Privacy Policy

1. Our Commitment

• We respect your privacy. We do not tolerate spam, and we will never sell, rent, lease or give away your information (name, address, email, phone number, or any other personal information) to any third party.
• This Privacy Policy explains what information CaDoMi.ai™ ("CaDoMi", "we", "us") collects, how we use it, who we share it with, and the choices you have. CaDoMi.ai™ is operated by Scrum Adventures, Inc., Long Beach, CA 90802, United States.
• It covers the CaDoMi.ai™ web platform, the Scrum Adventures Toolbox app, and any app, plugin or connector you authorize to reach your CaDoMi.ai™ account.

2. Information We Collect

• Account information you provide when you register: username, email address, first and last name, and your password (stored only as a salted hash, never in readable form).
• A mobile phone number, only if you choose to add one to your profile. It is optional, and you can remove it at any time.
• Profile settings such as your avatar, display preferences, and the team, product, sprint and theme selections that make the Platform remember where you left off.
• Content you create on the Platform: organizations, teams, products, sprints, stories, capacity plans, rubric assessments, messages and any files or images you attach.
• Billing records if you subscribe. Card details are handled by Stripe and never reach our servers; we store only the Stripe customer and subscription identifiers.
• Integration identifiers if you connect a third-party tool — for example your Atlassian account ID and email when you connect Jira.

3. How We Use Your Information

• To provide, maintain, secure and improve the Platform and the features you use.
• To verify your email address, authenticate you, and keep your account secure. Email verification is required before you can sign in.
• To communicate with you about your account, your subscription, and the services you signed up for.
• To generate AI coaching insights, assessments and chat responses when you use those features. See "AI Features" below.
• To meet our legal, accounting and security obligations.

4. AI Features

• Some Platform features — the AI coach, chat assistant, rubric insights and similar tools — work by sending the relevant content to OpenAI, our AI processing provider, which returns the generated response.
• What is sent is limited to the content the feature needs to answer: for example the sprint, story, or assessment you are asking about, together with your question.
• Conversations are not only passed through. To keep context across turns, an assistant conversation is held on OpenAI's systems and we store a reference to it alongside your conversation in our database. Deleting a conversation in CaDoMi.ai™ removes it from our side; ask us if you also need the copy held by OpenAI removed.
• If you attach a file to an AI conversation, that file is uploaded to OpenAI so the assistant can work with it, and may be executed in OpenAI's sandboxed code-interpreter environment to produce a result. Do not attach material you are not willing to have processed this way.
• The assistant also consults a fixed CaDoMi.ai™ knowledge base of agile coaching reference material. That knowledge base contains no customer data.
• OpenAI processes this content as our service provider in order to return a response. We do not authorize it to be used to train third-party models.
• These features are optional. If you would rather no content be sent for AI processing, do not use them.

5. Communications

• We send transactional email relating to your account: email verification, password resets, subscription and billing notices, and notifications about activity on your teams. These are part of the service and are not marketing.
• Where you have signed up for them, we also send newsletters and occasional marketing offers. Every marketing email carries an unsubscribe link, and unsubscribing does not affect transactional email.
• Email is delivered through Microsoft 365, which processes it as our service provider.
• CaDoMi.ai™ does not currently send SMS or text messages. A phone number on your profile is stored as contact information only. If we ever introduce SMS, we will ask for your explicit opt-in first and update this policy before sending anything.

6. Apps, Plugins and Connectors

• CaDoMi.ai™ exposes a Model Context Protocol (MCP) endpoint so AI assistants and other clients — such as Claude Desktop, claude.ai connectors, ChatGPT connectors, or your own automation — can work with your CaDoMi data on your behalf.
• A connector reaches your data only after you authorize it. Authorization uses OAuth 2.1 with PKCE: you sign in, you are shown which client is asking, and access begins only when you approve. Tokens are issued for a single "mcp" scope and bound to the specific CaDoMi resource they were requested for.
• Once connected, we receive the requests the client sends (the command or question you asked it to carry out) and return only data your own account is already permitted to see. Every request is scoped to your user, your teams and your organization; a connector cannot reach another customer's data.
• We do not sell data exchanged through apps, plugins or connectors, and we do not use it to build advertising profiles.
• The provider of the AI assistant or client operates under its own privacy policy, which governs what that provider does with your conversation and any data the connector returns into it. Please review that policy before connecting.
• You can disconnect a connector at any time by revoking its token, which immediately stops any further access on your behalf.

7. Data Sharing

• We will not sell your personal information, including your phone number.
• We share personal information with service providers who process it only to perform services for us: Stripe for subscription payments, Microsoft 365 for email delivery, OpenAI for the AI features described above, and Cloudflare Turnstile for bot protection on our sign-up form.
• If you connect an integration such as Jira, data is exchanged with that service according to the connection you authorized.
• Content you create is visible to other members of the organizations and teams you belong to. That is how the Platform is designed to work: a sprint or story shared with your team is visible to your team.
• We may disclose information where required by law, or to protect the rights, safety and security of our users and the Platform.

8. Cookies and Local Storage

• We use cookies that are strictly necessary to run the Platform: a session cookie to keep you signed in, and a CSRF token to protect forms against cross-site request forgery. The session cookie is HTTP-only and expires after 24 hours.
• We also use your browser's local storage to keep you signed in and to make the Platform responsive. It holds your authentication token, a cached copy of your profile and permissions, the team or product you last had open, and preferences such as your light or dark theme. This data stays in your browser and is cleared when you sign out.
• We do not use advertising cookies, and we do not run third-party analytics or tracking scripts on the Platform.

9. Mobile Application

• Scrum Adventures, Inc. built the Scrum Adventures Toolbox app as a free app. That service is provided at no cost and is intended for use as is.
• If you choose to use it, you agree to the collection and use of information in accordance with this policy. The personal information it collects is used for providing and improving the service, and we will not use or share it with anyone except as described here.
• Terms used in this Privacy Policy have the same meanings as in the Scrum Adventures Toolbox Terms and Conditions unless otherwise defined here.

10. Security

• We strive to use commercially acceptable means to protect your information: encrypted transport, hashed passwords, token-based authentication with scoped access, and rate limiting on sensitive endpoints such as sign-up and password reset.
• However, no method of transmission over the internet or method of electronic storage is 100% secure, and we cannot guarantee absolute security.

11. Data Retention

• We keep your account information and the content you create for as long as your account is active.
• When an account is deleted, the account and its personal data are removed and any live subscription is cancelled. We retain a limited deletion record — username, email address and the outcome of the subscription cancellation — as an audit trail of the deletion itself, which we are required to keep for accounting and abuse-prevention purposes.
• Content you contributed to a shared team or organization may remain visible to that team after your account is deleted, because it forms part of that team's record.

12. Your Rights and Choices

• Access and correct most of your personal information directly in your profile settings, including your name, avatar and phone number.
• Unsubscribe from marketing email at any time using the link in any marketing message.
• Delete your account, and with it your personal data, from your account settings — subject to the retention described above.
• Disconnect any app, plugin or connector you have authorized, by revoking its access.
• Contact us to access, correct, export or delete personal information you cannot change yourself. Depending on where you live, you may have additional rights under laws such as the GDPR or the CCPA, including the right to object to or restrict processing; we honor these requests regardless of your location.

13. Changes to This Privacy Policy

We may update this policy from time to time. If we make significant changes — including any change to the service providers we send your data to, or the introduction of SMS messaging — we will notify you by email where required by law, and we will update the "Last updated" date on this page.

14. Contact Us

If you have any questions or suggestions about this Privacy Policy, or you would like to access, correct, export or delete your personal information, please contact us at support@cadomitools.com.

Scrum Adventures, Inc.
Long Beach, CA 90802, United States
(562) 337-9777