🔒 Privacy and Data Processing Policy

Plain-language summary

• We use your data to provide you with the service: your account, your profile, your chats, your purchases and sales, payments, and security.
• We do not sell your data. We do not use your private messages for advertising.
• Your phone number, email, date of birth, documents, and bank details are not visible to other users.
• You can view, correct, or delete your data and delete your account at any time.
• If you live in Colombia, by checking the privacy box you give your prior, express, and informed authorization for the processing described here (Ley 1581 de 2012, Colombian Personal Data Protection Law).

1. Data controller

• For people residing in Colombia: CASHWING COLOMBIA S.A.S., domiciled in Bogotá D.C., Colombia.
• For people in the United States and the rest of the world: CASHWING LLC, Florida, United States (Windermere, Orange County).
• Email for privacy matters, inquiries, and claims: services@cashwing.net.

Sellers, drivers, hosts, and creators who receive your data to fulfill a purchase or reservation are independent controllers of the use they make of it and may use it only for that transaction.

2. What data we collect

Sensitive data. We do not ask you for sensitive data (health, religion, sexual orientation, biometric data, etc.). If you choose to tell the Companion something like that or post it, you do so voluntarily, and it is used only to respond to you. You are not required to provide sensitive data.

Data of minors. Cashwing does not allow children under 13 to sign up. Teenagers aged 13 to 17 must have the authorization of their legal guardian, and their information is processed with respect for the best interests of the minor. If a teenager participates as a collaborator in their legal guardian's store, that guardian authorizes and supervises that use.

3. What we use your data for (purposes)

1. To create and manage your account and verify your age.
2. To display your profile and your content to the audience you choose.
3. To operate the Marketplace, stores, chats, reservations, Drivers, Stays, courses, Total Cuota (installment plan), and the other features.
4. To process payments, protect them while delivery is confirmed, issue refunds, and pay commissions.
5. To handle claims, questions, and support requests.
6. To prevent fraud, protect accounts, and enforce the Community Guidelines.
7. To send you service notifications (orders, messages, installment reminders, security).
8. To send you Cashwing news and promotions only if you allow it; you can stop receiving them at any time.
9. To measure and improve the Platform using internal statistics.
10. To comply with legal and tax obligations and requests from authorities.
11. To keep proof of your acceptance of the legal documents.
12. To operate the artificial intelligence features that you use.

4. Who we share your data with

We do not sell or rent your data. We share it only with:

• Other users, according to what you post and the audience you choose, and with the other party to a purchase, reservation, or chat (for example, the seller receives your name and delivery address).
• Providers that operate the service, under contracts that require them to protect your data:
  • Stripe (payments and payout accounts) and, in Colombia, the local payment gateway that is enabled.
  • Supabase (database and file storage).
  • Google (Firebase: application hosting and notifications; Google Workspace: email).
  • Anthropic (artificial intelligence for the Companion and the assistants; only the text or image needed).
  • Uber Direct (home deliveries, when you request them).
  • IP-based approximate location services.
• Authorities, when a law or a valid order requires it, or to protect a person in danger.
• A buyer or successor of the business, if Cashwing is reorganized or sold, in compliance with this Policy.

5. International transfer

Our providers have servers in the United States and other countries. If you live in Colombia or another country, your data may be transferred to the United States, which may have a level of protection different from that of your country. We do this only to provide you with the service and under appropriate contracts and security measures. By accepting this Policy, you authorize that transfer.

6. How long we keep your data

• For as long as your account is active.
• If you delete your account, we delete or anonymize your personal data, except for what the law requires us to keep: records of sales, payments, commissions, and taxes (usually up to 10 years), the proof of acceptance of the legal documents (for as long as claims may arise), and the information necessary to prevent fraud or defend ourselves in a proceeding.
• Messages you have already sent may remain in the other person's chat.

7. Security

We use encryption in transit (HTTPS), encrypted passwords, column-level permissions so that private data is not visible to other users, two-step verification for administrators, and access logs. No system is 100% secure: if an incident occurs that affects your data, we will notify you, and we will notify the authorities when required by law.

8. Your rights

You may, at any time and at no cost:

• Know what data we hold about you and how we use it.
• Update and correct your data (you can change much of it yourself in My Profile).
• Ask us to delete it or delete your account in My Profile → Delete my account.
• Revoke your authorization, when there is no legal or contractual duty to retain the data.
• Request proof of the authorization you gave us.
• Stop receiving promotional communications.
• File a complaint with the data protection authority.

How to exercise them: write to services@cashwing.net from your account's email address, with your name, what you are requesting, and, if it is a claim, the facts.

Deadlines: inquiries, a maximum of 10 business days; claims, a maximum of 15 business days (extendable as provided by law, with notice). In the United States, we respond within the 45 days required by state laws where they apply.

9. Colombia — Habeas Data Authorization (Ley 1581 de 2012 and Decreto 1377 de 2013, Colombia's implementing regulation)

If you reside in Colombia, by checking the box "I accept the Privacy Policy and authorize the processing of my data":

1. You declare that you were informed of who the controller is (CASHWING COLOMBIA S.A.S.), of the purposes in section 3, that your data may be transferred to the United States (section 5), of the optional nature of answering questions about sensitive data or data of minors, and of your rights (section 8).
2. You give your prior, express, and informed authorization for the processing of your data for those purposes.
3. You understand that what you post as public may be seen by other users and, if the feature allows it, by search engines.
4. You know that you may go to the Superintendencia de Industria y Comercio (SIC, Colombia's consumer and data protection authority) after having submitted your inquiry or claim to us.

Cashwing keeps proof of this authorization (date, time, IP, device, language, and version of the text).

10. United States

• Children (COPPA): we do not knowingly collect data from children under 13. If you believe a child under 13 has signed up, write to us and we will delete the account.
• State privacy laws (California, Virginia, Colorado, Texas, Florida, and others): where they apply, you may request access, correction, deletion, and portability, and opt out of the sale of data or targeted advertising. Cashwing does not sell personal data or share data for cross-context behavioral advertising. We honor the Global Privacy Control signal.
• We do not discriminate against anyone for exercising their rights.

11. Other countries

We apply the mandatory data protection rights of your country of residence. If you are in the European Union or the United Kingdom, you may exercise your GDPR rights (access, rectification, erasure, restriction, portability, and objection) by writing to services@cashwing.net.

12. Cookies

We use only the storage necessary for the Platform to work. Read the Cookie Policy.

13. Changes

If we make a significant change to this Policy, we will notify you and, when required by law, we will ask for your authorization again. Previous versions remain published in the Legal Center.