Cashy Workshops Privacy Notice

Effective Date: October 1, 2026 · Last Updated: October 1, 2026

This Privacy Notice describes the information practices of Cashy Workshops, the live financial education product that bank and credit union staff run for workshop audiences. It is provided to the compliance, vendor management, and information security functions of an Institution that licenses Cashy Workshops, and it supplements the Cashy Privacy Policy. Where an Institution licenses Cashy Workshops only, this Notice describes the entirety of the personal information involved in its program. Workshop participants do not create accounts, do not sign in, and are not asked for any personal information. The two Cashy features that can collect personal information from an Institution's community are off by default and under the Institution's own control. The survey email field is disabled unless an Institution administrator turns it on in the dashboard, which presents this Notice and records who enabled it and when. The Learning Center is a separately licensed product and is enabled only for Institutions whose Services Agreement includes it. An Institution licensed for Cashy Workshops that leaves the survey email field off collects no personal information from Participants through Cashy other than the technical information described in Section 5, and its administrators can confirm the setting at any time.

1. Scope

Cashy Workshops provides live games and interactive presentations that an authenticated Institution staff member or volunteer (a "Host") runs for an audience in person or over video. Participants join a session with a game PIN or QR code on any device, or take part with no device at all using printed cards or by responding aloud. Sessions are run on behalf of the Institution; Cashy has no relationship with the Participant.

2. Information Collected from Participants

Collected	A nickname the Participant chooses when joining, and the Participant's responses or choices during the game. Both exist to run the game and show results on screen.
Not collected	Name, email address, telephone number, postal address, date of birth, Social Security number, account or card numbers, banking credentials, or any customer, member, or transaction data. Participants are not asked for any of these, and there is no field in which to enter them.
Accounts	None. Participants do not register, authenticate, or create a profile. A Participant who returns to a later session is not recognized.
Device-free sessions	When a session is run with printed cards or spoken answers, Cashy collects nothing from Participants at all.
After the session	Nicknames and responses are retained only for the session and its results display. The Institution's analytics dashboard retains aggregate results: number of sessions, number of Participants, topics, languages, and survey results in aggregate.

3. Session Surveys

Cashy Workshops includes optional end-of-session surveys (for example, a pre- and post-session confidence measure or session feedback). A Host may add one to a session. Responses are collected without identifying the respondent and are reported to the Institution in aggregate. A survey without an email field collects no personal information.
A separate setting allows a survey to include a clearly labeled optional field in which a Participant may choose to leave an email address for the Institution's follow-up. The setting is off by default. Only an Institution administrator can enable it, from the Institution's dashboard; doing so presents this Notice and is recorded with the administrator's name and the date. Individual Hosts cannot enable it. Where it is enabled, email addresses are passed to the Institution that conducted the session, for its follow-up under its own privacy policy; Cashy does not use them for any purpose of its own.
While the setting is off, surveys collect no personal information from Participants.

4. Information Collected from Hosts and Administrators

Institution staff who run sessions or administer the program hold accounts. For each account Cashy holds the person's name, work email address, a password stored as a salted hash, the Institution, the role (administrator or presenter), and the platform activity required to operate the program: sessions hosted, content selected, participant counts, survey settings, and administrative actions. Administrators of the Institution can view this activity for their own Institution.

5. Technical and Log Information

Cashy's servers and analytics tools record standard technical information for all connections: IP address, browser type and version, device type and operating system, timestamps, and pages viewed. It is used for security, troubleshooting, and understanding platform usage, and it is not linked to Participant nicknames or responses.

6. Disclosure of Information

The Institution	Aggregate session analytics, Host account activity, and, where an Institution administrator has enabled the survey email field, the email addresses Participants chose to provide. No other Institution has access to its data.
Amazon Web Services, Inc.	Hosting, database, storage, backup, and encryption. AWS US East region, United States.
PostHog, Inc.	Product usage analytics and session replay with input masking, used for troubleshooting. United States.
Functional Software, Inc. (Sentry)	Application error monitoring.
No one else	Cashy does not sell information, does not share it for advertising, and places no advertising or cross-site tracking technologies on the platform. Disclosure may otherwise be made only where required by law.

7. Integration and Regulatory Scope

Data location: Institution data, including product analytics and session replay data, is hosted in the United States.
Cashy Workshops does not integrate with the Institution's core banking, customer, authentication, or internal systems. No customer, member, or account-level data is exchanged with Cashy.
No GLBA nonpublic personal information, PCI cardholder data, or protected health information is processed.
Children's audiences: Participants provide a nickname only. The technical information described in Section 5 is used solely to support the internal operations of the service, as permitted under COPPA, and is not linked to any Participant's nickname or responses.
California: Cashy does not sell or share personal information as defined in the CCPA/CPRA. Cashy acts as a service provider to the Institution.

8. Retention and Deletion

Participant nicknames and responses	Duration of the session and its results display.
Aggregate analytics	Term of the Institution's license; exported to the Institution on request and deleted within 60 days after termination.
Optional survey email addresses	Passed to the Institution; retained by Cashy for the license term, then deleted.
Host and Administrator accounts	License term, then deleted within 60 days.
Technical logs	Server logs are retained for 90 days and then deleted. Analytics events and session replays are retained no longer than the license term.
Backups	Encrypted nightly; deleted data ages out within 60 days.

9. Security

All traffic is encrypted in transit using HTTPS/TLS; data at rest and backups are encrypted using AWS-managed encryption. Production access is limited to authorized Cashy personnel and contractors on a least-privilege basis. Cashy notifies affected Institutions without undue delay, and in any event within 72 hours of becoming aware of a security incident involving their data, describes the information involved and the remediation steps taken, and notifies an Institution as soon as possible of any incident reasonably likely to cause a material service disruption of four or more hours. Cashy does not currently hold a SOC 2 report. Cashy relies on the SOC 1, SOC 2, and ISO 27001 reports of Amazon Web Services for the hosting layer, and makes its own security documentation available to Institutions on request.

10. Contact Us

Cashy Technology, Inc., Attn: Privacy, 8 The Green, Suite #14776, Dover, DE 19901, United States. cashy@cashygame.com, +1 (813) 785-2215. This Notice is incorporated into the Cashy Privacy Policy; for Cashy Workshops it controls where the two differ.