Privacy Policy

The data controller responsible for data processing on this website is:

We take the protection of your personal data seriously. We process personal data collected during your visit to our website in compliance with the General Data Protection Regulation (GDPR) and applicable national data protection laws.

We process personal data based on the following legal grounds:

This website uses SSL/TLS encryption for security purposes and to protect the transmission of confidential content.

This website is hosted by Vercel Inc.; the Cashflow Engine App is hosted by Railway Corp. with Supabase Inc. as database provider. Data processing takes place in the EU region (data on EU servers). All three are US companies certified under the EU-US Data Privacy Framework for any residual transfers.

The Cashflow Engine Workbench(wb.cashflowengine.io) and its API (api.cashflowengine.io) use the same infrastructure (Vercel frontend, Railway API, Supabase) plus the additional services listed in section 9 (“Workbench”).

Our website uses cookies. Analytics cookies (specifically Google Analytics 4) are only set after your explicit consent via our cookie consent banner (opt-in). Without your consent, no tracking takes place.

You can revoke your consent at any time by clearing your browser cookies. The consent banner will reappear on your next visit.

We use Google Analytics 4 by Google Ireland Limited. Google Analytics is only activated after your consent via our cookie banner (Consent Mode v2). IP anonymization is enabled by default.

Legal basis: Art. 6(1)(a) GDPR (consent).

If you subscribe to our newsletter, your email address is transmitted to Beehiiv Inc. (USA), our newsletter service provider. We use a double opt-in process: after signing up, you will receive a confirmation email. Your address is only added to our mailing list after confirmation.

You can unsubscribe at any time via the unsubscribe link in each email.

The Cashflow Engine Workbench is our paid analysis and portfolio tool. In addition to the hosting providers above, we use the following processors to operate it. For users in the EEA, non-essential services (analytics, marketing, session replay) are activated only after consent.

Subscription & payments (Stripe)

We sell the Workbench subscription directly and use Stripe, LLC (USA) as our payment processor. Stripe processes name, email, and payment/invoice data on our behalf to take payment and to prevent payment fraud. The invoice is issued by Cashflow Engine. Stripe, LLC is self-certified under the EU-US Data Privacy Framework (see section 10). Legal basis: Art. 6(1)(b) GDPR (contract).

Product & funnel analytics (PostHog)

We use PostHog (EU Cloud, Frankfurt) to analyse product usage via pseudonymous usage events. For EEA users, PostHog is initialised only after consent. Legal basis: Art. 6(1)(a) GDPR (consent).

Error & performance monitoring (Sentry)

We capture technical error and performance data with Sentry (EU region). Personal identifiers (tokens, emails, trade and portfolio details) are stripped before transmission. Any session replay is enabled only after consent. Legal basis: Art. 6(1)(f) GDPR (legitimate interest) or (a) for session replay.

Conversion tracking (Google Ads, Meta)

For ad campaigns we measure conversions server-side via Google Ads and the Meta Conversions API. Only pseudonymous event data required for attribution is transmitted; for EEA users only with marketing consent (Google Consent Mode). Legal basis: Art. 6(1)(a) GDPR (consent).

Broker account connection (SnapTrade)

If — and only if — you choose to connect your own brokerage account, we use SnapTrade (Passiv Financial Inc., Canada) as an account-aggregation processor. You authenticate directly with your broker through SnapTrade; we never receive, see, or store your brokerage login credentials. SnapTrade returns your account data (accounts, balances, positions including option positions, and orders), which we display to you in the Workbench.

We store only a per-user SnapTrade identifier and an access secret, which is encrypted at rest and never transmitted to your browser, plus connection metadata (broker name, connection status, last sync time). We never request or hold any permission to move money or assets. You can disconnect at any time, which revokes our access. Canada is covered by an EU adequacy decision, so no additional transfer safeguards are required. Legal basis: Art. 6(1)(b) GDPR (performance of a contract you requested).

Affiliate links (Option Omega, OptionsApp)

The Workbench links to Option Omega (validation) and OptionsApp (execution) and may earn a commission. Data is transferred to these providers only once you actively open a link or trigger an export; their own privacy notices then apply.

Some of the providers we use are established outside the EU. The legal framework applicable to each provider — for example the EU-US Data Privacy Framework (DPF)— is stated in the “Framework” column below. Our payment processor Stripe, LLC(USA) is self-certified under the DPF and receives personal data originating from the EEA, the UK, or Switzerland on that basis; where the certification does not apply, Stripe’s EU Standard Contractual Clauses (or the UK IDTA) apply instead.

Under the GDPR, you have the following rights:

To exercise your rights, contact us at: terminal@cashflowengine.io

You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data violates the GDPR. The competent authority depends on your place of residence.

We delete personal data as soon as the purpose for its storage no longer applies, unless statutory retention periods require otherwise. As a guide:

Our services are intended exclusively for adults (18 years and older). We do not knowingly collect personal data from minors. If we become aware that data from a minor has been provided to us without parental consent, we will delete it without undue delay.

We reserve the right to update this privacy policy to reflect changes in our services or legal requirements. The current version always applies.