Privacy Policy

1. Who we are

Cash Stash (the "Service", "we", "us") is a service of Digitalsurfing Limited (Trading as Cash Stash). Digitalsurfing Limited is the data controller for the personal data described in this policy.

You can reach us at ds@digitalsurfing.co.uk.

2. What data we collect

We collect only what we need to provide the Service.

• Account data: name, email, sign-in provider (email, Google, Apple), profile photo if you add one.
• Future-activity data: recipients and contact details for scheduled messages, gifts, tasks and digital cash grants; the message content; release rules and trusted-contact lists.
• Payment metadata: we use Stripe for payments and receive only the metadata Stripe returns (transaction id, plan, amount, customer id). We never see or store full card numbers.
• Legal acceptances: when you tick the agreement boxes at checkout we record the document name, version, timestamp, the IP address of the request and the browser user-agent string, alongside a unique receipt id.
• Legal Declaration documents: signed Legal Declaration PDFs you upload, plus the metadata we record about them (filename, file hash, timestamp, and a snapshot of your account settings at the time of signing).
• Usage and log data: standard server logs, IP, browser, device, and pages visited, used for security, diagnostics and analytics.
• Cookies: essential cookies for authentication and session state. We do not run advertising cookies.

3. How we use your data

• To operate the Service: schedule and deliver future activity (messages, gifts, tasks and digital cash), run check-ins and trusted-contact confirmations, and keep your wallet and release rules secure.
• To handle payments, send transactional emails (receipts, payment confirmations), and provide support.
• To protect the Service: detect abuse, prevent fraud, enforce our Terms of Service and respond to legitimate legal requests.
• To improve the Service: analyse aggregated, de-identified usage to fix bugs and develop features.

4. Lawful bases (UK GDPR)

• Contract: processing necessary to provide the Service you signed up for, including paid plans.
• Legitimate interests: securing the Service, preventing fraud, improving features, and operating our business — balanced against your rights.
• Consent: for any optional features you choose to switch on and for any future marketing email. You can withdraw consent at any time.
• Legal obligation: tax, accounting and lawful disclosure requests.

5. Who we share data with

We do not sell your personal data. We share only with the processors we need to run the Service:

• Amazon Web Services (AWS): the only cloud infrastructure provider we use to host, store and back up platform data. Cash Stash does not use Google Cloud, Microsoft Azure, or any other listed infrastructure provider to store your data.
• Stripe for payment processing.
• Email and SMS delivery providers used to send transactional notices and your scheduled future messages.

Each processor is bound by a data-processing agreement limiting use of your data to the service they perform for us.

6. International transfers

Some of our processors are located outside the UK and EEA. Where data is transferred, we rely on UK GDPR safeguards such as the UK International Data Transfer Addendum or the EU Standard Contractual Clauses, and we restrict transfers to providers offering an adequate level of protection.

7. Retention

• Account data: while your account is active.
• Future activity: until each scheduled message, gift or task has been dispatched or you delete it.
• Legal acceptance records: for the life of the account plus six years thereafter, to evidence consent.
• Payment and tax records: retained as long as UK tax law requires (currently six years).
• Deletion requests: on request we erase personal data within 30 days, subject to the legal-retention exceptions above.
• Free-account lifecycle: every new account starts with a free one-month trial. After the trial, an unpaid account becomes read-only: you can still see everything, but you cannot make changes until you choose a paid plan. Your data is kept while the account exists, and you can ask us to delete it at any time.

8. Security

We encrypt data in transit (TLS) and at rest, use row-level security so each user can read only their own records, store secrets in a restricted vault, and limit administrative access to a small number of authorised staff. No system is perfectly secure — keep your sign-in credentials safe and tell us promptly if you suspect unauthorised access.

9. Your rights under UK GDPR

You have the right to:

• Access the personal data we hold about you.
• Have inaccurate data corrected.
• Have your data erased ("right to be forgotten").
• Restrict or object to certain processing.
• Receive your data in a portable, machine-readable format.
• Withdraw consent for any processing based on consent.
• Complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

To exercise any of these rights, email ds@digitalsurfing.co.uk. We respond within 30 days.

10. Children

The Service is for adults aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe a child has provided data to the Service, contact us and we will delete it.

11. Posthumous handling

The Service is designed to operate after your death. You can nominate trusted contacts, configure proof-of-life checks, and set rules for when scheduled messages, gifts and digital cash should be released. Trusted contacts only ever receive the information you chose to share with them. If we are notified that you have died, we will follow the instructions you have configured in-app and limit any other disclosure to what UK law requires.

Any signed Legal Declaration PDF you uploaded is stored alongside the rest of your account record. It is intended to function as an additional component alongside any other valid Will or estate document you may have — not as a replacement for them — and may be used as supplementary, witnessed evidence of your wishes when executors, trusted contacts, or family members ask Cash Stash to act on your posthumous instructions for this account. Cash Stash does not provide legal advice; we encourage you to consult a qualified legal professional in your own jurisdiction about how the Declaration fits with the rest of your estate planning.

12. Cookies

We use cookies and similar local storage strictly for sign-in, session continuity and security. We do not run third-party advertising trackers. Where a third-party feature you choose to use (for example, a card payment page) sets its own cookies, the provider's own cookie policy applies.

13. Record of your consent

When you tick the Privacy Policy and Terms of Service boxes at checkout, we store an append-only record of that acceptance: the document name, the version you accepted, the date and time, the IP and browser used, and the checkout context. You can view every acceptance and download a printable receipt from the "Legal agreements" section of your Dashboard.

14. Changes to this policy

When we change this policy we bump the version number at the top of the page and, for material changes, notify you by email before they take effect. Older versions remain referenceable from the receipt id stored against any historic acceptance.

15. Contact

Digitalsurfing Limited (Trading as Cash Stash) · ds@digitalsurfing.co.uk.

To report a security vulnerability, email ds@digitalsurfing.co.uk.