Privacy Policy

• Institution means a bank, credit union, school, school district, or other organization that licenses Cashy under a Services Agreement or sponsors access to Cashy for its community.
• Cashy Workshops means the live games and interactive presentations facilitated by an Institution's staff or volunteers ("Hosts") for an audience ("Participants").
• Cashy Learning Center means the self-paced financial education lessons that an Institution embeds in its website or mobile banking application for its customers or members ("Learners").
• Cashy Classroom means the curriculum product used by teachers ("Teachers") with their students ("Students") in a school setting, either through a sponsoring Institution or licensed directly by the school.
• Administrators means the Institution personnel who manage Cashy for their organization and view its analytics dashboard.
• Personal information means information that identifies, relates to, or could reasonably be linked to an individual.

Where Cashy is provided through an Institution, whether in Cashy Workshops, the Cashy Learning Center, or Cashy Classroom, Cashy processes personal information on behalf of and under the instructions of that Institution. In that capacity Cashy is a service provider as defined in the California Consumer Privacy Act, a processor under comparable laws, and, for schools, a school official under FERPA. The Institution determines which products are deployed, which features such as session surveys are enabled, and who may access its data; Cashy uses the information only to provide the service to that Institution and does not use it for any independent purpose. Cashy is the controller only for information collected through cashygame.com, forms on our website, and its own business contacts.

Because licensing is per product, the data practices of a product an Institution has not licensed do not apply to that Institution's program. The Learning Center and Cashy Classroom are separately licensed products, enabled only for Institutions whose Services Agreement includes them. The survey email field in Cashy Workshops is off by default and can be enabled only by an Institution administrator, in the Institution's dashboard, where enabling it presents the Workshops Privacy Notice and is logged. An Institution that licenses Cashy Workshops alone and leaves that setting off therefore has a program in which participants provide no personal information.

The table below summarizes what personal information each Cashy product collects, what it does not collect, and to whom it is disclosed. The full description follows in Section 4.

4.1 Cashy Workshops. Participants join a live session using a game PIN or QR code and a nickname of their choosing. Cashy records the nickname and the Participant's responses and choices during the session in order to operate the game and display results. Participants do not create accounts, do not authenticate, and are not asked for their name or any other personal information. Session results are made available to the Institution in aggregate form only.

A Host may enable an end-of-session survey (for example, a pre- and post-session confidence measure or feedback on the session). Survey responses are collected without identifying the respondent. A survey may include a clearly labeled optional field in which a Participant may choose to provide an email address. That setting is off by default and can be enabled only by an Institution administrator in the Institution's dashboard, where enabling it presents the Workshops Privacy Notice and is logged; individual Hosts cannot enable it. Email addresses provided in this way are disclosed to the Institution that conducted the session for that Institution's follow-up under its own privacy policy. Cashy does not use them for its own purposes. Session surveys are a feature of Cashy Workshops only and are not available in Cashy Classroom.

4.2 Cashy Learning Center. To save progress, a Learner signs in with an email address. Cashy stores the email address together with the Learner's lesson progress, quiz results, completion dates, and certificates earned. Cashy does not request a name, date of birth, address, account number, or any other personal information. Cashy makes the Learner's learning activity, including lessons started and completed, quiz results, and completion dates, keyed to the Learner's email address, available to the sponsoring Institution through its dashboard. The Institution may use this information to support the Learner, to administer any incentive it offers for completing lessons, and to contact the Learner about products or services related to the topics the Learner is studying. Any such contact is made by the Institution under its own privacy policy and marketing practices; Cashy does not contact Learners for marketing purposes. Any matching of a Learner's email address to the Institution's own customer or member records takes place on the Institution's systems. This disclosure is presented to the Learner when signing in to the Learning Center.

4.3 Cashy Classroom. Live games and presentations in Cashy Classroom operate on a self-selected nickname only. For self-paced lessons, a Student signs in with an email address so that lesson progress, quiz scores, and completion are recorded in the Teacher's class view. Cashy collects no other personal information from Students. Cashy Classroom contains no surveys, no advertising, and no marketing communications. Student information is disclosed only to the Student's Teacher and school, is never made available to a sponsoring bank or credit union, and is never used for marketing or outreach of any kind. Cashy's practices for Students, including Students under 13, are set out in Section 8 and in the Cashy Classroom Student Data Privacy Notice.

Google Classroom integration. Where a school connects Cashy Classroom to Google Classroom, a Teacher may share a Cashy activity to a Google Classroom class and import that class's roster. In that case Cashy receives from Google, under the school's authorization, the class name and, for each Student on the roster, the name and school Google account email address, and uses them solely to display the roster, record progress against the right Student, and return grades to Google Classroom where the Teacher requests it. Cashy's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements: Cashy does not use Google user data for advertising, does not sell it, does not transfer it to third parties except to provide the service or as required by law, and does not allow humans to read it except with the user's consent, for security purposes, or to comply with law. Google user data is deleted when the school disconnects the integration or when the account is deleted, and in any event within 60 days of the license ending.

4.4 Hosts, Teachers, and Administrators. When an Institution provisions an account, or a Teacher or Host registers with a work or school email address, Cashy collects the account holder's name, email address, password (stored as a salted hash and never in plain text), Institution, and role. Cashy also records the platform activity required to operate the service and the Institution's analytics dashboard: sessions hosted, content selected, participant counts, survey settings, class rosters, and administrative actions such as adding or removing presenters.

4.5 Website visitors and business contacts. When a visitor submits a form on cashygame.com, Cashy collects the information provided: name, work email address, institution, role, and product interest. Cashy also maintains business contact information (name, employer, title, work email address, professional profile) for personnel of Institutions with which Cashy works or seeks to work, obtained directly from the individual, from the individual's employer, from publicly available professional sources, or at industry events.

4.6 Technical and log information. For all users, Cashy's servers and analytics tools record IP address, browser type and version, device type and operating system, language, timestamps, pages or screens viewed, and referring page. This information is used for security, troubleshooting, and understanding platform usage. It is not linked to Participant or Student nicknames or responses.

4.7 Information Cashy does not collect. Cashy does not collect Social Security numbers, dates of birth, home addresses, account numbers, payment card numbers, banking credentials, or any customer, member, or transaction data held by an Institution. Cashy does not integrate with any Institution's core banking, customer, authentication, or internal systems, and no such data is exchanged with Cashy. Figures entered into Cashy's calculators and worksheets, such as income, expenses, balances, or interest rates, are processed in the user's browser to display a result; they are not stored by Cashy, not transmitted to an Institution, and not associated with any account.

Cashy does not receive nonpublic personal information as defined in the Gramm-Leach-Bliley Act, cardholder data, or protected health information from any Institution. Where an Institution requires it, Cashy will agree in the Services Agreement to safeguard Institution data consistent with the Institution's obligations under 12 CFR Part 30, Appendix B, or 12 CFR Part 748, as applicable.

Cashy uses personal information for the following purposes:

• Providing the service: operating live sessions, saving Learner and Student progress, issuing certificates, and displaying to Hosts, Teachers, and Administrators the activity of their own Institution.
• Institution reporting: providing Institutions with aggregate workshop analytics (sessions, participants, languages, survey results), Learning Center learning activity and completion records for the Institution's member support, incentive, and outreach programs, and Student progress in a Teacher's class view. Institutions own the usage analytics generated by their programs.
• Support and service communications: responding to inquiries and notifying account holders of service changes, maintenance, and security matters.
• Security and integrity: detecting and preventing misuse, investigating incidents, and enforcing Cashy's Terms and Conditions.
• Product improvement: analyzing which games, lessons, and features are used, as described in Section 7.
• Marketing to Institutions: communicating with personnel of banks, credit unions, schools, and similar organizations about Cashy by email, telephone, professional networks, and at events, using business contact information. Cashy does not market to Participants, Learners, or Students.
• Legal compliance: complying with applicable law and legal process and establishing, exercising, or defending legal claims.

Cashy may use information in aggregated or de-identified form, from which no Institution or individual can reasonably be identified, to operate, evaluate, and improve the service and to report aggregate usage. Cashy does not attempt to re-identify such information and prohibits its service providers from doing so. Cashy does not identify an Institution in any public material without that Institution's written consent.

Cashy does not sell personal information. Cashy does not display advertising within any Cashy product and does not use Participant, Learner, or Student information for advertising or for building profiles for any purpose other than providing the educational service. Cashy does not use personal information to train artificial intelligence or machine learning models and does not permit any service provider to do so.

6.1 Institutions. Cashy discloses to an Institution the information described in Section 4 relating to that Institution's own program: aggregate workshop results, optional survey email addresses, Learning Center learning activity and completion records keyed to email address, and, to Teachers, their Students' learning activity. Student information is never made available to a sponsoring Institution and is never used for marketing. No Institution has access to another Institution's data.

6.2 Service providers. Cashy engages the following service providers to process information on its behalf. Each is bound by written agreement to confidentiality and security obligations no less protective than those in this Policy, and Each is bound by a written agreement imposing confidentiality and security obligations no less protective than those in this Policy. Cashy gives Institution customers at least 30 days' written notice before engaging a new service provider that will process their data, and an Institution may object on reasonable data protection grounds within that period.

6.3 Legal requirements. Cashy may disclose information where required by law, regulation, subpoena, or court order, or where necessary to protect the rights, property, or safety of Cashy, its users, or others.

6.4 Corporate transactions. In connection with a merger, acquisition, financing, or sale of all or part of Cashy's assets, personal information may be transferred to the successor entity, which will remain bound by this Policy until users are notified otherwise.

6.5 No sale or sharing. Cashy does not sell personal information. Cashy does not share personal information about Participants, Learners, Students, Hosts, Teachers, or Administrators for cross-context behavioral advertising, as those terms are defined in the California Consumer Privacy Act. Advertising cookies on the public marketing website are described in Section 7, together with the opt-out.

• Strictly necessary cookies and local storage maintain authenticated sessions, associate a Participant with the session joined, and protect against misuse. The platform cannot operate without them.
• Product analytics and session replay. Cashy uses PostHog to measure feature usage and to record masked session replays for troubleshooting. Text entered into any field is masked before capture. Analytics events and replays are associated with a Host, Teacher, Learner, or Administrator account where one exists; for Participants and for Students in live games they are associated only with a random session identifier.
• No advertising technologies on the platform. Cashy does not place advertising or cross-site tracking cookies or pixels on the Cashy platform: play.cashygame.com, Institution-branded subdomains, the Learning Center, or Cashy Classroom. No information about Participants, Learners, Students, Hosts, or Teachers is used for advertising.
• Advertising measurement on the marketing website only. cashygame.com, the public website that describes Cashy to banks, credit unions, and schools, may use advertising cookies and pixels from advertising networks such as LinkedIn, Google, and Meta to measure the performance of Cashy's advertising and to reach professionals at financial institutions and schools. These tags are confined to cashygame.com. Visitors may opt out through their browser's cookie settings, through the networks' own advertising preferences (LinkedIn: linkedin.com/psettings/advertising; Google: adssettings.google.com; Meta: facebook.com/adpreferences), or through the Network Advertising Initiative opt-out at optout.networkadvertising.org. California residents may treat this as an opt-out of sharing under Section 12.
• Opt-out preference signals. cashygame.com treats a Global Privacy Control signal from a visitor's browser as a request to opt out of the sharing of personal information for cross-context behavioral advertising, and does not load advertising cookies or pixels for that browser.
• Users may block or delete cookies through browser settings; blocking strictly necessary cookies will prevent parts of the platform from functioning.

Cashy is designed for use with young audiences and is built to collect the minimum information necessary to provide the educational service.

• Live games and presentations, whether in Cashy Workshops or Cashy Classroom, require only a self-selected nickname. No account is created and no personal information is requested.
• Self-paced lessons in Cashy Classroom require an email address so that the Teacher can view progress and scores. Cashy collects only that email address and the Student's learning activity, uses it solely to provide the lessons and the Teacher's class view, and does not use it for marketing, advertising, or profiling.
• Children under 13. Cashy makes self-paced lessons available to children under 13 only within a program that a school or Teacher has authorized. In that setting the school provides consent on behalf of parents for the educational use of the service, as permitted under the Children's Online Privacy Protection Act (COPPA). Cashy does not knowingly collect personal information from a child under 13 outside a school-authorized program. Any such information brought to Cashy's attention will be deleted; contact cashy@cashygame.com.
• School records. Where Cashy receives Student information from a school, Cashy acts as a school official with a legitimate educational interest under the Family Educational Rights and Privacy Act (FERPA), uses the information only for the purposes authorized by the school, and does not redisclose it except as directed by the school or required by law.
• Parental rights. Parents and guardians may review, correct, or request deletion of their child's information by contacting the school or by emailing cashy@cashygame.com. Cashy verifies such requests with the school before acting on them.
• Cashy does not sell Student information, does not use it for targeted advertising, and does not build Student profiles for any non-educational purpose, consistent with COPPA, FERPA, California's Student Online Personal Information Protection Act (SOPIPA), and comparable state student privacy laws.
• Cashy will work with school districts that require a written student data privacy agreement. The complete statement of Cashy's practices for schools is the Cashy Classroom Student Data Privacy Notice.

Cashy may retain information for longer periods where required by law, to resolve disputes, or to enforce its agreements.

All traffic between users and the Cashy platform is encrypted in transit using HTTPS/TLS. Data at rest, including backups, is encrypted using AWS-managed encryption. Access to production systems is restricted to authorized Cashy personnel and contractors on a least-privilege basis. All persons with production access are bound by written confidentiality obligations and complete annual security awareness training. Cashy maintains a documented incident response process. Cashy will notify affected Institutions without undue delay, and in any event within 72 hours of becoming aware of a security incident involving their data, will describe the information involved and the remediation steps taken, and will cooperate with the Institution's own notification obligations. Cashy will notify an Institution as soon as possible of any incident that has caused, or is reasonably likely to cause, a material disruption of the service for four or more hours.

Cashy does not currently hold a SOC 2 report. Cashy relies on the SOC 1, SOC 2, and ISO 27001 reports of Amazon Web Services for the hosting layer, and makes its own security documentation available to Institutions on request for vendor due diligence.

No method of transmission or storage is entirely secure. Suspected account compromise or security vulnerabilities should be reported to cashy@cashygame.com. Cashy acknowledges good-faith reports promptly.

Cashy is operated from the United States and hosted on Amazon Web Services in the AWS US East region; product analytics and error monitoring data are processed in the United States. Users accessing Cashy from outside the United States, including from Canada, should be aware that their information is transferred to and processed in the United States, where privacy laws may differ from those of their jurisdiction. Institution customers outside the United States may contact Cashy for the contractual terms governing such transfers.

Subject to applicable law, individuals may request that Cashy:

• provide access to the personal information Cashy holds about them and a copy of it;
• correct inaccurate personal information;
• delete their personal information, including closure of a Learner, Student, Teacher, or Host account; and
• cease marketing communications, by using the unsubscribe link in any marketing email or by contacting Cashy.

Requests may be submitted to cashy@cashygame.com from the email address associated with the account, or in writing to the address in Section 14. Cashy will verify the identity of the requester, which may include confirmation through the Institution or school that provided access, and will respond within 30 days. Cashy may decline or limit a request where the information is required to operate an active program, to comply with a legal obligation, or to protect the platform, and will inform the requester where that is the case.

California residents. Under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), California residents have the right to know the categories and specific pieces of personal information Cashy collects, uses, and discloses (as described in this Policy); to request deletion; to request correction; to opt out of the sale or sharing of personal information (Cashy does not sell personal information and does not share platform user information; the advertising cookies used on the public marketing website can be declined as described in Section 7); to limit the use of sensitive personal information (Cashy does not collect sensitive personal information); and not to be discriminated against for exercising these rights. Requests may be made through an authorized agent with proof of authorization. Cashy responds to verified requests from California residents within 45 days.

In the preceding twelve months Cashy has collected the following categories of personal information: identifiers (name, email address, IP address, nickname); professional information (employer, title, role); internet activity (pages viewed, lessons and sessions completed); and, for Learners and Students, education information. Cashy has disclosed each of these categories to service providers for a business purpose and to the Institution sponsoring the individual's access. Cashy has not sold or shared any personal information.

Requests relating to an Institution's program. Where an individual uses Cashy through an Institution or school, that Institution determines the products and content available and may hold information about the individual in its own systems under its own privacy policy. Requests concerning an Institution's incentive program, class roster, or survey follow-up should be directed to the Institution. Cashy will assist the Institution and the individual with requests concerning information held by Cashy.

Cashy may amend this Policy to reflect changes in its products, practices, or applicable law. The effective date at the top of this Policy identifies the current version. Non-material changes are posted at privacy.cashygame.com. Material changes affecting the treatment of personal information are communicated to Hosts, Teachers, and Learners by email or in-product notice, and to Institution customers through their designated Administrator contacts, before taking effect.

Questions, requests, and complaints regarding this Policy may be directed to:

Cashy Technology, Inc.
Attn: Privacy
8 The Green, Suite #14776
Dover, DE 19901, United States
Email: cashy@cashygame.com
Telephone: +1 (813) 785-2215

Institutions conducting vendor due diligence may request Cashy's technical and security documentation, which together with this Policy, the Terms and Conditions, and the Services Agreement supports that review.