Privacy Policy

CashFlow OS is operated by CyberGen Holdings, LLC (DBA CyberGen AI), a company organized under the laws of the State of Florida, United States (“CyberGen,” “we,” “us,” or “our”). This Privacy Policy applies to information we process in connection with the Service. If you do not agree with these practices, you should discontinue use of the Service.

2.1 Personal Information You Provide

Personal information you provide voluntarily may include:

• Account creation and sign-in details (name, email address, password — stored only as a salted hash);
• Organization details, role, and account preferences such as timezone and language;
• Communications you send us, including support requests;
• Financial figures you enter directly, such as projects, budgets, forecasts, and notes.

2.2 QuickBooks Online Data (Read-Only)

When you connect a QuickBooks Online company, you authorize us — through Intuit’s OAuth 2.0 authorization flow — to read the financial records needed to produce your cash-flow reports. This may include transactions, bills, invoices, sales receipts, deposits and their line items, chart-of-accounts entries, classes, and customer/job references. We request read-only access. We do not create, modify, or delete any data inside your QuickBooks company, and we use this data solely to provide the Service to you.

2.3 Automatically Collected Information

When you use the Service, we automatically collect:

• Device information: IP address, browser type and version, operating system, device type;
• Usage information: pages visited, time spent, referring URLs, and interaction patterns;
• Location information: general geographic location based on IP address;
• Cookies and similar technologies (see Section 9).

2.4 Information from Third Parties

We may receive information from Intuit (as the source of the QuickBooks data you authorize) and from service providers that help us operate the Service, and combine it with other information described above.

We use the information we collect to:

• Service delivery: provide, maintain, and improve the Service, and compute deterministic cash-flow statements, project profitability, and forecasts from your QuickBooks and CashFlow OS data;
• AI narration: generate optional plain-language summaries that describe figures the Service has already calculated — the narration explains numbers, it does not alter, recompute, or make decisions about your finances;
• Communication: respond to inquiries, provide support, and send transactional messages;
• Security: detect, prevent, and address fraud, abuse, and security issues;
• Legal compliance: comply with legal obligations and protect legal rights.

We do not sell your personal information or your financial data. We do not use your QuickBooks data for advertising, we do not share it with third parties for their own marketing, and where AI narration uses a third-party provider, that data is not used to train the provider’s models.

3.1 Legal Basis for Processing (GDPR)

For users in the European Economic Area, we process personal data based on: (a) your consent, (b) performance of a contract, (c) compliance with a legal obligation, or (d) our legitimate interests.

If you are in the European Economic Area, you have the following rights:

• Right of access: request copies of your personal data;
• Right to rectification: request correction of inaccurate or incomplete data;
• Right to erasure: request deletion of your personal data;
• Right to restrict processing: request that we restrict processing;
• Right to data portability: request transfer of your data to another organization;
• Right to object: object to processing for certain purposes;
• Right to withdraw consent where processing is based on consent;
• Right to lodge a complaint with a supervisory authority.

Contact privacy@cybergen.ai to exercise these rights. We respond within 30 days.

California residents have the following rights under the CCPA and CPRA:

• Right to know what personal information we collect, use, and disclose;
• Right to delete personal information we hold;
• Right to correct inaccurate personal information;
• Right to opt out of the sale or sharing of personal information;
• Right to limit the use of sensitive personal information;
• Right to non-discrimination for exercising your rights.

We do not sell personal information. To exercise your CCPA rights, contact privacy@cybergen.ai or call 1-800-561-2713.

We maintain appropriate technical and organizational security measures, including:

• Encryption of data in transit (TLS) and at rest;
• Access controls and authentication mechanisms, including row-level controls that scope data to your organization and role;
• Regular security assessments;
• Least-privilege access for personnel;
• Incident response and breach notification procedures.

Your data is stored in the United States on managed PostgreSQL infrastructure (Supabase). No method of transmission or storage is completely secure; while we prioritize protecting your information, absolute security cannot be guaranteed.

We retain personal information for as long as necessary to:

• Fulfill the purposes for which it was collected and provide the Service;
• Comply with legal, accounting, or reporting requirements;
• Resolve disputes and enforce our agreements.

You may disconnect QuickBooks Online at any time from within the application, which revokes our access token so we can no longer read new data from your QuickBooks company. You may request deletion of your account and associated data by contacting us; we will delete it except where we are required to retain certain records by law.

We may share information only in these limited circumstances:

• Service providers: vendors who help us operate the Service under contract and confidentiality obligations, including our hosting and database provider (Supabase), Intuit (as the source of the QuickBooks data you authorize), and our AI narration provider;
• Within your organization: users see data according to their assigned role (for example, investors see only the projects assigned to them);
• Legal requirements: when required by law, court order, or government request;
• Business transfers: in connection with a merger, acquisition, or asset sale;
• Protection of rights: to protect the rights, property, or safety of CyberGen, our users, or others.

All third parties must keep information confidential and use it only for the specified purposes.

We use only cookies and similar technologies that are essential to keep you signed in and to operate the Service securely. We do not use advertising or cross-site tracking cookies. You can manage cookies through your browser settings; disabling essential cookies may affect Service functionality.

9.1 Do Not Track Signals

Because there is no uniform “Do Not Track” standard, the Service does not currently respond to DNT signals.

The Service is a business tool and is not intended for children under 13 (or 16 in the EEA). We do not knowingly collect personal information from children under these ages. If you believe a child has provided us information, contact privacy@cybergen.ai and we will delete it promptly.

Your information may be transferred to and processed in countries other than your own, including the United States, which may have different data protection laws. Where required, we use appropriate safeguards such as Standard Contractual Clauses for such transfers.

We may update this Privacy Policy to reflect changes in our practices, technologies, or legal requirements. When we make material changes, we will update the “Last updated” date above and, where appropriate, provide additional notice. Your continued use of the Service after a change takes effect constitutes acceptance.

For privacy questions or to exercise your rights, contact the CyberGen privacy team:

• CyberGen Holdings, LLC (DBA CyberGen AI)
• 2875 S Ocean Blvd, Ste. 200-57, Palm Beach, FL 33480, USA
• Privacy inquiries: privacy@cybergen.ai
• Legal department: legal@cybergen.ai
• Phone: 1-800-561-2713