California Privacy Rights

This notice applies to California residents whose personal information Kashboard collects, uses, or discloses in operating the Service. Business-to-business contact data and employment-related data are handled under the CPRA's B2B and HR provisions.

In the past 12 months, we may have collected the following CCPA categories:

• Identifiers — name, email address, account ID, IP address, device identifiers.
• Customer records (Cal. Civ. Code § 1798.80(e)) — billing name, billing address, payment token (payment card data itself is handled by Stripe, our merchant of record).
• Commercial information — subscription tier, purchase history, coupon redemptions.
• Internet or other electronic network activity — pages visited in the app, feature interactions, error diagnostics.
• Geolocation data — approximate location derived from IP.
• Professional or employment-related information — business name, role, and any professional details you add to your workspace.
• Inferences — derived tags on transactions (e.g. category, merchant) produced by our AI features.
• User-uploaded content — receipts, invoices, bills, statements, and notes you upload or type into the app.

We do not knowingly collect biometric information, precise geolocation, or genetic data.

• Directly from you when you sign up, upload documents, or contact support.
• Automatically from your device and browser when you use the Service.
• From service providers acting on our behalf (e.g. Stripe for billing, Supabase for hosted database and auth, Cloudflare for delivery, Google Gemini for AI extraction).

We use personal information to:

• Provide, maintain, and secure the Service.
• Process payments and manage subscriptions.
• Detect and prevent fraud, abuse, and security incidents.
• Respond to support requests.
• Send transactional emails (receipts, security alerts, account notices).
• Improve the product and diagnose errors.
• Comply with legal obligations.

In the past 12 months, we have disclosed the categories above to the following types of recipients for the business purposes listed:

• Payment processor (Stripe, Inc.) — identifiers, commercial information, customer records.
• Hosting and database (Supabase / AWS) — all categories above, stored on our behalf.
• Content delivery and edge (Cloudflare) — identifiers and network activity.
• AI processing (Google Gemini via Lovable AI Gateway) — user-uploaded content and derived inferences, on a no-training basis.
• Transactional email (Resend) — identifiers (name, email).
• Legal and safety recipients — where required by law or to protect rights, property, and safety.

Each of these recipients is bound by a written contract restricting their use of the information to the services they provide to Kashboard.

Kashboard does not sell your personal information for money, and does not share it for cross-context behavioral advertising, as those terms are defined under the CCPA/CPRA. We have not done so in the preceding 12 months, and we do not knowingly do so with information of consumers under 16.

Because we do not sell or share your personal information, there is nothing to opt out of in that sense. If this ever changes, we will update this notice, add a conspicuous "Do Not Sell or Share My Personal Information" link, and honor Global Privacy Control (GPC) signals as a valid opt-out request from your browser.

You can still control non-essential cookies and local storage at any time through our cookie preference center:

We use sensitive personal information (such as account login credentials and any financial information you upload) only for the purposes permitted by CPRA § 1798.121(a) — namely, to provide the Service you requested, to secure your account, and to prevent fraud. We do not use it to infer characteristics about you. As a result, no separate "Limit the Use of My Sensitive Personal Information" right is triggered.

Subject to verification and legal exceptions, you have the right to:

• Know what personal information we have collected about you, the categories of sources, the purposes for collection, and the categories of third parties to whom we disclose it.
• Access the specific pieces of personal information we hold about you (portable copy).
• Delete personal information we have collected from you.
• Correct inaccurate personal information.
• Opt out of any sale or sharing (see § 6 — currently not applicable).
• Limit the use of sensitive personal information (see § 7 — currently not applicable).
• Non-discrimination for exercising any of these rights (see § 12).

You can submit a verifiable consumer request in either of two ways:

1. Email contact@kashboard.app with the subject line "California Privacy Request". Tell us which right you are exercising (know, access, delete, correct) and the email address associated with your Kashboard account.
2. In-app — signed-in users can export or delete their account data from Settings → Privacy & data.

We will confirm receipt within 10 business days and respond substantively within 45 calendar days. If we need more time, we may extend once by an additional 45 days and tell you why.

To protect your data, we verify that the requester is the account holder before we act on Know, Access, Delete, or Correct requests. Verification normally consists of:

• Confirming the request is sent from the email on file, and
• Confirming ownership of the account via a signed-in session or a one-time code.

For sensitive requests (deletion, export of full account data) we may require an additional signed-in confirmation. We do not use verification information for any other purpose and delete it once the request is closed.

You may designate an authorized agent to submit a request on your behalf. We will require: (a) written permission signed by you authorizing the agent to act, and (b) verification of your own identity as described in § 10. Agents registered with the California Secretary of State should include proof of registration.

We will not deny you the Service, charge you a different price, or give you a lower quality of Service because you exercised a CCPA/CPRA right. Kashboard does not offer financial incentives in exchange for the collection, sale, or retention of personal information.

We retain personal information for as long as your Kashboard account is active and for a limited period afterward to comply with legal, tax, and accounting obligations, enforce our agreements, and resolve disputes. Specific retention periods for each category are described in our Privacy Policy. When retention ends we delete or de-identify the information.

Kashboard is not directed to children under 16. We do not knowingly collect personal information from minors under 16 and we do not sell or share personal information of consumers we know to be under 16.

Questions about this notice, or about how we handle your California privacy rights, can be sent to:

• Email: contact@kashboard.app
• Entity: Omnaxis LLC (operator of Kashboard)