Skip to main content
Cashlucent

Privacy Policy

Effective September 29, 2026

This Privacy Policy explains what information Cashlucent collects, how we use it, who we share it with, and the choices you have. It applies to your use of the Cashlucent service.

1. Who we are

Cashlucent is operated by Phan Ventures LLC. For any privacy questions, contact us at support@cashlucent.com.

2. Information we collect

  • Account information: your name, email address, and a securely hashed password. If you enable two-factor authentication, we store the associated secret and recovery codes.
  • Business & financial data: the information you enter to keep your books: businesses, chart of accounts, transactions, invoices, expenses, customers, vendors, items, bank imports, tax settings, and reports.
  • Bank connection data: if you choose to connect a bank account, data we receive through our bank aggregation provider, Plaid: linked account details (institution, account name, type, and masked account number) and transaction data (dates, amounts, and descriptions). See “Bank connections (Plaid)” below.
  • Files you upload: receipts, bills, and other documents you attach or add to your document store, and receipts you forward by email.
  • Messages you send us: support requests, and feature requests or problem reports you send from inside the app.
  • Usage & technical data: basic log data such as IP address, browser type, and timestamps, generated automatically when you use the service, used to operate and secure it, and technical details of errors when something breaks.
  • Website visit data: on our public pages only (the homepage, pricing, help, and legal pages), Google Analytics records which pages are viewed, how you arrived, your approximate location, and your device and browser, and Microsoft Clarity records how those pages are used: clicks, scrolling, and a replay of the visit, with text you type masked. Neither is used inside the app, where your books live.

We do not intentionally collect sensitive personal information beyond what’s needed to run your books, and we ask that you not store payment card numbers or government ID numbers in free-text fields.

3. How we use your information

  • To provide, maintain, and improve the service and its features.
  • To authenticate you, keep your account secure, and enforce our Terms.
  • To send transactional email: account verification, password resets, invitations, and documents you choose to send.
  • To respond to support requests and communicate about the service.
  • To read the receipts you ask us to read, using the AI provider key you supply (see “Service providers” below).
  • To comply with legal obligations.

4. Cookies

Inside the app, we use a small number of strictly functional cookies, to keep you signed in and to remember which business is active. The app, where your books live, has no analytics or tracking cookies.

Our public pages use Google Analytics, which sets cookies to count visits and show us how people find Cashlucent. Google processes that data as described in How Google uses information from sites that use its services, and you can opt out with Google’s Analytics opt-out browser add-on. Our public pages also use Microsoft Clarity, which sets cookies to recognise a returning visit and records clicks, scrolling, and a replay of the visit, so we can see which parts of a page people use. Microsoft processes that data as described in the Microsoft Privacy Statement. We do not use advertising cookies. If you open the bank connection window, it is run by Plaid under Plaid’s own policy.

5. Service providers we share with

We don’t sell your data or share it for advertising. We rely on these providers to run the service, and share only what each needs to perform its function:

  • Vercel: application hosting and delivery, including request logs.
  • Neon: the managed PostgreSQL database where your data is stored.
  • Cloudflare: storage for the files you upload.
  • Resend: sending transactional email on our behalf, and receiving receipts you forward to your receipts address.
  • Stripe: subscription billing, and payments on your invoices if you turn on online payments. Card details go directly to Stripe; Cashlucent never sees or stores card numbers.
  • Plaid: connecting your bank accounts, if you choose to use bank connections (see the next section).
  • Google Analytics: visit statistics for our public pages, never inside the app.
  • Microsoft Clarity: heatmaps and session replay for our public pages, never inside the app.
  • Sentry: error monitoring, which receives technical details when something in the app breaks.
  • ClickUp: where we track the feature requests and problem reports you send from the app.
  • GitHub: our source code, and daily encrypted backups of the database, kept for 7 days.
  • pCloud: encrypted offsite copies of those backups, kept for 90 days.

Your own AI provider. Reading receipts automatically is off until you add an API key from Anthropic or OpenAI. When you do, the receipt images you ask Cashlucent to read are sent to that provider under your own account and its terms. We don’t send your data to any AI provider on our own account.

We may also disclose information if required by law, to protect our rights or the safety of others, or in connection with a business transfer (such as a merger or acquisition), in which case we’ll notify you.

6. Bank connections (Plaid)

Bank connections are optional. If you connect a bank account, we use Plaid to link it. You authenticate directly with your bank through Plaid. Cashlucent never sees or stores your bank username or password. Through Plaid we receive linked account details and transaction history, which we use only to import transactions into your books or budget. Connections are read-only: Cashlucent cannot move money or make changes at your bank.

The credentials Plaid issues us for your connection (access tokens) are stored encrypted with a key held outside our database. When you remove a bank connection, or delete the business or account it belongs to, we invalidate those credentials with Plaid and delete them from our systems. By using bank connections you also grant Plaid the right to process your data as described in the Plaid End User Privacy Policy.

A personal budget is visible only to the person who owns it, and to anyone the owner chooses to share it with from Settings, under Sharing. People it is shared with see and edit its transactions, including those imported from connected banks, but can't connect or remove bank accounts. Teammates on your business books never see a personal budget. The owner can stop sharing at any time.

7. Data security

We protect your data with industry-standard measures: encryption in transit (HTTPS), password hashing, session controls including “sign out everywhere,” two-factor authentication (required for anyone with access to a connected bank), and strict per-business data isolation so one business’s data is never exposed to another. No method of transmission or storage is perfectly secure, but we work to protect your information and to respond promptly to any incident.

8. Data retention

We keep your data for as long as your account is active. Deleting a transaction keeps an audited record of it in your books, so your ledgers stay consistent. Deleting a business, or your account, removes it from our live systems immediately, including its files and any bank connections. Copies in our backups expire on their own within 90 days. Stripe keeps the billing records it is required to keep for tax purposes.

9. Your rights & choices

  • Access and export your data at any time: every report and list exports to CSV or PDF, and an organization owner can download a complete copy of the organization (every business, every transaction, every file) from Settings.
  • Correct your account information in Settings.
  • Delete your account yourself from Settings, under Profile. If you’re the last person with access to your organization, the organization and everything in it are deleted too; if other people still have access, an owner removes them first.
  • Depending on where you live, you may have additional rights (such as under GDPR or CCPA) to access, correct, delete, or restrict processing of your personal data. Email us to exercise them.

10. Children

Cashlucent is intended for business use by adults. It is not directed to anyone under 18, and we do not knowingly collect personal information from children.

11. International users

Cashlucent is operated from the United States, and your data is processed and stored there. If you access the service from outside the U.S., you consent to that transfer and processing.

12. Changes to this policy

We may update this Privacy Policy from time to time. We’ll revise the effective date above and, for material changes, provide additional notice where appropriate.

13. Contact

Questions or requests about your privacy? Email support@cashlucent.com.