Privacy Policy

1. Introduction & Our Legal Role

Cashup Express provides a platform for retail businesses to manage their daily cash reconciliations. Because of how our software is used, we operate in two distinct legal capacities under the Privacy Act:

• As an Agency (Data Controller): We control the account and billing information of the person or company that signs up for our service (the "Account Holder").
• As an Agent (Data Processor): We merely process operational data (such as staff names and shift details) on behalf of the Account Holder. The Account Holder owns and controls this data.

If you have any questions about this policy, you can contact us at admin@cashupexpress.com.

2. Information We Collect

We collect and process the following information:

• Account information: Your email address, shop name, authentication information, and account settings such as currency, default float and number of tills.
• Subscription information: Information required to manage your Cashup Express subscription, including Stripe customer and subscription identifiers and subscription status. Payment card details are processed by Stripe and are not stored by Cashup Express.
• Cash-up information: Information entered or generated when completing a cash-up, including till number, denomination counts, POS cash figures, calculated totals, float and bank amounts, variance, staff names, notes and timestamps.
• Skim information: Skim session details and individual cash removals, including denominations, totals, staff names, timestamps, void information and reconciliation status.
• Technical information: Information required to authenticate requests, operate the service and protect it against misuse. Our infrastructure providers may also process information such as IP addresses and server request logs.

3. How We Use This Information

We use this information to:

• provide and operate Cashup Express;
• authenticate users and maintain account access;
• store and display cash-up and skim records;
• calculate reconciliation results and variance information;
• generate reports requested by the Account Holder;
• manage subscriptions and billing;
• provide support, investigate faults and maintain the security of the service.

We do not sell operational data or staff information, and we do not use that information for advertising.

4. Disclosure & Offshore Storage

To run Cashup Express, we rely on trusted third-party infrastructure providers (subprocessors). By using our service, you agree that your data will be processed by:

• Supabase: For database hosting and user authentication.
• Cloudflare: For secure web hosting and DNS routing.
• Stripe: Used for subscription billing and payment processing. Payment card details entered during Checkout are processed by Stripe. Cashup Express receives the information required to identify and manage your subscription, but does not store your full payment card details.

Offshore Storage: Because we use these modern cloud services, your data is transmitted and stored outside of New Zealand, primarily in the Supabase database in Sydney, Australia. We ensure these providers are subject to privacy laws that provide comparable safeguards to the New Zealand Privacy Act 2020.

5. Security & Data Retention

We take the security of your financial and operational data seriously. We protect your data using encryption in transit (HTTPS) and strictly enforced row-level security (RLS) in our database, which ensures that your shop's data is completely isolated from other users.

We retain account and operational data while your Cashup Express account exists, unless records are deleted sooner through features provided in the service.

• Clearing saved history: Clearing saved history removes completed cash-up and skim history covered by that action. Open skim sessions are retained until they are reconciled or cancelled.
• Account deletion: If you delete your Cashup Express account, associated account and operational data held by Cashup Express are permanently deleted and any active subscription is cancelled. Stripe may separately retain billing and transaction information in accordance with its own retention requirements and policies.
• Dormant accounts: We may delete dormant accounts and associated data after a prolonged period of inactivity.

6. Browser Storage & Tracking

Cashup Express uses essential browser storage to maintain login state and support the normal operation of the service.

We do not use advertising trackers or use operational data to create advertising profiles.

7. Your Rights (Access & Correction)

Under the Privacy Act 2020, you have the right to ask for a copy of any personal information we hold about you, and to ask for it to be corrected if you think it is wrong.

• For Account Holders: You can request access or correction to your account data by emailing admin@cashupexpress.com.
• For Retail Staff: If your name or shift data has been entered into Cashup Express by your employer, you must contact your employer directly to access or correct that data. As an Agent, Cashup Express Ltd cannot fulfill these requests without the Account Holder's authorization.

If you are not satisfied with our response to a privacy concern, you have the right to make a complaint to the New Zealand Office of the Privacy Commissioner (www.privacy.org.nz).

8. Policy Updates

We may update this policy occasionally as our app evolves. If we make material changes, we will notify Account Holders via email before the changes take effect.