Privacy Policy

1. Introduction and Scope

This Privacy Policy explains how CACHE Apps Inc. ("CACHE," "CACHE Apps," "we," "us," or "our") collects, uses, discloses, stores, protects, retains, and deletes personal information.

CACHE Apps Inc. is a Canadian company based in Alberta, Canada.

This Privacy Policy applies to personal information processed through:

The CACHE Apps website at https://cacheapps.io.
CACHE mobile applications.
CACHE web-based applications and dashboards.
Financial management, invoicing, and expense management features.
Bank connectivity and financial data integration services.
CACHE AI and other AI-powered functionality.
Customer support, account administration, and related communications.

This Privacy Policy applies to individuals, freelancers, business owners, and authorized representatives of organizations using CACHE.

Where an organization uses CACHE to manage information about employees, contractors, customers, vendors, or other individuals, that organization is responsible for ensuring it has the appropriate authority to provide that information to CACHE.

CACHE processes such information to provide the services requested by the organization, subject to applicable law.

CACHE handles personal information in accordance with applicable Canadian privacy legislation, including Alberta's Personal Information Protection Act (PIPA) and the federal Personal Information Protection and Electronic Documents Act (PIPEDA), where applicable.

Additional privacy laws may apply depending on an individual's location and the services provided.

2. Information We Collect

We collect personal information directly from you, automatically through your use of CACHE, and from third parties you authorize.

2.1 Account and Profile Information

When you register for or use CACHE, we may collect:

Full name.
Email address.
Business or organization name.
Account username or identifier.
Business contact information.
Account preferences and settings.
Team membership and assigned roles.
Authentication and account verification information.

This information allows us to create and maintain accounts, authenticate users, manage permissions, and communicate important account information.

2.2 Financial and Banking Information

When you connect a financial account or use CACHE's financial management features, we may collect or process:

Financial institution name.
Bank account name and identifying information.
Bank account numbers and related identifiers.
Account balances.
Transaction dates and descriptions.
Transaction amounts.
Merchant and payee information.
Income and expense records.
Transaction categories.
Financial information derived from connected accounts.

CACHE uses Flinks to facilitate authorized connections to supported financial institutions.

Financial account connections used for transaction retrieval are intended to provide read-only access to financial information.

CACHE does not use these connections to initiate withdrawals or transfers from your bank account.

Bank connection credentials, where required, are handled through the applicable connectivity provider and its authentication processes.

The information available to CACHE depends on the financial institution, the permissions granted, and the functionality supported by the connectivity provider.

2.3 Receipts, Invoices, and Business Records

When you use CACHE's document and financial record management features, we may collect:

Uploaded receipts and supporting documents.
Invoice numbers, dates, descriptions, and amounts.
Customer and vendor names.
Billing and business contact details.
Tax information.
Payment statuses and payment references.
Reimbursement requests and supporting documentation.
Expense categories.
Budget information.
Financial reports and summaries.
Other documents you voluntarily upload.

Documents may contain personal information about individuals other than the account holder.

You are responsible for ensuring that you have the appropriate authority to upload, disclose, or manage information belonging to other individuals.

2.4 Payment Information

CACHE integrates with Stripe to facilitate payment-related services.

When users accept payments through CACHE-generated invoices, Stripe processes the payment through the relevant connected Stripe account.

CACHE does not receive or hold the invoice creator's customer funds as part of this arrangement.

CACHE may receive a platform service fee deducted at the time of payment.

CACHE may receive or process information relating to:

Payment amounts.
Transaction identifiers.
Payment status.
Payment dates.
Payment method details made available by Stripe.
Platform fees.
Refunds, disputes, and related transaction information.

Payment information is also subject to Stripe's applicable privacy policies and service agreements.

2.5 Technical and Usage Information

When you access CACHE, we may automatically collect:

Device type and operating system.
Browser type and version.
Internet Protocol (IP) address.
Device identifiers.
Application version.
Login and authentication activity.
Features accessed.
Pages viewed.
Session information.
Error reports and diagnostic information.
Security-related activity.

We use this information to operate, maintain, troubleshoot, protect, and improve our services.

2.6 Communications and Support Information

When you communicate with CACHE, we may collect:

Emails and messages you send.
Support requests.
Feedback and suggestions.
Information submitted through contact forms.
Records of communications relating to your account.

We use this information to respond to inquiries, resolve problems, and maintain appropriate records of customer interactions.

3. How We Use Personal Information

CACHE collects and uses personal information for identified, legitimate purposes related to providing and maintaining its services.

3.1 Providing Financial Management Services

We use information to:

Create and manage accounts.
Organize financial transactions.
Categorize income and expenses.
Manage receipts and invoices.
Prepare budgets and cash flow summaries.
Generate financial reports.
Maintain business records.
Support reimbursements and related workflows.
Provide other features requested by users.

3.2 Bank Account Connectivity

When you authorize a bank connection, CACHE uses the financial information made available through Flinks to provide connected-account features.

This may include importing transaction histories, refreshing account information, and displaying financial activity within CACHE.

Bank connectivity is optional where the relevant CACHE features can be used without a connected account.

3.3 Artificial Intelligence Features

CACHE uses artificial intelligence technologies, including Anthropic's Claude models, to provide CACHE AI functionality.

Depending on the feature and your request, information processed by CACHE AI may include:

Financial transactions.
Expense and income information.
Invoice details.
Budget information.
Cash flow records.
Financial summaries.
Questions and instructions submitted by users.
Other information necessary to generate a requested response.

Information may be transmitted to Anthropic or other authorized infrastructure providers for processing.

CACHE AI is intended to assist users with understanding and managing financial information.

AI-generated responses may contain inaccuracies and should be reviewed before being relied upon for important financial, tax, legal, or business decisions.

CACHE does not sell personal or financial information to AI providers.

3.4 Security and Fraud Prevention

We use relevant information to:

Authenticate users.
Identify unauthorized access.
Investigate suspicious activity.
Protect accounts and information.
Prevent misuse of our services.
Maintain the integrity and availability of our platform.
Respond to security incidents.

3.5 Communications

We may use your contact information to send:

Account verification messages.
Security notifications.
Invoice-related notifications.
Payment confirmations.
Important service updates.
Support responses.
Other communications necessary to operate your account.

Promotional messages are handled in accordance with applicable Canadian anti-spam legislation and other relevant laws.

Where consent is required for marketing communications, we obtain that consent and provide an appropriate unsubscribe mechanism.

3.6 Improving Our Services

We may use relevant information to investigate technical issues, improve usability, evaluate service performance, and develop or improve functionality.

Where reasonably possible, we use aggregated or de-identified information for analysis that does not require directly identifying an individual.

4. Consent and Your Choices

CACHE obtains consent for the collection, use, and disclosure of personal information where required by applicable law.

Consent may be provided through account registration, acceptance of relevant terms, feature-specific authorizations, or other appropriate mechanisms.

The type of consent requested depends on the sensitivity of the information and the purpose for which it is collected or used.

4.1 Financial Account Authorization

Connecting a financial account requires you to authorize access through the applicable bank connectivity process.

You may choose not to connect a bank account, although certain connected-account features will be unavailable.

4.2 Optional Features

Where a feature involves an optional collection, use, or disclosure of personal information, CACHE will provide an appropriate choice where required by law.

4.3 Withdrawal of Consent

You may withdraw consent to certain uses or disclosures of your personal information, subject to applicable legal or contractual restrictions and reasonable notice.

Withdrawing consent may prevent CACHE from providing features that depend on the relevant information.

To request withdrawal of consent, contact privacy@cacheapps.io.

We will explain any relevant consequences and legal limitations.

5. Disclosure of Personal Information

CACHE does not sell, rent, or share personal information with advertisers.

We disclose personal information only for legitimate purposes associated with operating our services, when authorized by users, or when otherwise permitted or required by law.

5.1 Third-Party Service Providers

CACHE uses the following service providers:

Supabase — Provides our database, authentication, file storage and serverless functions. Our Supabase project is hosted in the Canada (Central) region, so your account, financial records, receipts and documents are stored in Canada. Serverless functions may run in the region closest to the request; the functions that handle bank data are pinned to Canada. Supabase may also process operational information through services or personnel in other countries, including the United States and Singapore.

Amazon Web Services (AWS) — Provides the underlying cloud infrastructure for our Supabase project, in the Canada (Central) region.

Flinks — Provides financial institution connectivity and authorized, read-only financial data retrieval. Flinks is a Canadian financial technology provider. Its published information indicates that financial information is stored in Canada or the United States depending on the user's country of residence.

Stripe — Provides payment processing, connected payment accounts, payment records, and related financial transaction services for invoices paid online. Stripe operates internationally and may process information in the United States and other countries where it or its service providers operate.

Anthropic (Claude AI) — Provides artificial intelligence processing for CACHE AI and for reading receipts (extracting the vendor, date, amounts and tax from receipt images you capture or forward). Anthropic's commercial API services may process information through infrastructure in the United States, Europe, Asia, and Australia. Anthropic states that API customer data is stored in the United States by default, unless different contractual arrangements apply, and that it is not used to train Anthropic's models.

Resend — Sends our transactional email (invoices, estimates, invites, notifications) and receives the receipt emails you forward to your personal @in.cacheapps.io address. Resend operates in the United States.

PostHog — Provides product analytics, crash and error reports, and the in-app support chat. We use PostHog's United States cloud.

Google and Apple — Provide optional sign-in (Sign in with Google, Sign in with Apple) and distribute the app through their app stores under their own terms.

Clearbit — Looks up a vendor's logo from the vendor's business name only; no personal information is sent.

For questions about any service provider, contact privacy@cacheapps.io.

5.2 Authorized Accountants and Team Members

When you invite an accountant, employee, collaborator, or other authorized person to access your CACHE account, information may be made available according to the permissions associated with that person's role.

You are responsible for selecting appropriate individuals and managing the access you grant.

5.3 Legal Requirements

CACHE may disclose personal information when required or permitted by applicable law, including in response to valid legal process or lawful requests from authorized public authorities.

5.4 Business Transactions

If CACHE becomes involved in a merger, acquisition, financing, restructuring, or transfer of business assets, personal information may be disclosed where permitted by applicable law and subject to required safeguards and confidentiality obligations.

6. International Storage and Data Transfers

CACHE is based in Alberta, Canada, but some of the technology providers supporting its services operate internationally.

Personal information may be stored, accessed, or processed outside Canada.

Depending on the service and the applicable configuration, countries or regions involved may include:

Canada: Our database, file storage, authentication and the serverless functions that handle bank data (Supabase on AWS Canada Central), and bank connectivity (Flinks).
United States: Payment processing (Stripe), email delivery and receipt-email intake (Resend), analytics and support chat (PostHog), AI processing (Anthropic), and Supabase support operations.
Singapore: Certain Supabase-related operational and support activities.
European countries: Certain cloud, support, and AI processing activities.

The countries involved may vary according to the provider, service configuration, and operational requirements.

Where personal information is processed outside Canada, it may be subject to the laws of the jurisdiction in which it is processed, including lawful access requests by public authorities.

CACHE remains responsible for personal information under its custody or control and takes appropriate steps to protect it when using third-party service providers.

Where required, we use contractual, technical, and organizational safeguards appropriate to the information and processing involved.

Where applicable and implemented, cross-border transfers may be supported by standard contractual clauses or other legally recognized transfer mechanisms.

For further information about international processing, applicable countries, and our policies concerning service providers outside Canada, contact our Privacy Officer at privacy@cacheapps.io.

7. Data Security

CACHE recognizes that financial and personal information requires appropriate protection.

We maintain administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, collection, use, disclosure, alteration, loss, and destruction.

These safeguards are selected according to the sensitivity of the information and the risks associated with its processing.

Our security practices include appropriate measures relating to:

User authentication and account access.
Access permissions and authorization.
Protection of information during transmission and storage.
Security monitoring and incident response.
Management of service provider access.
Protection of application infrastructure.
Backup and recovery processes.
Restriction of internal access to information.

Access to personal information is limited to authorized individuals and service providers with a legitimate need to access it.

No internet-based service or information system can guarantee absolute security.

CACHE continually evaluates security risks and takes reasonable steps to address identified vulnerabilities.

Users are responsible for protecting their login credentials and notifying CACHE if they suspect unauthorized access to their accounts.

Security concerns, suspected unauthorized access, and potential vulnerabilities may be reported to security@cacheapps.io.

Privacy-related inquiries may be directed to privacy@cacheapps.io.

8. Your Privacy Rights

Subject to applicable law, you may have rights relating to personal information held by CACHE.

8.1 Access

You may request access to personal information CACHE holds about you.

You can view information available through the Security screen in the app (More → Security).

You may also submit a request to privacy@cacheapps.io.

8.2 Correction

You may correct inaccurate or incomplete information through your account settings or by contacting CACHE.

We may need to verify your identity before processing certain correction requests.

8.3 Data Export

You can download your data from the app:

More → Security → Export data

You may also contact our Privacy Officer if you require assistance accessing your information.

8.4 Data Deletion

You can delete your account yourself from the app (More → Security → Delete account), or request permanent deletion of your personal information by contacting privacy@cacheapps.io.

Deletion requests are completed within 30 days, except where information must be retained under applicable law or another legally permitted exception applies.

8.5 Withdrawal of Consent

You may request withdrawal of consent for certain processing activities, subject to applicable legal or contractual limitations.

8.6 Complaints

You may contact CACHE's Privacy Officer with concerns about how your personal information is handled.

You may also contact the Office of the Information and Privacy Commissioner of Alberta or another applicable privacy regulator.

We will not prevent individuals from exercising privacy rights available under applicable law.

9. Data Retention and Deletion

CACHE retains personal information only for as long as reasonably necessary to fulfill identified purposes or comply with applicable legal requirements.

Our general retention practices are:

Active account information — Retained for as long as the account remains open and the information is required to provide services.
Deleted accounts — When you delete your account from the app, your account and the data in your personal workspace are deleted immediately. Data in a workspace shared with other people stays with that workspace and its owner.
Closed account information — Information from accounts that are closed but not deleted is retained for 90 days following closure, then permanently deleted unless continued retention is required or permitted by applicable law.
Financial and accounting records — Certain financial records may be retained for seven years where required by applicable tax, accounting, or recordkeeping obligations.
Backups — Information scheduled for deletion is purged from backups within 35 days of deletion, subject to applicable legal retention requirements.
Support and correspondence records — Retained only for as long as reasonably necessary for support, operational, legal, or legitimate recordkeeping purposes.

Where information is no longer required, CACHE takes appropriate steps to securely delete, destroy, or anonymize it.

Deleting a CACHE account does not necessarily delete records independently held by financial institutions, payment processors, or other third parties acting under their own legal obligations.

10. Account Closure and Bank Disconnection

Users may discontinue using CACHE or request account closure.

Where available, users may disconnect linked financial accounts through the relevant account settings.

Disconnecting a financial account stops future access through that connection, subject to the applicable provider's technical processes.

Previously imported financial information may remain in CACHE until deleted in accordance with our retention practices or an applicable deletion request.

Account closure and bank disconnection do not override legal obligations requiring certain information to be retained.

11. Cookies and Similar Technologies

CACHE's website and applications may use cookies, session identifiers, and similar technologies where necessary to operate and secure the services.

These technologies may support:

Authentication and session management.
Security and fraud prevention.
Remembering account preferences.
Application functionality.
Performance measurement and troubleshooting.

Where applicable law requires consent for particular non-essential tracking technologies, CACHE will obtain the required consent.

Users may manage certain cookies through browser settings, although disabling essential technologies may affect the operation of the service.

12. Children's Privacy

CACHE is intended exclusively for individuals aged 18 years or older. Children under the age of 18 are not permitted to create an account or use CACHE's services.

We do not knowingly collect personal information directly from children under 18.

If we discover that a person under 18 has created an account or provided personal information, we will take steps to close the account and delete the information, except where retention is required by law.

If you believe a child has created a CACHE account or provided personal information to us, please contact privacy@cacheapps.io.

13. Privacy Breaches and Security Incidents

CACHE maintains procedures for assessing and responding to actual or suspected privacy breaches.

Where a privacy breach occurs, we will investigate the circumstances, take reasonable steps to contain the incident, and assess potential risks to affected individuals.

Where required by applicable privacy legislation, CACHE will notify the appropriate privacy regulator and affected individuals.

We will maintain records of privacy breaches where legally required.

Where appropriate, notifications may include information about the incident, potential consequences, and steps individuals can take to protect themselves.

Suspected security incidents, unauthorized account access, and potential security vulnerabilities should be reported to security@cacheapps.io.

Privacy breach concerns, including suspected unauthorized disclosure or misuse of personal information, may be reported to privacy@cacheapps.io.

Reports received through either address will be directed to the appropriate responsible personnel.

14. Third-Party Websites and Services

CACHE may contain links to websites, financial institutions, payment services, or other third-party platforms.

These services may have their own privacy policies, terms, and data-handling practices.

CACHE's Privacy Policy does not govern the independent processing activities of third parties that determine their own purposes for using personal information.

We encourage users to review the relevant privacy notices before providing information to external services.

15. Changes to This Privacy Policy

CACHE may update this Privacy Policy to reflect changes in its services, technologies, data-handling practices, or applicable legal requirements.

When changes are made, we will update the "Last Updated" date at the beginning of this policy.

Where required by law, we will provide additional notice or obtain consent before implementing material changes affecting how personal information is collected, used, or disclosed.

The current version of this Privacy Policy will be available at https://cacheapps.io/privacy.

16. Privacy Accountability and Contact Information

CACHE Apps Inc. has designated a Privacy Officer responsible for overseeing compliance with applicable privacy legislation.

The Privacy Officer is responsible for receiving and addressing privacy inquiries, access and correction requests, deletion requests, and complaints concerning the handling of personal information.

Organization: CACHE Apps Inc.

Address: 202-191 Edwards Way SW, Airdrie, AB T4B 3E2, Canada

Privacy Contact: Privacy Officer

Privacy Email: privacy@cacheapps.io

Security Email: security@cacheapps.io

Website: https://cacheapps.io

Our Privacy Officer aims to respond to initial inquiries within two business days.

Formal privacy requests will be processed within the timelines required by applicable law.

For questions about this Privacy Policy, international data processing, privacy rights, or the handling of your information, contact privacy@cacheapps.io.

For security vulnerabilities, suspected unauthorized access, or other security-related concerns, contact security@cacheapps.io.

CACHE Apps Inc. — Your Personal CFO.