Cashfeed

Privacy Statement – Cashfeed

When offering, and through your use of, our services, products and information in any way offered under the various plans/formulas we offer now and in the future (collectively referred to as the "Products") through our website, application, APIs, browser extensions, software, tools, or any other technology, interface, or platform (collectively referred to as the "Platform"), Cashfeed (Cashfeed BV, hereinafter "we", "us", "our") will process certain personal data about you as a visitor or user of the Platform (hereinafter "you(r)") as a so-called "(data) controller".

We value your privacy and want to inform you in the most transparent way possible about our data processing activities and your rights in this respect. With this aim in mind, you will first find a brief summary of these data processing activities below, followed by more extensive information. In case of further questions, please do not hesitate to contact us.

To make this Privacy Statement as easy as possible to consult, it is structured as follows:

Part A: Summary of our Privacy Statement
Part B: Contact details and information regarding this Privacy Statement
Part C: What data do we process from our visitors and users, on what legal basis and for what purposes?
Part D: How do we share your data?
Part E: Protection, integrity and retention of your personal data
Part F: Your rights and obligations
Part G: Do you still have questions?

Part A: Summary of our privacy statement

Cashfeed processes different categories of personal data depending on whether you are a visitor or a user of our Platform. As a visitor, we collect your data when you provide it to us or for limited technical purposes in the interests of the Platform (e.g. analytics, cookies, support requests). As a user, we additionally collect information to fulfil our agreement with you and deliver the specific services and Products of the Platform.

We do not use your data for any purpose that you would not reasonably expect. We do not sell your data. We share data only with third-party providers who help us deliver the Products or if we are required to by law.

Privacy law grants you several rights, and we want to make it as easy as possible for you to exercise them.

Part B: Contact information

Cashfeed (Cashfeed BV)
Dok-Noord 4D bus 101, Belgium
VAT: BE1020118217
Email: legal@cashfeed.com

This Privacy Statement works alongside our Terms of Use, Cookie Statement, and, where relevant, our Data Processing Agreement. By using our Platform, you agree to the processing activities outlined herein.

Part C: What data do we process and why?

Data we collect from visitors

IP address, browser type, time of access, pages visited
Voluntary communications (e.g. contact forms or emails)
Newsletter subscription (with opt-out option)

Legal basis: Consent, legitimate interest

Data we collect from users

When you register or log in to the Platform:

First and last name
Email address
Google profile picture
Company name, description, address, website
Company IBAN/BIC (used in invoice generation)
Google refresh token (used to retrieve invoice-related emails)
Logs of user actions on the Platform

Legal basis: Contractual necessity, legitimate interest

Browser Extension

If you use the browser extension:

URLs, click and browsing behaviour
Technical data: browser version, OS, device info
Extension-specific data used to autofill or assist invoicing features

Part D: How do we share your data?

We share personal data only as necessary:

With service providers acting under data processing agreements:
- AWS (cloud hosting)
- Google OAuth (authentication)
- Posthog (analytics)
- Sentry (error logging)
- Inngest (workflow orchestration)
With competent authorities as legally required
In the context of mergers, acquisitions, or restructuring
With your explicit consent

Our user data is currently hosted and processed within the European Economic Area (EEA). Specifically, our primary infrastructure is hosted in Ireland (AWS), and Google services are used solely for internal authentication and corporate email. No user data is transferred outside the EEA. Should this change in the future, we will ensure appropriate legal safeguards (e.g., Standard Contractual Clauses) are in place before any such transfer occurs.

Use of Google User Data

Our application uses the Gmail API to access email metadata and content strictly for the purpose of retrieving

invoice-related emails. This enables users to manage their business invoices through our Platform. We do not

access, process, or store any other personal Gmail data unrelated to this purpose. Google user data is not used to

train or improve machine learning or AI models, and is not shared with third parties beyond our service providers

necessary to deliver this functionality.

Google User Data and AI/ML Use

We do not use any Google user data (including data obtained via the Gmail API) to develop, improve, or train

generalized artificial intelligence (AI) or machine learning (ML) models. Google user data is used solely to provide the

services you explicitly requested (e.g., invoice extraction and management). We do not sell or share this data with

any third party, except as necessary to operate our services securely and effectively, and always under strict data

processing agreements.

Part E: Protection, integrity & retention

We take appropriate technical and organisational measures to protect personal data:

Encrypted storage and transmission
Access limitation and internal controls
Logging, error detection, and proactive maintenance

Retention Periods

Account data: for the duration of the contract + legal limitation periods
Usage logs and analytics: for performance and improvement, reviewed periodically
Marketing data: deleted upon opt-out or withdrawal of consent

Part F: Your rights and obligations

Under the GDPR, you have the following rights:

Right of access (Art. 15 GDPR): You have the right to know whether we are processing your personal data and, if so, to access that data and further details about the processing.

Right to rectification (Art. 16 GDPR): You have the right to correct or complete any inaccurate or incomplete personal data.

Right to erasure (Art. 17 GDPR): In certain circumstances, you may request that we delete your data (e.g., if it’s no longer necessary or if you withdraw consent).

Right to restrict processing (Art. 18 GDPR): You may request a restriction of processing, for example if you contest the accuracy of the data.

Right to object (Art. 21 GDPR): You may object to our processing where we rely on legitimate interest. You may also object to direct marketing at any time.

Right to data portability (Art. 20 GDPR): You can request a copy of your personal data in a structured, machine-readable format and request transfer to another controller.

To exercise your rights, contact us at legal@cashfeed.com. We may request confirmation of identity for your protection. You may also update your details through your user account where applicable.

You have the right to withdraw consent at any time (for consent-based processing), without affecting the lawfulness of prior processing.

We handle all requests with care. If a request is unclear, unfounded or excessive, we may reject it or ask for clarification.

Part G: Questions or complaints

We welcome your questions or feedback. Contact:

Email: legal@cashfeed.com
Post: Dok-Noord 4D bus 101, Belgium

If we cannot resolve your concern, you have the right to file a complaint with the supervisory authority:

Gegevensbeschermingsautoriteit (GBA)
www.gegevensbeschermingsautoriteit.be
Drukpersstraat 35, 1000 Brussels, Belgium

Your Responsibilities

You confirm that the data you provide is accurate and complete
You confirm you are authorised to provide any third-party or company data
If you use integrations, your organisation must ensure lawful grounds for Cashfeed’s access to such data