Information practices of the Cashy Learning Center.
Effective Date: October 1, 2026 · Last Updated: October 1, 2026
This Privacy Notice describes the information practices of the Cashy Learning Center, the self-paced financial education hub that a bank or credit union embeds in its website or mobile banking application for its customers or members ("Learners"). It is provided to the Institution's compliance, marketing, and digital teams, and it supplements the Cashy Privacy Policy. The Learning Center is the one Cashy product in which an individual signs in with an email address, and this Notice sets out exactly what follows from that.
The Learning Center delivers short self-paced lessons, quizzes, certificates, calculators, and worksheets under the Institution's branding, on the Institution's website or inside its mobile banking application. Cashy operates the Learning Center as a service provider to the Institution; the Institution decides which content is available and whether to offer incentives for completion.
| Collected | Email address, used to sign in so progress is saved; lesson progress; quiz results; completion dates; certificates earned. |
| Not collected | Name, date of birth, postal address, telephone number, Social Security number, account or card numbers, banking credentials, or any data from the Institution's systems. Cashy does not request them and does not integrate with the Institution's core or customer systems. |
| Calculators and worksheets | Figures a Learner enters (income, expenses, balances, rates) are processed in the browser to display a result. They are not stored by Cashy and not associated with the Learner's account. |
| Technical information | IP address, browser and device type, timestamps, and pages viewed, for security and troubleshooting. |
Cashy makes each Learner's learning activity, including lessons started and completed, quiz results, and completion dates, keyed to the Learner's email address, available to the Institution through its dashboard, together with aggregate usage. The Institution may use this information to support the Learner, to administer any incentive it offers for completing lessons, and to contact the Learner about products or services related to the topics the Learner is studying. Any such contact is made by the Institution under its own privacy policy and marketing practices. Any matching of a Learner's email address to the Institution's own customer or member records takes place on the Institution's systems, not Cashy's.
This disclosure is presented to the Learner at sign-in. Cashy does not contact Learners for marketing purposes, does not sell Learner information, does not use it for advertising, and places no advertising or cross-site tracking technologies in the Learning Center.
| Amazon Web Services, Inc. | Hosting, database, storage, backup, encryption. AWS US East region, United States. |
| PostHog, Inc. | Product usage analytics and session replay with input masking, used for troubleshooting. United States. |
| Functional Software, Inc. (Sentry) | Application error monitoring. |
Each provider is bound by written confidentiality and security obligations. No other third party receives Learner information except where required by law.
| Learner accounts and activity | Retained while the account is active and the Institution's license is in force; deleted within 60 days after the license ends, or earlier at the Learner's or Institution's request. |
| Technical logs | Server logs are retained for 90 days and then deleted. Analytics events and session replays are retained no longer than the license term. |
| Backups | Encrypted nightly; deleted data ages out within 60 days. |
A Learner may request access to, correction of, or deletion of their information, or ask the Institution to stop contacting them, by emailing cashy@cashygame.com from the account email address or by contacting the Institution. Cashy responds within 30 days and assists the Institution with requests it receives.
HTTPS/TLS in transit; AWS-managed encryption at rest and for backups; least-privilege production access; notification to affected Institutions without undue delay and in any event within 72 hours of becoming aware of a security incident involving their data, and as soon as possible for any incident reasonably likely to cause a material service disruption of four or more hours. Cashy does not currently hold a SOC 2 report. Cashy relies on the SOC 1, SOC 2, and ISO 27001 reports of Amazon Web Services for the hosting layer, and makes its own security documentation available to Institutions on request.
Cashy Technology, Inc., Attn: Privacy, 8 The Green, Suite #14776, Dover, DE 19901, United States. cashy@cashygame.com, +1 (813) 785-2215. This Notice is incorporated into the Cashy Privacy Policy; for the Learning Center it controls where the two differ.
