Privacy Policy

Overview

Cashflow Verdict processes bank statements and related business data to generate underwriting reports. This policy describes what we collect, how we use it, and your choices. We only receive what you choose to upload.

Information we collect

• Account: email address (password sign-in), usage and subscription status.
• Documents you upload: bank statements, application PDFs, and metadata you submit for analysis. The service only receives documents you choose to upload. We do not pull data from third parties.
• Personal information within documents: uploaded documents may contain nonpublic personal information about a merchant or applicant, such as name, date of birth, government identifiers (e.g. SSN), and bank account numbers. We receive this only if you include it in what you upload.
• Derived data: parsed transactions, generated reports, grades, and analysis history tied to your account.
• Technical: logs, IP address, browser type, and error diagnostics for security and reliability.

Your role and ours

You decide what to submit. As the customer (broker, ISO, funder, or lender), you act as the controller of the personal data contained in documents you upload, and you are responsible for having the authorization and a lawful basis to submit it. Cashflow Verdict acts as a processor. We analyze the documents you provide, on your instruction, and do not collect this data directly from the individuals it describes.

How we use information

• Run analysis and deliver reports you request.
• Authenticate users, enforce plan limits, and process payments.
• Improve reliability, prevent abuse, and support customers.
• Send transactional email (sign-in links, optional report delivery if enabled).

We do not sell your personal information or uploaded statements to third parties for marketing.

Service providers

We use vetted infrastructure providers to operate the Service, and share data with them only as needed to run it:

• Cloud database & authentication — sign-in, database, and application storage.
• Payment processor — subscription billing and the customer portal.
• AI analysis provider — document classification and analysis. Documents sent for analysis are handled under that provider's API terms; where those terms apply, submissions are not used to train its models.
• Transactional email provider (optional) — email delivery when report email is enabled.

Retention

Analysis history is stored while your account is active so you can access past reports. You may delete individual analyses or request deletion of your account; deletion removes the associated uploaded documents. Backups may persist for a limited period for disaster recovery.

Security

We use encryption in transit (TLS), encryption at rest, access controls, and industry-standard hosting. No method of transmission or storage is 100% secure; you are responsible for safeguarding credentials and uploaded documents on your side.

SOC 2: Cashflow Verdict itself is not SOC 2 certified today. We rely on SOC 2–certified infrastructure providers for core systems. Enterprise SOC 2 for our product may be pursued as we scale.

Your rights

Depending on your location, you may have rights to access, correct, delete, or export personal data. Contact us to exercise these rights. California residents may have additional rights under the CCPA.

Contact

Privacy requests: privacy@cashflowverdict.com

This document is a starter template and should be reviewed by qualified counsel before production use.