Privacy Policy

1. Introduction & Our Legal Role

Cashup Express provides a platform for retail businesses to manage their daily cash reconciliations. Because of how our software is used, we operate in two distinct legal capacities under the Privacy Act:

• As an Agency (Data Controller): We control the account and billing information of the person or company that signs up for our service (the "Account Holder").
• As an Agent (Data Processor): We merely process operational data (such as staff names and shift details) on behalf of the Account Holder. The Account Holder owns and controls this data.

If you have any questions about this policy, you can contact us at admin@cashupexpress.com.

2. Information We Collect

We collect information in three ways:

• Account Data (Collected directly from you): When you register, we collect your email address and, once active, your billing and payment details.
• Operational & Staff Data (Provided by you): In the course of using the app, you will enter cash-up figures, shift data, and staff names.
• Technical Data (Collected automatically): When you use our service, our servers automatically record your IP address, authentication tokens, and basic server logs to ensure the app functions securely.

3. How We Use This Information

We use the information we collect solely to provide and maintain our software. Specifically, we use it to:

• Authenticate your account and provide access to the platform.
• Process billing and subscription payments.
• Provide customer support and troubleshoot technical issues.

We do not sell your data. We do not use your operational data or the names of your staff for our own marketing, analytics, or any other commercial purpose.

4. Disclosure & Offshore Storage

To run Cashup Express, we rely on trusted third-party infrastructure providers (subprocessors). By using our service, you agree that your data will be processed by:

• Supabase: For database hosting and user authentication.
• Cloudflare: For secure web hosting and DNS routing.
• Stripe: For secure processing of your billing details.

Offshore Storage: Because we use these modern cloud services, your data is transmitted and stored outside of New Zealand, primarily in the Supabase database in Sydney, Australia. We ensure these providers are subject to privacy laws that provide comparable safeguards to the New Zealand Privacy Act 2020.

5. Security & Data Retention

We take the security of your financial and operational data seriously. We protect your data using encryption in transit (HTTPS) and strictly enforced row-level security (RLS) in our database, which ensures that your shop's data is completely isolated from other users.

We retain data according to the following schedule:

• Active Accounts: Data is kept for as long as your account is active.
• Account Deletion: If you delete your account (or request deletion), we will permanently hard-delete all your account and operational data immediately.
• Dormant Accounts: If an account remains entirely inactive for 12 consecutive months, we will automatically purge all associated data.

6. Cookies & Tracking

We only use essential functional cookies (such as authentication and session tokens) required to keep you logged in and ensure the app works. We do not use third-party tracking, advertising, or invasive analytics cookies.

7. Your Rights (Access & Correction)

Under the Privacy Act 2020, you have the right to ask for a copy of any personal information we hold about you, and to ask for it to be corrected if you think it is wrong.

• For Account Holders: You can request access or correction to your account data by emailing admin@cashupexpress.com.
• For Retail Staff: If your name or shift data has been entered into Cashup Express by your employer, you must contact your employer directly to access or correct that data. As an Agent, Cashup Express Ltd cannot fulfill these requests without the Account Holder's authorization.

If you are not satisfied with our response to a privacy concern, you have the right to make a complaint to the New Zealand Office of the Privacy Commissioner (www.privacy.org.nz).

8. Policy Updates

We may update this policy occasionally as our app evolves. If we make material changes, we will notify Account Holders via email before the changes take effect.