Privacy Policy

1. About this notice

This notice explains how CashVol handles account and business information. Effective date: 5 November 2026. The service-operator contact is Moiz Asif, LDA Dream Gardens; email info@cachebrains.com for privacy questions.

Business owners decide which customer, supplier and transaction details to enter and should explain that use to those people. CashVol operates the application and its platform administration. Each party must comply with the legal responsibilities that apply to its use of personal information.

2. Account and security information

The application stores owner name and email, email verification state, password hashes, account links, sessions and verification records. It processes security and authentication activity and audit records. Passwords must not be sent to support; the authentication system hashes them rather than storing a readable password.

Administrators additionally use authenticator MFA credentials and time-limited authorized sessions. Business registration links an owner account to that business.

3. Business information

Records may include business details, item groups and custom product attributes, quantities and purchase batches, serial numbers or IMEIs, customer and supplier names and contacts, purchases, sales, allocations, returns, exchanges, invoices and payment entries.

Enabled finance modules store expenses, repairs attributed to products or units, cash/bank account names and entered details, opening balances, transfers and daily closing records. Optional warranty information is processed only where actually supported or entered in business records. Recording a bank account or payment does not authorize CashVol to debit it.

4. Files and communications

Supported uploads include subscription payment evidence and optional retail payment images. Bulk Excel/CSV purchase import is not supported in the launch application. Previously saved purchase attributes and stock identifiers remain part of historical business records. Payment images use private server storage with metadata linked to the relevant payment.

When an owner uses the optional Chrome extension, the recipient number and customer-safe invoice PDF are prepared in that owner’s WhatsApp Web account. WhatsApp may upload the PDF while showing the attachment preview. The owner checks the recipient, invoice and caption and presses Send. A manual download link is offered if preparation cannot be confirmed. Owners must have authority to contact the recipient. CashVol does not use a WhatsApp Cloud API sender or verify owner phone numbers.

5. Purposes

Information is used to verify accounts, maintain sessions, isolate business workspaces, record inventory and transactions, calculate recorded financial results, create invoices, review subscriptions, deliver requested account or billing messages, protect accounts, investigate errors and maintain audit history.

Support information you choose to send is used to handle that request. The support page does not automatically send private business details or diagnostics.

6. Providers and disclosure

Configured SMTP services process destination emails and message content, including verification and reset links. WhatsApp processes the PDF and recipient when the owner uses the browser extension to prepare and send a bill. Subscription transfers are performed through the bank or wallet instructions shown to the owner; evidence is reviewed by authorized platform administrators rather than an automatic payment gateway.

CashVol uses Netlify for application hosting, Supabase for PostgreSQL and private file storage, Upstash for shared rate limiting, and Google SMTP for account and billing emails. Providers process relevant information to operate those services and may process it outside your country. We do not claim that all data stays in Pakistan.

CashVol does not sell user data or operate an advertising-data marketplace. Disclosure needed for a lawful request, security incident or service-provider operation must be reviewed under applicable law; these are not permission for unrestricted sharing.

7. Access and safeguards

Application APIs use authenticated owner and business context, with additional administrator and MFA checks for protected platform functions. Private attachment routes check authorization. Security measures include password hashing, session protections, request-origin checks, validation, rate limits and audit records.

Platform administrators have privileged access for billing and business administration; ordinary businesses must not retrieve another owner’s records. No system is absolutely secure. Secure hosting, HTTPS, secrets management, patching and operator access practices still matter, especially outside local testing.

8. Cookies and browser storage

Authentication uses session-related cookies. Production settings enable secure cookies; local development may use HTTP on localhost. The browser also stores functional preferences, such as dashboard amount visibility, the last selected expense account and supplier import column mappings.

CashVol does not currently use advertising trackers or third-party analytics in the application. Separately installed browser extensions and external websites have their own data practices. Marketing consent is not bundled into the registration acknowledgment.

9. Retention and closure

Account, business, transaction, subscription and audit information is retained by the current application; there is no automatic account-wide erasure on trial expiry or a closure request. Information is retained while needed to operate your account, maintain financial and audit history, resolve disputes, protect security and meet applicable legal obligations. Contact support to discuss a specific record or closure request. This notice does not promise immediate removal from operational backups.

Subscription evidence has a configured retention workflow: attached evidence for eligible resolved payments can be purged after its recorded retention date, generally set 365 days from attachment or approval, by the retention job. Older staged files can be cleaned by that job. Metadata and audit history remain. Actual removal depends on that job running and the record meeting its conditions; this is not a 365-day promise for all application data.

Retail payment images do not currently have the same automatic purge schedule. Before closing an account or deleting information, the operator must assess identity, financial history, disputes, applicable retention and available export/correction tools.

10. Requests, corrections and changes

Contact support to request access to or correction of your information, discuss closure or report a security concern. Identify the business and relevant record, but do not send passwords, MFA secrets, session tokens or full banking credentials. We may need reasonable identity and authority checks before discussing private records.

Customer or supplier contacts may ask the shop that entered their details for help, or contact CashVol support about a platform concern. Requests will be assessed against applicable law and actual application capabilities; no unverified statutory deadline or unconditional deletion right is promised.

Material changes to this notice will carry a new version and effective date and will be communicated where required. Contact info@cachebrains.com with questions or concerns about personal information, security or international processing.