Privacy Policy

ByDatum, Inc. ("ByDatum," "we," "us," or "our") operates the CashflowCycles Platform (the "Platform"), a cloud-based financial management application designed to help accounting firms, businesses, and their clients manage cash flow, financial reporting, and banking integrations. The Platform is accessible via cashflowcycles.com and any associated subdomains or white-label portals.

This Privacy Policy explains what information we collect, how we use and share it, how we protect it, and what rights and choices you have. By creating an account or using our Platform, you acknowledge that you have read and understood this Privacy Policy.

This Privacy Policy applies to all users of the Platform, including:

• Firm Users: Accounting professionals, firm administrators, and firm team members who manage client relationships, financial data, and reporting through the Platform.
• Client Users: Individuals and businesses onboarded by a Firm User who connect their financial institutions and view financial insights through a dedicated client portal.
• Visitors: Individuals who browse our public-facing website without creating an account.

This policy does not apply to third-party websites, applications, or services linked from our Platform, each of which may have their own privacy policies.

We collect information in the following categories:

2.1 Information You Provide Directly

• Account Registration Data: Full name, email address, firm name, role designation, and account credentials when you create an account.
• Onboarding & Profile Data: Industry, company size, specialities, professional goals, onboarding plan preferences, and agreement to terms of service collected during the onboarding survey.
• Client Data: Client names, client codes, client types (individual, business, or firm), contact information, and engagement details entered by Firm Users.

2.2 Financial Data Obtained via Plaid

• Bank Account Information: When you or your client connects a financial institution through our Platform, we use Plaid, Inc. to securely retrieve account details, including account names, types, balances, and institution identifiers.
• Transaction Data: Historical and ongoing transaction records, including amounts, dates, merchant names, categories, and payment channels.
• Account Holder Identity: Where supported, names and account ownership details returned by Plaid.

We access this data only with your explicit authorization via the Plaid Link consent flow. Our use of information received from Plaid is governed by the Plaid End User Privacy Policy.

2.3 Payment & Subscription Data Obtained via Stripe

• Billing Information: We use Stripe, Inc. to process subscription payments. Stripe collects and processes your payment card details directly. We do not store full credit card numbers on our servers.
• Subscription Metadata: Plan selection, billing cycle, payment status, and Stripe customer identifiers necessary to manage your subscription.

2.4 Automatically Collected Data

• Usage & Analytics Data: Features accessed, pages visited, session duration, and interaction patterns collected to improve the Platform.
• Device & Browser Data: IP address, browser type and version, operating system, screen resolution, and referring URLs.
• Cookies & Local Storage: Session tokens, authentication state, and user preference settings stored locally in your browser.

We process your information for the following lawful purposes:

• Service Delivery: To provide, operate, and maintain the Platform, including cash flow dashboards, financial reports (balance sheets, cash flow summaries, expense distributions), alerts, and forecasting tools.
• Authentication & Security: To verify your identity via AWS Cognito, enforce role-based access controls, and protect the integrity of user sessions.
• Financial Institution Connectivity: To facilitate the secure connection and synchronization of bank accounts and transaction data via Plaid on your behalf.
• Payment Processing: To manage subscriptions, process payments, and facilitate access to the Stripe customer portal for billing management.
• Email Communications: To send transactional emails including account verification codes, password resets, engagement notifications, and invoice communications via Amazon SES.
• Analytics & Improvement: To understand usage patterns and continuously improve Platform features, performance, and user experience.
• Legal Compliance: To comply with applicable laws, regulations, legal processes, or enforceable governmental requests.
• Fraud Prevention: To detect, prevent, and address fraud, security breaches, or other potentially prohibited or illegal activities.

We do not sell, rent, or trade your personal information. We share data only in the following limited circumstances:

• Plaid, Inc.: To retrieve and synchronize your financial institution data. Plaid's use of your data is governed by the Plaid End User Privacy Policy.
• Stripe, Inc.: To process subscription payments. Stripe's use of your data is governed by the Stripe Privacy Policy.
• Amazon Web Services (AWS): Our Platform infrastructure — including authentication (Cognito), API layer (AppSync), databases (DynamoDB), file storage (S3), and email delivery (SES) — is hosted entirely on AWS. AWS processes data on our behalf as a data processor under appropriate contractual safeguards.
• Your Accounting Firm: If you are a Client User, your connected financial data and reports are accessible to the Firm User(s) who onboarded you, in accordance with the engagement between you and your firm.
• Legal Obligations: We may disclose information if required by law, subpoena, court order, or governmental regulation, or where we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
• Business Transfers: In the event of a merger, acquisition, reorganization, or sale of all or a portion of our assets, your information may be transferred as part of the transaction, subject to the acquirer's commitment to honor this Privacy Policy.

We implement rigorous technical and organizational measures to safeguard your data:

• Encryption In-Transit: All communications between your browser and our servers are encrypted using TLS 1.2 or higher, strictly enforced at the AWS CloudFront and API Gateway edge layers.
• Encryption At-Rest: All stored data — including DynamoDB records, S3-hosted documents, and search indices — is encrypted using AES-256 via AWS Key Management Service (KMS).
• Identity & Access Management: AWS Cognito provides centralized authentication with email verification. Role-Based Access Control (RBAC) ensures users access only the data and features appropriate to their role and tenant.
• Multi-Factor Authentication (MFA): MFA via authenticator applications is enforced for all administrative and engineering access to critical systems that store or process consumer financial data.
• Infrastructure as Code: All cloud infrastructure is defined, version-controlled, and deployed via AWS Cloud Development Kit (CDK), enabling full auditability of every security configuration change.
• Least Privilege Principle: AWS IAM policies enforce the minimum necessary permissions for each serverless function, ensuring no component has broader access than required.
• Secrets Management: Third-party credentials (Plaid API keys, Stripe secret keys) are never stored in source code and are managed exclusively through secure AWS parameter stores accessible only by authorized backend Lambda functions.

The Cashflow Platform operates a strict multi-tenant architecture. Each firm and its associated clients are logically isolated by a unique tenant identifier. This ensures:

• One firm's data is never visible to, or accessible by, another firm or its clients.
• All API queries, database reads, and report generation are scoped exclusively to the authenticated user's tenant.
• Client Users can only view data pertaining to their own connected financial accounts within their assigned firm's portal.

We retain your information for as long as reasonably necessary to fulfill the purposes outlined in this Privacy Policy and to comply with our legal and contractual obligations. Specifically:

• Active Accounts: Data is retained for the duration of your active subscription and use of the Platform.
• Closed Accounts: Upon account closure or subscription cancellation, we retain essential records for a period required by applicable tax, financial, and regulatory obligations (typically up to 7 years), after which data is securely deleted or anonymized.
• Plaid Access Tokens: If you disconnect a financial institution or request deletion, we deactivate the associated Plaid access tokens and purge the linked transaction data from our systems in accordance with our data retention schedule.

Depending on your jurisdiction, you may have the following rights regarding your personal information:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete personal data.
• Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data, subject to our legal retention obligations.
• Right to Restrict Processing: Request that we limit how we use your data in certain circumstances.
• Right to Data Portability: Request that we provide your data in a structured, commonly used, and machine-readable format.
• Right to Object: Object to processing based on legitimate interests or for direct marketing purposes.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.
• Right to Disconnect Financial Institutions: You may disconnect any linked bank account at any time through the Platform, which will deactivate the associated Plaid access token and cease further data synchronization.

To exercise any of these rights, please contact us at privacy@cashflowcycles.com. We will respond to your request within 30 days, or as otherwise required by applicable law.

We use cookies and similar technologies for the following purposes:

• Essential Cookies: Required for authentication, session management, and Platform security (e.g., AWS Cognito session tokens).
• Functional Cookies: Used to remember your preferences, selected theme, and layout configurations.
• Analytics Cookies: Used to collect anonymized usage data for improving Platform performance and features.

You may control cookie settings through your browser preferences. Disabling essential cookies may impair Platform functionality.

Our Platform infrastructure is hosted on Amazon Web Services in the United States. If you access the Platform from outside the United States, your information may be transferred to, stored, and processed in the United States or other jurisdictions where our service providers operate.

We ensure appropriate safeguards are in place for such transfers, including Standard Contractual Clauses (SCCs) or equivalent mechanisms recognized under applicable data protection law.

The Platform is not directed to, and we do not knowingly collect personal information from, individuals under the age of 18. If we become aware that we have inadvertently collected data from a minor, we will take prompt steps to delete such information.

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will:

• Post the revised policy on our website with an updated "Effective Date."
• Notify registered users via email where required by law or where the change materially affects how we process your data.

Your continued use of the Platform after such changes constitutes acceptance of the revised Privacy Policy.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: