown at the top of this page.