Privacy Policy

1. Data controller

The controller responsible for processing and protecting personal information, within the meaning of Quebec’s Law 25 and the GDPR, is:

• Identity: Benoit De Grandpré (the "Publisher").
• Contact: support@cardendar.com.

The Publisher is committed to handling your information with transparency, purpose limitation and data security.

2. Information collected

Cardendar collects only what it needs to work:

• Identification: your email address, for authentication and service communications.
• Your cards: issuer, card name, the nickname you give it, network, the last 4 or 5 digits, credit limit, balance, statement and due dates, annual fee and opening date.
• Your tracking: payments you record, welcome bonus progress, credits claimed, free-night certificates and renewal decisions.
• Your preferences: province, country of use, credit utilization target, preferred reward type, date format and language.
• Technical data: IP address and usage metadata passed on by the host, needed to keep the service secure.

All of this is entered by you. Cardendar imports none of it from an external source.

3. What Cardendar does not collect

This section matters as much as the previous one:

• No full card number, no PIN, no security code. Only the last 4 or 5 digits are stored, and only to help you tell two similar cards apart.
• No connection to your bank accounts. Cardendar connects to no financial institution and has access to no statement. Everything it knows, you typed in.
• No credit score. Cardendar computes a utilization rate from the limits and balances you enter. It does not obtain, consult or store your score from Equifax or TransUnion.
• No analytics, no advertising. No third-party tracker, no advertising pixel, no profiling.

4. Purposes and legal basis

Your information is processed for:

• Performing the service: due-date calendar, card recommendation, bonus and annual fee tracking, eligibility.
• Our legitimate interest: securing the application, fixing defects, improving the service.
• Compliance with our legal obligations.

It is never sold to third parties, nor used to train artificial intelligence models.

5. No sale, no sharing (CCPA/CPRA)

Cardendar does not sell your personal information and does not "share" it within the meaning of the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), for cross-context behavioral advertising.

6. Providers and hosting outside Quebec

To operate, Cardendar entrusts certain data to the following providers:

• Supabase — authentication and database.
• Vercel — application hosting.
• Google — authentication provider, only if you choose "Sign in with Google".
• Resend — sending the service's emails. Receives your email address and the message content.
• Stripe — payment processing. Receives your email address and your billing information; the Publisher never sees your card number.

These providers host data outside Quebec. The Publisher selects providers that publish contractual data protection commitments and apply industry-recognized security measures. No other third party receives your information.

7. Retention

• Your account data is kept as long as the account remains active, and deleted on request.
• Beta access requests, collected before public sign-ups opened, were deleted in August 2026. That form no longer exists.
• Prolonged inactivity: an account left inactive for eighteen (18) consecutive months may be deleted after an email notice left unanswered for 30 days.

8. Your rights (Law 25, GDPR, CCPA)

You have the following rights:

• Right of access and rectification.
• Right to erasure and to delete your account.
• Right to restriction of processing and right to object.
• Right to data portability in a structured, commonly used format.

To exercise them, write to support@cardendar.com from the address associated with your account. We respond within a maximum of 30 days.

9. Cookies

Cardendar uses only technical, strictly necessary cookies: keeping your session and your language preference. No advertising cookie, no third-party tracker — and therefore no consent banner to click.

10. Security and incident handling

Traffic is encrypted (TLS). Access to data is partitioned at the database level by row-level security rules: each account can read only its own cards, never someone else’s.

In the event of a confidentiality incident presenting a risk of serious harm, the Publisher will notify the Commission d’accès à l’information and the individuals concerned, as required by Law 25.

11. Supervisory authorities

If you believe your rights have not been respected, you may file a complaint with:

• In Quebec: the Commission d’accès à l’information (CAI).
• In Europe: the data protection authority of your country of residence.

12. Changes

Cardendar evolves quickly. Any substantial change to this policy will be announced by email to account holders before it takes effect. The last updated date appears at the top of this page.