Privacy Policy

The privacy of your data — and it is your data, not ours — is a big deal to us. Especially when that data includes your bank accounts, transactions, and investments. In this policy, we lay out: what data we collect and why; how your data is handled; and your rights with respect to your data. We promise we never sell your data: never have, never will.

This policy applies to cashegg, a product built and maintained by Float Technologies (“Company”, “we”, or “us”), delivered via web browser and mobile application.

What We Collect and Why

Our guiding principle is to collect only what we need. Here's what that means in practice:

Identity and access

When you sign up for cashegg, we ask for your name, email address, and preferred currency. That's so we can personalize your experience, send you essential product updates, and display your finances in the right currency. Your password is securely hashed — we never store it in plain text and we cannot see it.

Billing information

If you subscribe to cashegg, your credit card and billing details are submitted directly to our payment processor. We do not store your full card number on our servers. We retain a record of the transaction (amount, date, last four digits) so you can view your billing history and so we can handle refunds if needed.

Financial data

This is the core of what cashegg does: with your explicit consent, we retrieve your bank account information and transaction history through GoCardless. This may include account balances, transaction amounts, merchant names, dates, and references. If you connect a brokerage account, we also retrieve investment portfolio data through SaxoBank.

We never see or store your bank login credentials. When you connect a bank, you authenticate directly with your bank (typically through your bank's own app or website). GoCardless acts as a regulated intermediary — they are supervised by the French ACPR (Autorité de Contrôle Prudentiel et de Résolution, registration No. 834422180). We only receive the account and transaction data, never the keys to get in.

Geolocation data

We log the full IP address used to sign up for and log in to cashegg. We use this to prevent fraudulent access and to detect unusual login activity. We keep this data for as long as your account is active.

Website interactions

We collect information about your browser, device, and how you navigate the app (which features you use, when you access the Service). We use this to improve cashegg, diagnose technical issues, and understand which features matter most. We do not use third-party analytics trackers or advertising pixels.

Cookies

We use only first-party, essential cookies — the kind that keep you logged in and protect against cross-site request forgery (CSRF). That's it. We do not use advertising cookies, third-party tracking cookies, or any form of ad-tech. We don't run retargeting campaigns and we don't let ad platforms set cookies on our site.

Voluntary correspondence

When you email us with a question or contact support, we keep that correspondence, including your email address, so that we have a history of past interactions to reference if you reach out again. We also store information you may volunteer, for example, written responses to surveys.

How Your Financial Data Flows

Since cashegg handles sensitive financial data, we want to be especially transparent about how it moves through our systems:

1. You authorize access through your bank's own secure authentication flow (typically your bank's app or website). Your bank credentials are entered directly with your bank — cashegg never sees or stores them.
2. GoCardless retrieves your data. Acting as a regulated Account Information Service Provider, GoCardless fetches your account information and transaction history on our behalf.
3. cashegg stores the data in our encrypted database so we can show you your accounts, transactions, and reports.
4. Transactions may be categorized by AI. We may send transaction descriptions and amounts to Google Gemini for automatic categorization (see below).

Third-Party Services We Use

cashegg relies on a small number of third-party services to operate. Some of these are data sources (we receive data from them), while others are processors (we send data to them). We do not sell your data to any of them.

Data processors — we send limited data to these services

• Stripe — Payment processing. Stripe handles your subscription billing and credit card transactions. Your payment details are submitted directly to Stripe and are not stored on our servers.
• Google Gemini — AI-powered transaction categorization. Transaction descriptions and amounts may be sent to Google Gemini so your transactions can be automatically sorted into categories. We strip out personally identifiable information before sending these requests.
• RevenueCat — Subscription and in-app purchase management. RevenueCat manages your subscription status so you get access to the features you've paid for across devices.
• Amazon Web Services (SES) — Email delivery. We use AWS SES for transactional emails — password resets, account notifications, and billing confirmations. We don't send marketing email.

AI-Powered Features

cashegg uses Google Gemini to power two AI features: transaction categorization and an AI chat assistant.

For categorization, when a new transaction comes in, we may send the merchant name, transaction description, and amount to Gemini to determine the best category.

For the AI chat assistant, when you ask a question, we may send relevant account data (such as transaction history, balances, and spending summaries) to Gemini to generate a response. The chat assistant is for informational purposes only — it does not provide financial advice.

We take care to minimize what we send in both cases: your name, account number, and other personally identifiable information are not included in these requests. Google processes this data solely for the purpose of returning a result — your data is not retained by Google for model training or any other purpose.

When We Access or Disclose Your Information

Our default practice is to not access your information. The rare exceptions are:

To provide the Service

We access your data as needed to deliver the features you use — displaying your transactions, syncing your accounts, generating reports, and categorizing your spending. This happens automatically and is the core function of cashegg.

To help you with support requests

If you contact us for help, we may need to access your account data to troubleshoot the issue. We ask for your consent before looking at your data, and all support access is logged for auditing purposes. No cashegg human looks at your financial data except for these limited purposes with your express permission.

To safeguard the Service

If we become aware of abusive activity, we may investigate. We try to balance privacy and safety, and we only access accounts as a last resort after other options have been exhausted.

When required under applicable law

Float Technologies is subject to EU law. If we receive a valid legal order (court order, warrant, or subpoena) requiring us to share data, we comply. It is our policy to notify affected users before we disclose data unless we are legally prohibited from doing so.

If the company is acquired

If Float Technologies is acquired by or merged with another company — we don't plan on that, but if it happens — we will notify you well before any of your personal information is transferred and becomes subject to a different privacy policy.

We never sell your personal data. We do not share your data with advertisers or data brokers. We do not mine your financial data for any purpose other than providing and improving cashegg for you.

Your Rights With Respect to Your Information

At cashegg, we apply the same data rights to all customers, regardless of where you live. These rights include:

• Right to know. You have the right to know what personal information is collected, used, shared, or sold. We lay all of that out in this privacy policy.
• Right of access. You can request a copy of all personal data we hold about you. Much of this is available directly in your account.
• Right to correction. You can update your personal information at any time through your account settings, or ask us to correct inaccurate data.
• Right to erasure / “right to be forgotten.” You can request deletion of your personal data. When you delete your account, we remove all your data from active systems within 30 days (see “Content Deletion” below).
• Right to portability. You have the right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to restrict processing. You can request that we limit how we process your data. We have never and will never sell your personal data.
• Right to object. You can object to our processing of your data for specific purposes.
• Right to withdraw consent. You can withdraw consent for data processing at any time. Withdrawing consent for bank access will disconnect your linked bank accounts.
• Right against automated decision-making. cashegg uses AI to categorize transactions, but no automated process makes decisions that have legal or similarly significant effects on you. You can always manually override any AI categorization.
• Right to complain. You have the right to file a complaint with your local data protection supervisory authority.
• Right to non-discrimination. We will not charge you a different amount or give you a lower level of service because you exercised your data rights.

Many of these rights can be exercised directly in your account settings. If you need help or want to exercise a right we haven't covered, contact us at [email protected]. We will respond within 30 days. If we deny a request, you are entitled to appeal, and we will explain how.

How We Secure Your Data

All data is encrypted in transit between your device and our servers using SSL/TLS. Database backups are encrypted at rest. Passwords are hashed using industry-standard algorithms — we never store them in plain text.

Bank credentials are never stored by cashegg at all — all bank authentication is handled directly by GoCardless.

Our infrastructure is built with redundancy in mind — data is written to multiple locations and backed up regularly. We apply the latest security patches to our systems and monitor for suspicious activity. Credit card transactions are processed on PCI-compliant networks.

Access to production systems and customer data is restricted to personnel who need it and is logged for auditing. Unauthorized access by any employee is grounds for immediate termination. If you discover a security vulnerability, please report it to [email protected] and we will address it promptly.

Content Deletion

If you delete individual data within your account (such as removing a bank connection or deleting a transaction), that data becomes inaccessible in the app immediately. It is permanently purged from our active servers within 30 days. Encrypted backups may retain a copy for up to 60 additional days before being rotated out.

If you cancel your account, all your content becomes inaccessible immediately. We permanently delete it from our active systems within 30 days and from encrypted backups within 60 days — a maximum of 90 days total. We also revoke all third-party access tokens (GoCardless, SaxoBank) upon account deletion.

Data Retention

We retain your personal information only for as long as it is needed for the purposes described in this policy, or as required by law. For most data, that means as long as your account is active. Transaction data from GoCardless typically covers the last 90 days of history per connection, but we retain all transactions previously synced to your account so you can build a complete financial picture over time.

When we no longer need data and there is no legal requirement to keep it, we delete it or aggregate it into anonymized form. Aggregated data that can no longer identify you may be retained to help us improve cashegg.

Location of Data and International Transfers

cashegg is an EU-focused service. Your data is primarily stored and processed within the European Union. We take EU data protection standards seriously, both for the data we store and the data processed by our third-party providers.

In limited cases, data may be transferred outside the EU — for example, to Google for AI categorization or to AWS for email delivery. Where this happens, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission, to guarantee your data receives equivalent protection.

Children's Privacy

cashegg is not intended for use by anyone under the age of 16. We do not knowingly collect personal data from children. If we learn that a child under 16 has provided us with personal information, we will delete that data promptly.

Changes and Questions

We may update this policy as needed to comply with relevant regulations and reflect any new practices. Whenever we make a significant change, we will refresh the date at the top of this page and notify you through the Service or by email.

By accepting this policy upon signup, you acknowledge that it is your responsibility to periodically review this page for updates. We recommend checking back whenever you see the “last updated” date has changed.

Have any questions, comments, or concerns about this privacy policy, your data, or your rights? Please get in touch at [email protected] and we'll be happy to help.