Privacy notice

This Privacy Notice explains how Cashly Ltd collects, uses, stores and protects personal information in connection with Dash Analytix. It applies when you:

• —visit the Dash Analytix website
• —request information or a demonstration
• —create or use a Dash Analytix account
• —connect an accounting platform
• —upload financial or operational information
• —use forecasting, reporting, analysis or artificial intelligence features
• —contact us for support
• —otherwise interact with Cashly Ltd

It also explains your rights under applicable data protection law.

Dash Analytix is operated by Cashly Ltd, trading as Dash Analytix. Company number 14988415. Registered office: 12 Glenhill Close, London, N3 2JS, United Kingdom. Email: contact@dashanalytix.com

References to “Dash Analytix”, “Dash”, “Cashly”, “we”, “us” or “our” mean Cashly Ltd.

Cashly Ltd may process personal information as either a controller or a processor, depending on the circumstances.

2.1When Cashly Ltd acts as a controller

Cashly Ltd acts as a controller where it determines why and how personal information is used. This includes processing for:

• —creating and administering user accounts
• —managing subscriptions and customer relationships
• —responding to enquiries and support requests
• —maintaining service and account security
• —preventing fraud and misuse
• —sending service communications
• —maintaining legal, accounting and business records
• —operating the Dash Analytix website
• —complying with legal and regulatory obligations

2.2When Cashly Ltd acts as a processor

Cashly Ltd generally acts as a processor when it processes accounting, financial or operational information on behalf of a customer through the Dash Analytix platform.

For example, a business, finance team, accountant or adviser may connect an accounting organisation and instruct Dash to import, organise, forecast and analyse its financial information. In these circumstances:

• —the customer normally acts as the controller
• —Cashly Ltd acts as the processor
• —Cashly Ltd processes the information in accordance with the customer’s instructions, the customer agreement and the Dash Analytix Data Processing Addendum

If your personal information has been uploaded to Dash by your employer, accountant, adviser or another organisation, you should normally contact that organisation first about how your information is used.

The personal information we collect depends on how you interact with Dash.

3.1Account and user information

We may collect:

• —your name
• —business email address
• —telephone number, where provided
• —job title
• —organisation name
• —login and authentication information
• —user role and permissions
• —account and workspace identifiers
• —communication preferences
• —account and subscription status

3.2Accounting and financial information

When a customer connects an accounting platform or uploads data, Dash may process:

• —chart of accounts information
• —trial balance information
• —account codes and descriptions
• —profit and loss information
• —balance sheet information
• —cash flow information
• —invoices and bills
• —invoice descriptions
• —transaction values and dates
• —reporting periods
• —budgets and forecasts
• —financial assumptions
• —key performance indicators
• —non-financial operational information
• —comments and notes
• —customer-created models and reports
• —information needed to reconcile, analyse or explain financial performance

Accounting information may sometimes contain personal information relating to customers, suppliers, employees, directors, contractors, sole traders or other individuals mentioned in accounting records.

3.3Information from accounting integrations

Where you authorise an integration with an accounting platform such as Xero or QuickBooks, Dash retrieves information using the permissions granted through that platform.

Our standard accounting integrations are read-only unless we expressly state otherwise for a particular feature. This means that Dash does not use its standard integrations to:

• —post journals
• —amend invoices
• —modify transactions
• —change accounting records
• —initiate payments

Disconnecting an integration prevents Dash from retrieving new information. It does not automatically delete information previously imported into Dash.

3.4Artificial intelligence information

When you use an AI-enabled feature, we may process:

• —financial figures selected for analysis
• —reporting periods and comparisons
• —trial balance codes and account descriptions
• —invoice descriptions
• —questions, prompts and instructions entered by users
• —generated responses
• —user feedback about generated responses
• —summaries of earlier conversations used to maintain relevant context

3.5Support and communication information

When you contact us, we may collect:

• —your contact details
• —the organisation you represent
• —the content of your enquiry
• —support messages
• —attachments you provide
• —product feedback
• —records of our response

3.6Technical and security information

When you access Dash, we may automatically collect:

• —IP address
• —browser and device information
• —operating system
• —login dates and times
• —security and access logs
• —account activity
• —error information
• —information needed to detect misuse or protect the service

3.7Website information

When you visit our website, we may collect limited technical information needed to:

• —deliver the website
• —maintain secure sessions
• —protect forms and login pages
• —remember essential settings
• —prevent fraud and misuse
• —identify and resolve technical problems

We do not currently use third-party advertising pixels, behavioural advertising technologies or third-party website analytics services. If this changes, we will update this Privacy Notice and introduce any required cookie consent controls before enabling those technologies.

We may obtain personal information:

• —directly from you
• —from the organisation that creates or administers your Dash account
• —from your employer
• —from an accounting firm or adviser acting for a client
• —from an accounting platform connected with the customer’s permission
• —from information uploaded to Dash
• —from other authorised users in your organisation
• —automatically when you use our website or application
• —through communications you send to us

Where a customer provides personal information about another individual, that customer is responsible for ensuring that it has an appropriate lawful basis and has provided any required privacy information.

5.1Providing Dash Analytix

We use information to:

• —create and manage user accounts
• —authenticate users
• —provide forecasting, reporting and analysis
• —retrieve authorised accounting information
• —generate dashboards and reports
• —maintain models and assumptions
• —provide AI-enabled functionality
• —store user settings and conversation context
• —make information available to authorised users
• —provide technical and customer support

Where we act as controller, our lawful basis is normally that the processing is necessary to perform a contract or take steps before entering into a contract. Where we process accounting or customer information on behalf of a customer, we normally act as processor under that customer’s instructions.

5.2Managing customer relationships

We use information to:

• —administer customer accounts
• —manage subscriptions
• —respond to customer requests
• —communicate with account administrators
• —provide service notices
• —manage renewals and cancellations
• —maintain records of the customer relationship

Our lawful bases are performance of a contract and our legitimate interests in administering our services and business relationships.

5.3Security and fraud prevention

We use information to:

• —protect customer accounts
• —monitor access and login activity
• —detect unauthorised access
• —prevent misuse and fraud
• —investigate security events
• —protect customer information
• —maintain the reliability of Dash

Our lawful basis is our legitimate interests in protecting Cashly Ltd, Dash Analytix, our customers and our users.

5.4Legal and regulatory obligations

We may process information to:

• —comply with applicable law
• —respond to lawful requests
• —maintain tax, accounting and business records
• —establish, exercise or defend legal claims
• —investigate complaints
• —enforce our customer agreements

Our lawful bases are compliance with legal obligations and our legitimate interests in protecting and enforcing our legal rights.

5.5Improving the service

We may use limited information to:

• —investigate errors
• —improve usability
• —monitor service performance
• —develop and test functionality
• —confirm that features are working correctly

Where reasonably possible, we use aggregated, minimised or de-identified information for these purposes.

6.1How Dash uses AI

Dash uses specialist third-party artificial intelligence infrastructure to support features such as:

• —forecasting assistance
• —financial analysis
• —variance explanations
• —financial commentary
• —responses to user questions
• —related AI-enabled functionality

Cashly Ltd does not publicly identify its external AI infrastructure provider. Where information about the provider is reasonably required for customer due diligence, legal compliance, audit or regulatory purposes, Cashly may make relevant information available to authorised customers through confidential documentation or following a written request to contact@dashanalytix.com

Provider information supplied confidentially may be shared with the customer’s authorised employees, professional advisers, auditors, regulators, or clients where disclosure is reasonably required, provided that appropriate confidentiality protections apply.

6.2Information sent for AI processing

Dash aims to send only information reasonably necessary to generate the requested response. Depending on the feature used, information submitted to the external AI service may include:

• —financial values
• —reporting periods
• —comparisons and variances
• —trial balance codes
• —account descriptions
• —invoice descriptions
• —user-entered prompts
• —relevant sanitised conversation context

The company name is not intentionally included in the AI request. Dash does not intentionally include persistent customer, organisation, user or transaction identifiers in the AI request where they are not required.

6.3Data minimisation and sanitisation

Before information is submitted to the external AI service, Dash applies or intends to apply data-minimisation and sanitisation controls designed to remove unnecessary direct identifiers. These controls may include:

• —removing personal names
• —removing company and trading names
• —removing postal addresses
• —removing email addresses
• —removing telephone numbers
• —removing bank account details
• —removing customer, supplier, employee and director names
• —removing persistent identifiers
• —replacing customer-specific account names with standard financial categories
• —excluding invoice descriptions where they are not required
• —scanning and redacting user prompts
• —aggregating financial values where transaction-level detail is unnecessary
• —using temporary, non-persistent request references

Cashly will not claim that all information submitted to the external AI service is anonymous unless its sanitisation controls have been implemented, tested and documented as sufficiently effective.

6.4Residual risk in narrative information

Automated sanitisation cannot guarantee that every item of personal information will be detected or removed. Personal information may remain in invoice descriptions, customised account descriptions, user-entered prompts, or other narrative information supplied by a customer.

Users must not include unnecessary:

• —names or contact details
• —employee-level payroll information
• —health information
• —criminal allegation information
• —trade union information
• —information about ethnicity, religion or political beliefs
• —individual disciplinary or redundancy details
• —other special-category or highly sensitive personal information

Dash may redact, block or request reformulation of a prompt where it appears to contain unnecessary personal or sensitive information.

6.5Model training and provider practices

Unless Cashly has obtained an appropriate binding assurance from the external AI provider, Cashly does not claim that the provider:

• —operates a zero-retention service
• —never stores API inputs or outputs
• —never uses submitted information to improve its services
• —processes information only within the United Kingdom

Cashly reduces this risk by limiting and sanitising the information submitted to the provider.

6.6AI conversation summaries

Dash may create and retain summaries of AI conversations to:

• —maintain conversational continuity
• —remember relevant financial instructions
• —reduce the need for users to repeat previous information
• —personalise later responses within the relevant organisation
• —provide related user-visible features

These summaries may contain personal information where it was included in a prompt, output or underlying financial record. Conversation summaries are:

• —stored in Cashly’s AWS environment
• —associated with the relevant customer organisation
• —available only to authorised users and personnel
• —not used by Cashly to train shared or public AI models
• —retained in accordance with the periods described in this Privacy Notice

Where available, users or organisation administrators may request deletion of stored conversation context by contacting contact@dashanalytix.com

6.7Human review

AI outputs may be incomplete, inaccurate or unsuitable for a particular purpose. Users are responsible for:

• —reviewing AI-generated outputs
• —checking the underlying figures
• —applying appropriate professional judgement
• —correcting errors
• —deciding whether an output is suitable for use
• —ensuring that outputs are not treated as regulated professional advice

7.1Amazon Web Services

Dash is hosted using Amazon Web Services. Our primary production database is hosted in the AWS London region in the United Kingdom. AWS processes information as an infrastructure service provider acting on Cashly’s instructions and subject to its contractual and data protection obligations.

7.2External AI infrastructure

Dash uses a specialist external AI infrastructure provider to generate responses for AI-enabled features. We do not publicly identify this provider.

Although Dash removes or minimises direct identifiers, invoice descriptions, account descriptions and user-entered prompts may contain personal information. The external AI provider may therefore receive personal information in limited circumstances. The provider may process information outside the United Kingdom.

Relevant provider and processing information may be made available confidentially to authorised customers where reasonably required for due diligence or legal compliance.

7.3Accounting platforms

When you connect an accounting platform, information is exchanged between Dash and that platform at your direction. The accounting platform processes information under its own terms and privacy notice. Dash uses read-only integration permissions unless expressly stated otherwise for a particular feature.

7.4Legal and regulatory disclosures

We may disclose personal information where reasonably necessary to:

• —comply with a legal obligation
• —comply with a court order
• —respond to a regulator or law-enforcement authority
• —establish or defend legal claims
• —investigate fraud or misuse
• —protect the security of Dash
• —protect the rights and safety of Cashly, our customers, users or another person

7.5Business transactions

If Cashly Ltd is involved in an investment, merger, acquisition, restructuring or sale of all or part of its business or assets, relevant information may be disclosed to potential investors, purchasers and professional advisers under appropriate confidentiality protections.

Dash’s primary production database is hosted in the United Kingdom. Information may be processed outside the United Kingdom where this is required to provide external AI functionality.

Where personal information is transferred to a separate organisation outside the United Kingdom and UK transfer restrictions apply, Cashly will assess whether an appropriate legal transfer mechanism is required. Depending on the circumstances, this may include:

• —UK adequacy regulations
• —the UK International Data Transfer Agreement
• —the UK Addendum to approved Standard Contractual Clauses
• —another recognised legal transfer mechanism
• —supplementary technical and organisational safeguards

Cashly also reduces international transfer risk by:

• —excluding unnecessary information
• —removing direct identifiers
• —removing the company name
• —limiting persistent identifiers
• —sanitising narrative information where possible
• —submitting only information relevant to the requested AI feature

Where information has been effectively anonymised before it is sent externally, it is no longer personal information in the hands of the recipient. Cashly does not rely on this position where there remains a reasonable possibility that an individual could be identified.

Additional information may be requested by emailing contact@dashanalytix.com

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Notice. We consider:

• —why the information was collected
• —whether it remains necessary
• —legal and contractual requirements
• —security and fraud risks
• —possible disputes
• —customer recovery and export requirements
• —whether the information can be deleted or de-identified

9.1Active customer data

Customer Data, account information, forecasts, reports and AI conversation summaries may be retained for the duration of the customer’s active subscription.

9.2Data after cancellation

Following cancellation or expiry, operational Customer Data may be retained for up to 12 months. This period is intended to allow Cashly to:

• —respond to restoration requests
• —support data export or migration
• —respond to disputes
• —investigate security or service incidents
• —comply with legal obligations
• —restore continuity where a customer renews within the retention period

Customers may request earlier deletion by contacting contact@dashanalytix.com Cashly may refuse or limit an earlier deletion request where information must be retained for legal or regulatory compliance, tax and accounting requirements, security investigations, fraud prevention, dispute resolution, or establishing, exercising or defending legal claims.

Cashly will periodically review whether the 12-month maximum remains necessary and proportionate.

9.3AI conversation summaries

AI conversation summaries may be retained while the customer account remains active, and for up to 12 months following cancellation. They may be deleted earlier where:

• —the user or organisation administrator requests deletion
• —the relevant organisation is deleted
• —the information is no longer needed
• —Cashly determines that continued retention is not justified

9.4Security and access records

Security, access and audit records may normally be retained for up to 12 months. They may be retained longer where needed to investigate a security event, fraud, misuse, unauthorised access, or a legal claim.

9.5Support communications

Support and customer service communications may normally be retained for up to 24 months after the relevant issue is closed. They may be retained longer where required for an active customer relationship, complaint, dispute or legal claim.

9.6Legal, tax and business records

Contracts, invoices, payment records, accounting records and other information needed for tax, legal or regulatory purposes may be retained for the applicable statutory or limitation period.

9.7Backups

Information may remain in encrypted backups for a limited period after deletion from active systems. Backup information is not used for ordinary business purposes and is deleted or overwritten through Cashly’s normal backup rotation process.

Cashly uses technical and organisational measures designed to protect personal information against unauthorised access, accidental loss, unlawful disclosure, alteration, destruction and misuse. These measures include, where applicable:

• —hosting in the AWS London region
• —encryption in transit and at rest
• —access controls based on role and business need
• —logical separation between customer organisations
• —logging and monitoring
• —read-only accounting integrations
• —backup and recovery arrangements
• —incident response procedures
• —data minimisation before external AI processing

No internet-based service can guarantee absolute security. Users are responsible for protecting their login credentials and notifying Cashly promptly if they suspect unauthorised access.

Dash currently uses only cookies and similar technologies that are necessary to:

• —operate the website and application
• —maintain secure sessions
• —authenticate users
• —remember essential settings
• —protect forms
• —prevent misuse
• —provide requested functionality

We do not currently use:

• —advertising cookies
• —behavioural profiling cookies
• —third-party advertising pixels
• —third-party website analytics cookies

If we introduce non-essential cookies, we will:

• —update this Privacy Notice or publish a separate Cookie Notice
• —explain their purpose
• —request consent where required
• —allow users to change or withdraw their consent

Blocking essential cookies may prevent parts of Dash from working correctly.

We may send service communications where necessary to:

• —administer your account
• —provide security information
• —communicate subscription or service changes
• —respond to requests
• —provide information required to deliver Dash

These are not marketing communications.

Where we send marketing communications, we will do so only where we have an appropriate lawful basis. You can unsubscribe by using the unsubscribe link in the message, or by emailing contact@dashanalytix.com

Unsubscribing from marketing will not stop necessary account, security or service communications.

Dash is not designed to require special-category personal information. Special-category information includes information concerning:

• —health
• —racial or ethnic origin
• —political opinions
• —religious or philosophical beliefs
• —trade union membership
• —genetic information
• —biometric identification
• —sex life
• —sexual orientation

Customers and users should not submit this information unless:

• —it is strictly necessary
• —they are authorised to provide it
• —they have an appropriate lawful basis and additional legal condition
• —they have provided any required privacy information

Dash is a business financial management service and is not intended for use by children. Users must be at least 18 years old or otherwise legally authorised to act for the relevant organisation.

We do not knowingly create accounts for children or intentionally collect information directly from children. Customer accounting records may incidentally contain information about children. Where this occurs, the customer is responsible for ensuring that the information is lawfully processed and limited to what is necessary.

Depending on the circumstances, you may have the right to:

• —request access to your personal information
• —ask us to correct inaccurate or incomplete information
• —ask us to delete your information
• —ask us to restrict how your information is used
• —object to processing based on legitimate interests
• —receive certain information in a portable format
• —withdraw consent where processing relies on consent
• —complain to a data protection supervisory authority

These rights are not absolute and may be subject to legal conditions or exemptions.

Where Cashly acts as controller, you can exercise your rights by contacting contact@dashanalytix.com Where Cashly processes information on behalf of a customer, such as your employer, accountant or adviser, we may refer your request to that customer.

We may need to verify your identity before responding. We do not ordinarily charge a fee for responding to a data protection request. We may charge a reasonable fee or refuse to act where a request is manifestly unfounded or excessive, where permitted by law.

Please contact us first if you have concerns about how we use personal information. Email contact@dashanalytix.com or write to Cashly Ltd, 12 Glenhill Close, London, N3 2JS, United Kingdom.

You also have the right to complain to the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom. You may also complain to another competent supervisory authority where applicable.

Dash may use automated tools to:

• —classify financial information
• —organise account data
• —identify financial patterns
• —generate forecasts
• —explain variances
• —produce financial commentary
• —assist users with financial analysis

These outputs are intended to support user decision-making. Dash does not intend to make solely automated decisions about individuals that produce legal or similarly significant effects.

Users remain responsible for reviewing Dash outputs and making final financial, commercial and professional decisions.

Customers using Dash are responsible for ensuring that they:

• —have authority to connect each accounting organisation
• —have an appropriate lawful basis for providing information to Dash
• —provide required privacy information to affected individuals
• —limit information to what is necessary
• —manage user access and permissions
• —remove access when users leave
• —do not submit unnecessary personal or sensitive information
• —comply with applicable data protection laws
• —review AI-generated outputs before relying on them

Accounting firms and advisers must ensure that they are authorised to process information for each client organisation connected to Dash.

We may update this Privacy Notice to reflect:

• —changes to Dash
• —changes to our processing activities
• —changes to our service providers
• —legal or regulatory developments
• —improvements to our privacy practices

We will publish the updated notice and change the “Last updated” date. Where a change materially affects how we use personal information, we will take reasonable steps to notify affected customers or users.

Questions, requests and complaints relating to privacy or personal information should be sent to Cashly Ltd, trading as Dash Analytix, 12 Glenhill Close, London, N3 2JS, United Kingdom. Company number 14988415.

Email: contact@dashanalytix.com