Privacy Policy

1. Data controller

Controller: Vimax Studio

Contact: support@cashafter.app

Company website: https://vimaxstudio.com

2. Data we collect

We process the following categories of data:

• Account data: email address, password hash, locale and settings preferences
• Financial planning data you enter: accounts, balances, transactions, categories, regular payments, obligation rules, income sources and materialized obligation instances
• Statement import data (Pro): uploaded statement files, the recognised draft rows and the category choices you make while reviewing them
• Referral data: your invite code, which accounts registered through it and their reward status; the person you invited sees your email address in masked form
• Workspace data: invitations and membership when you use shared workspaces
• Subscription data: plan status, trial end date, payment provider customer and subscription identifiers
• Technical data: server logs (IP address, timestamps, request metadata) for security and operations

3. What we do not do

We do not connect to banks or payment cards to pull transactions automatically. We do not store your bank login credentials.

4. Purposes and legal bases

We process data to provide the service, authenticate users, process subscriptions, send transactional email (e.g. email confirmation), prevent abuse, and comply with law.

For users in the EEA/UK, legal bases include contract performance, legitimate interests (security, product improvement), and consent where required (e.g. non-essential cookies if enabled later).

5. Processors and sharing

We use trusted providers who process data on our instructions:

• Hosting and database infrastructure on our servers
• Paddle.com - merchant of record for subscription billing and payment processing for Pro plans
• OpenRouter (openrouter.ai) and the AI model providers it routes to (for example Anthropic or OpenAI) - recognition and categorisation of bank statements you upload for the AI import feature; only the statement lines and your category names are sent, never your login, email or other account data. These providers process the request transiently; we do not allow use of your data for model training where the provider offers that choice
• Email delivery (SMTP) - transactional messages (confirmation, password reset, trial and invitation notices)

6. International transfers

Infrastructure and processors may be located outside Ukraine/EEA. We use appropriate safeguards where required by applicable law.

7. Retention

We retain account and financial data while your account is active. After account deletion, we delete or anonymize data within a reasonable period, except where law requires retention (e.g. billing records).

Uploaded statement files are deleted from our servers as soon as recognition finishes (and in any case within 24 hours). Draft rows stay until you add or delete the import. Expired login and one-time tokens are purged automatically.

8. Your rights

Depending on your location, you may have rights to access, rectify, erase, restrict, or port your data, and to object or withdraw consent. Contact support@cashafter.app. You may also lodge a complaint with your local supervisory authority.

You can export and delete your data through account features where available in the app.

9. Cookies and analytics

The app stores authentication tokens in your browser local storage to keep you signed in.

With your consent, we use Google Firebase Analytics to collect usage data (page views, sign-in events, and similar interactions). Analytics may set cookies such as _ga and _ga_* on your device. You can decline analytics cookies via the banner shown on first visit; declining disables analytics collection.

For more information, see Google's Privacy Policy at https://policies.google.com/privacy.

10. Security

We use HTTPS, hashed passwords, and access controls. No method of transmission over the Internet is 100% secure.

11. Children

The service is not directed at children under 16. We do not knowingly collect their data.

12. Changes

We may update this policy. The effective date at the top will change. Material updates will be posted on the website.