Privacy Policy

Our Privacy Principles

Four commitments shape every decision we make about data. They are the summary; the sections that follow are the detail.

• Collect less. We ask for the minimum needed to make a feature work, and we delete it when it is no longer needed.
• Never sell. We do not sell personal information, and we do not share it with data brokers or advertising networks for their own purposes.
• No surveillance advertising. We do not build advertising profiles, and we do not use the content of your private communications to target you.
• Your data is yours. You can export it, correct it, and delete it — and we will not make that difficult.

Who We Are

Cinnamon Publishing LLC ("Cinnamon Publishing," "we," "us," or "our") is the controller of the personal information described in this policy. This policy applies to cinnamon.mx and to the applications we publish, including Ryde, MoiraFinance, and Kaede Chat.

It does not apply to third-party services you reach through our apps — such as a brokerage, payment processor, or app store — each of which handles your information under its own policy.

Information We Collect

Information you give us

• Account details — name or display name, email address, phone number, password (stored only as a salted hash), and profile photo if you add one.
• Content you create — messages, files, and images in Kaede Chat; portfolio names and allocation preferences in MoiraFinance; saved places and trip notes in Ryde.
• Payment information — handled by our payment processors. We receive confirmation of payment, the last four digits of the card, and the billing country; we never receive or store full card numbers.
• Support correspondence — the messages, screenshots, and diagnostic details you send when you contact us.
• Verification information — where a regulated feature requires it, identity documents collected and held by our specialist verification partner rather than by us.

Information we collect automatically

• Device and app data — device model, operating system version, app version, language, timezone, and crash and diagnostic logs.
• Usage data — which features you open and general interaction patterns, aggregated wherever possible to understand what to improve.
• Network data — IP address and approximate region derived from it, used for security, fraud prevention, and regional compliance.
• Location data — only where a feature needs it, only with your permission, and only for as long as the feature is in use. Ryde needs precise location to match you with a nearby driver and to navigate; Kaede Chat and MoiraFinance do not use precise location.

Information from others

• Account details from a single sign-on provider, if you choose to sign in that way.
• Transaction and holdings data from a brokerage or account-aggregation provider you connect to MoiraFinance, at your instruction.
• Fraud and risk signals from security providers, used to protect accounts.

How We Use Information

• To provide the Services — create and maintain your account, deliver your messages, match rides, display your portfolio, and sync across your devices.
• To keep people safe — detect and prevent fraud, abuse, spam, and unauthorised access, and enforce our Terms of Service.
• To support you — respond to your questions and diagnose problems you report.
• To improve our products — understand which features work, fix crashes, and measure performance, using aggregated or de-identified data wherever it will do the job.
• To communicate with you — send service notices, security alerts, and billing confirmations. Marketing email is opt-in and you can unsubscribe from any of it at any time.
• To meet legal obligations — comply with applicable law, tax and accounting requirements, and valid legal process.

Automated decision-making

We use automated systems to flag fraud, spam, and abuse, and to generate the allocation suggestions in MoiraFinance. These do not produce legal effects for you without human review, and where a decision meaningfully affects your access to a Service you can ask a person to look at it by writing to admin@cinnamon.mx.

Machine learning

We do not use the content of your private messages or your financial account data to train general-purpose machine learning models, and we do not share it with third parties for that purpose.

Legal Bases (EEA & UK)

If you are in the European Economic Area, the United Kingdom, or Switzerland, we rely on the following legal bases under the GDPR and UK GDPR:

• Performance of a contract — to provide the Services you have signed up for and to process payments.
• Legitimate interests — to secure our platform, prevent fraud and abuse, and improve our products, where those interests are not overridden by your rights. We document this balancing test and will share our reasoning on request.
• Consent — for precise location, optional analytics cookies, marketing communications, and any special category data. You may withdraw consent at any time, without affecting processing already carried out.
• Legal obligation — to comply with tax, accounting, anti-money-laundering, and other statutory duties.

How We Share Information

We share personal information only in these circumstances:

• With people you choose — the recipients of your messages, or a rider and driver exchanging the details needed to complete a trip.
• With service providers — cloud hosting, payment processing, email delivery, error monitoring, identity verification, and customer support tooling. They act on our instructions under written contracts, may use the data only to provide their service to us, and must protect and delete it appropriately.
• For legal reasons — when required by valid legal process or where we believe disclosure is necessary to prevent imminent harm. We assess every request for validity and scope, push back on overbroad requests, and notify affected users unless we are legally prohibited from doing so.
• In a corporate transaction — if we are involved in a merger, acquisition, or sale of assets, information may transfer as part of it. We will give notice before your information becomes subject to a materially different policy, and the acquirer remains bound by the commitments here until then.
• With your consent — for anything else, we ask first.

We also publish aggregated statistics that cannot reasonably be used to identify anyone.

We Do Not Sell Your Data

This applies to the meanings of "sell" and "share" under the California Consumer Privacy Act as amended, and to comparable definitions in other US state privacy laws. Because we do not sell or share in this sense, there is no opt-out for you to exercise — but the rights in Section 11 are yours regardless.

Cookies & Similar Technologies

On cinnamon.mx we use only what the site needs to function — there are no advertising or cross-site tracking cookies, and no third-party trackers embedded in our pages.

• Strictly necessary — session management, security, and load balancing. These cannot be switched off without breaking the site.
• Preferences — remembering choices such as language, stored locally on your device.
• Analytics — privacy-preserving, aggregate measurement of page performance. Where consent is required by law, we ask before setting these.

You can clear or block cookies in your browser settings, and you can reset the advertising identifier on your mobile device at any time. We honour Global Privacy Control signals where your browser sends them.

Data Retention

We keep personal information only as long as we need it for the purpose we collected it, then delete or irreversibly de-identify it. In practice:

• Account information — for as long as your account is active.
• After account deletion — removed from production systems within 30 days, and from encrypted backups within 90 days.
• Message content — retained only as long as needed to deliver it and to sync your own devices, subject to any retention setting you choose.
• Diagnostic and crash logs — up to 90 days.
• Security and fraud records — up to 24 months, to detect repeat abuse.
• Transaction and tax records — for the period required by law, typically seven years.

We may retain information longer where we are legally required to, or where it is necessary to resolve a dispute or enforce our agreements.

How We Protect Information

We use industry-standard safeguards appropriate to the sensitivity of the data, including encryption in transit and at rest, least-privilege access controls with mandatory multi-factor authentication for staff, audit logging, regular dependency patching, and independent security testing. Access to production data is limited to the people who need it to do their jobs and is logged.

No system is perfectly secure. If a breach affects your personal information, we will notify you and the relevant regulators without undue delay and within the timeframes the law requires, and we will tell you what happened and what we are doing about it.

You can help by using a strong, unique password and enabling multi-factor authentication where we offer it.

Your Rights & Choices

Depending on where you live, you may have the right to:

• Access a copy of the personal information we hold about you.
• Correct information that is inaccurate or incomplete.
• Delete your information, subject to our legal retention obligations.
• Port your data — receive it in a structured, machine-readable format, or have us send it to another provider where technically feasible.
• Object to or restrict processing based on our legitimate interests.
• Withdraw consent at any time where consent is our legal basis.
• Opt out of marketing communications, via the unsubscribe link or your in-app settings.
• Be free from discrimination for exercising any of these rights. We will not degrade your service or charge you more because you did.

How to exercise them

Most of this is self-service in your account settings, including export and deletion. For anything else, email admin@cinnamon.mx. We will verify your identity — usually by confirming control of your account email — and respond within 30 days, or 45 days where US state law allows an extension and we tell you why. Our response is free unless a request is manifestly excessive or repetitive.

You may use an authorised agent to make a request on your behalf where the law permits; we will ask for proof of their authority.

If you are unhappy with how we handle your request, you may complain to your local data protection authority. If you are in the EEA or UK, that is the supervisory authority where you live or work. We would appreciate the chance to put it right first.

International Transfers

We operate globally, so your information may be processed in countries other than your own, including the United States. Where we transfer personal information out of the EEA, the UK, or Switzerland, we rely on an appropriate safeguard — an adequacy decision, the European Commission's Standard Contractual Clauses with the UK Addendum where applicable, or another mechanism permitted by law — and we carry out a transfer impact assessment where one is required. You may request a copy of the relevant safeguards from admin@cinnamon.mx.

Children's Privacy

Our Services are not directed to children under 13, and we do not knowingly collect personal information from them. Services involving payments, investing, or driving require you to be 18 or older. If you believe a child has provided us with personal information, contact admin@cinnamon.mx and we will delete it promptly. Where local law sets a higher age of digital consent, we apply that higher age.

App-Specific Disclosures

Ryde

Ryde processes precise location while you are requesting or taking a trip, and shares the limited details needed to complete it — pick-up point, first name, and vehicle or rider identifiers — between you and your driver. Trip history is retained for receipts, disputes, and safety investigations. Precise location collection stops when the trip ends and background location is never collected without a separate, clearly labelled permission.

MoiraFinance

If you link an external investment account, we receive holdings and transaction data through a regulated aggregation provider using tokenised access — we never see or store your brokerage password. We use that data solely to show and manage your portfolio inside the app. You can disconnect an account at any time, which revokes our access and deletes the imported data within 30 days.

Kaede Chat

We keep message content only as long as needed to deliver and sync it, and we do not scan the substance of your private conversations for advertising. We retain minimal metadata — such as delivery timestamps — for reliability and abuse prevention. Reporting a message shares the reported content with our safety team so we can act on it.

Third-Party Services

Our sites and apps may link to services we do not operate. This policy does not cover them, and we are not responsible for their practices. When you follow a link or connect an external account, that provider's privacy policy governs what they do with your information — it is worth reading before you connect.

Changes to This Policy

We will update this policy as our products and the law change. The "Last updated" date at the top always reflects the current version. If we make a material change — for example, using your information for a genuinely new purpose — we will give you prominent notice in advance, by email or in-app notice, and where the law requires it we will ask for your consent.

We will never apply a materially less protective policy to information we already hold about you without telling you first.

Contact Us

We would rather hear from you than have you wonder. Privacy questions, requests, and complaints all go to the same place.

Entity

Cinnamon Publishing LLC

Email

admin@cinnamon.mx

Post

1100 Bellevue Way NE, Ste 8A #664
Bellevue, WA 98004
United States

Response time

Within 30 days of a verified request