Legal
Privacy Policy
What CashLoop collects, why, and what you can ask us to do with it.
Who this covers
This policy covers CashLoop, the invoicing and subscription service at cashloop.co and app.cashloop.co. It applies to the people who use CashLoop and to the customer data those businesses store in it. Where your business stores its own customers' details in CashLoop, your business is the controller of that data and we process it on your behalf.
What we collect
Account details you give us: name, work email, phone number, organization name, country and tax registration number. Data you enter: customers, products, invoices, quotations, payments, expenses, vendors and subscriptions. Technical data created by using the service: sign-in times, IP address, browser and device type, and the audit log of actions taken in your organization. Payment details when you pay for CashLoop are handled by our payment provider; we never see or store full card numbers.
Why we hold it
To run the service you have asked for, to keep your organization's data separated from every other organization's, to send invoices and reminders you have asked us to send, to investigate problems you report, and to meet record-keeping obligations where the law requires it.
Who we share it with
Suppliers who run parts of the service for us, and no one else. Today these are Supabase (database, authentication and file storage), Resend (sending email), Sentry (error reports, which may include the page you were on when something failed), PayPal (payments), and an SMS provider if your organization enables SMS notifications. We do not sell personal data, and we do not share it for advertising.
Where it is stored
On servers operated by the providers above. Data may be processed outside your country. We ask each provider for contractual protections covering that transfer.
How long we keep it
For as long as your organization has an account, plus the period any tax or accounting law requires records to be kept. When you close an account you can ask us to delete what remains; some records are retained where we are legally required to keep them.
Your rights
You can ask what we hold about you, ask for a copy, ask us to correct it, and ask us to delete it. If your data was entered into CashLoop by a business you deal with, ask that business first — they control it, and we will point you to them. Write to privacy@cashloop.co and we will respond within 30 days.
Security
Every table is scoped to one organization and enforced at the database level, not only in the application. Access to production data is limited to staff who need it. If a breach affects your data we will tell you and the relevant authority as the law requires.
Changes
If we change this policy materially we will tell account administrators by email before it takes effect.