Privacy policy

Last updated 10 Nov 2026

What we process

Account data for users of the Service (name, email, hashed password, role, sign-in events); business records Customer imports or creates (customers, contacts, invoices, payments, notes, communications); and technical logs (request identifiers, IP addresses, timing) kept for security and reliability.

Why

To provide the Service under the terms of service: sending reminders and statements Customer configures, computing predictions and reports for Customer, securing accounts, and responding to support requests. We do not use Customer data to train models shared with other customers.

Who sees it

Only users Customer invites to its workspace, and CashPilot staff strictly when needed for support Customer requests. Sub-processors: the hosting provider for the deployment region and, if Customer configures one, its email relay.

Retention

For the life of the subscription and 30 days after termination, then deleted. Security logs are retained for 90 days. Administrators can export everything at any time.

Recipients of reminders

Customer's customers receive communications on Customer's behalf. Each message identifies the sending organisation and offers a reply channel. Portal links are unguessable tokens that administrators can rotate.

Your rights

Users and Customer's customers can ask for access, correction or deletion of their personal data through Customer, who is the controller; we assist as processor. Contact hello@cashpilot.app.

Security

TLS in transit, encrypted volumes at rest, scrypt password hashing, CSRF protection, brute-force throttling, per-tenant isolation enforced in every query, and a full audit trail of administrative actions.