Privacy Policy

1.Who we are

CashVista (“CashVista”, “we”, “us”, “our”) is a personal finance application published and operated by SUGUDIGITAL, which acts as the data controller responsible for your personal data under the GDPR.

This policy applies to the CashVista mobile application and to this website. By using CashVista, you acknowledge the practices described here.

2.Information we collect

We collect only what we need to provide the service. Specifically:

a. Your account

CashVista does not require a sign-up to get started. On first launch, the app creates an anonymous account tied to a random identifier, so your data can be stored and synced securely.

• If you choose to back up your data, you add your email address, which becomes linked to your account so you can recover your data or use it on another device.
• Any information you send us when you contact support (e.g. your email address and message).

b. Your name and age (optional)

During onboarding you may optionally provide your first name and your age. Both are optional: you can leave these fields blank and still use the app. Neither is used for cross-app tracking, and we do not sell your data or share it with advertisers.

You can ask us to delete your name and age at any time — see section 10 (Your rights).

c. Financial information you enter

The financial data in CashVista is what you enter manually, and it is stored on our servers (in the EU) so it is backed up and available across your devices:

• Transactions you add or edit: name, amount, date, and category.
• Your settings: currency, starting balance, low-balance buffer, and alert preferences.

d. Subscription & paywall information

If you subscribe to CashVista Pro, your purchase is processed by Apple, and your subscription status is managed through Superwall. We receive your subscription status (active, expired, in trial) — never your card or payment details, which are handled entirely by Apple.

Superwall also processes paywall interaction data on our behalf: which offer screen was shown, where in the app it was triggered from, whether you subscribed or dismissed it, together with basic device and app attributes (such as app version, device type and a subscription identifier). We use this only to operate, measure and improve our subscription offers. It is not used to track you across other apps or websites, and it is never shared with advertisers.

e. Bank account data (optional, planned)

Connecting a bank account is a planned, optional feature and is not active in the current version. If and when you choose to connect a bank, it will work through a regulated provider (such as Plaid), your banking credentials will be handled by that provider — never by us — and this policy will be updated before the feature is enabled. See section 12.

f. Technical & diagnostic data

We may process limited technical information necessary to operate and secure the service, such as app version, device/OS type, and server logs (including IP address) used for security, abuse-prevention and troubleshooting.

3.How your bank connection works (optional)

When available, reading your transactions automatically would rely on a specialised financial data provider such as Plaid Inc. (“Plaid”). Here is how it works:

• When you connect a bank, Plaid's own secure screen opens. You enter your credentials directly with Plaid (or are redirected to your bank's own login / open-banking flow).
• CashVista never sees, receives, or stores those credentials.
• After you authorise access, Plaid provides our secure backend with an access token. We store this token encrypted and use it only to fetch the account and transaction data you consented to share.
• You can revoke this access at any time by disconnecting the account in CashVista, which also revokes the token with Plaid.

Plaid processes your data in accordance with its own End User Privacy Policy. We encourage you to review it to understand how Plaid handles the information involved in connecting your accounts.

4.How we use your information

We use the information described above to:

• Provide the core service: store your transactions and generate your 12-month cash-flow forecast, balances, and analysis.
• Send you the alerts you enable, such as low-balance warnings.
• Keep your data separate, secure, and available across app restarts.
• Maintain, troubleshoot, and improve the reliability and security of the app and our servers.
• Respond to your support requests and comply with our legal obligations.

We do not use your financial data for advertising, profiling for third parties, or any purpose incompatible with providing CashVista to you.

5.Legal bases for processing (GDPR)

Under the GDPR, we rely on the following legal bases:

• Your consent (Art. 6(1)(a)) — for backing up your data with your email address, for the optional first name and age you provide during onboarding, and (optionally, in a future release) for connecting a bank account. You may withdraw consent at any time by deleting your data or, where applicable, disconnecting the account.
• Performance of a contract (Art. 6(1)(b)) — to provide the features you request when you use the app.
• Our legitimate interests (Art. 6(1)(f)) — to secure our service, prevent fraud and abuse, and improve reliability, balanced against your rights.
• Compliance with legal obligations (Art. 6(1)(c)) — where the law requires us to retain or disclose information.

6.How we share your information

We do not sell your data. We share it only with the following categories of recipients, and only as needed to run the service:

• Supabase (database & authentication) — stores your account and financial data on our behalf, hosted in the European Union.
• Apple and Superwall — to process and manage your subscription (Apple handles the payment; Superwall manages subscription status).
• Email provider — to send you account verification codes when you back up your data.
• Plaid (optional) — only if and when you enable the bank-connection feature.
• Legal & safety: we may disclose information if required by law, court order, or to protect the rights, safety, and security of our users, the public, or CashVista.
• Business transfers: if CashVista or SUGUDIGITAL is involved in a merger, acquisition, or asset sale, your data may be transferred under the same protections described here.

7.International data transfers

Your account and financial data are stored in the European Union (via Supabase). Some providers that support the app — such as Apple and Superwall (subscriptions) — may process limited data outside the European Economic Area (EEA), including in the United States. Where personal data is transferred outside the EEA, we rely on appropriate safeguards recognised by the GDPR, such as the European Commission's Standard Contractual Clauses, so your data keeps an equivalent level of protection.

8.How we protect your data

• Encryption in transit: all communication between the app, our servers, and our providers is protected with TLS/HTTPS.
• Encryption at rest & isolation: your data is encrypted at rest, and database row-level security ensures each user can only ever access their own records.
• Device protection: your account credentials are held in the platform keychain, and you can lock the app with Face ID, Touch ID, or your device passcode. Biometric verification happens entirely on your device and is never shared with us.
• Minimisation: we collect only what is necessary to provide the service.

No method of transmission or storage is ever completely secure, but we work continuously to protect your information using industry-standard measures.

9.Data retention & deletion

We keep your information only for as long as needed to provide the service to you:

• We keep your account and financial data for as long as you use CashVista, so your forecast is available whenever you open the app.
• Deleting your data from within the app (right to erasure) permanently removes your data from your device and erases the associated records on our servers.
• Residual copies in encrypted backups are purged within 30 days.
• Limited technical logs are automatically deleted after a short retention period.

10.Your rights

Subject to the GDPR, you have the right to:

• Access the personal data we hold about you;
• Rectify inaccurate or incomplete data;
• Erase your data (“right to be forgotten”);
• Restrict or object to certain processing;
• Data portability — receive your data in a structured, machine-readable format;
• Withdraw your consent at any time, without affecting prior processing.

Many of these actions are available directly in the app (disconnecting an account, deleting your data). To exercise any right, you can also contact us at contact@cashvista.app. We will respond within the timeframe required by law.

You also have the right to lodge a complaint with your local supervisory authority. In France, this is the Commission Nationale de l'Informatique et des Libertés (CNIL) — www.cnil.fr.

11.Children's privacy

CashVista is not intended for children. The app is designed for users aged 18 and over, and we do not knowingly collect personal data from anyone under this age. If you believe a child has provided us with personal data, please contact us and we will delete it.

12.Open banking & future providers

As CashVista grows, we may connect to your bank through regulated open-banking providers in addition to, or instead of, Plaid (for example, licensed account-information service providers in Europe and the UK). Any such provider will be bound by the same principles set out in this policy: you remain in control, you explicitly consent to each connection, your credentials are handled by the regulated provider (never by us), and your data is protected with the same safeguards. We will update this policy to name any new provider before it is used.

13.Third-party services

CashVista relies on a small number of essential services, each acting as our processor:

• Supabase — database and authentication; your data is hosted in the EU.
• Superwall — subscription management, paywalls, and paywall analytics.
• Apple — app distribution, in-app purchases, and (if enabled) biometric authentication, governed by Apple's own privacy policy.
• Resend — sending transactional emails such as verification codes.
• Plaid — only if you enable the optional bank-connection feature (see section 3).

These providers are permitted to use your data only to perform services for us, under contract and confidentiality obligations.

14.Our website & cookies

This website (www.cashvista.app) is a simple informational site. It does not use advertising or third-party tracking cookies. It may use a web font service to display fonts, and our hosting provider may process standard, short-lived server logs for security and performance. We do not build advertising profiles from your visit.

15.Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, providers, or legal requirements. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you in the app. Your continued use of CashVista after an update means you accept the revised policy.

16.Contact us

If you have any questions, requests, or concerns about this policy or your personal data, please contact us: