Privacy Policy

1. Scope; Controller

This Privacy Policy (this "Policy") describes how Cashout Mobile LLC, an Ohio limited liability company with its principal place of business in Columbus, Ohio, USA ("Cashout," "we," "us"), collects, uses, discloses, and retains personal information in connection with the Cashout iOS application, the Cashout merchant web portal, and the website at cashoutmobile.com (collectively, the "Service"). Cashout is the controller of the personal information described in this Policy, except for merchant personnel data as described in Section 7, for which the inviting merchant is the controller.

2. Categories of Personal Information Collected

• Account information. Student users register with a school email address (used solely to verify student status) and a password. Business users register with a business name, contact email address, and password.
• Student profile information. Student users select a pseudonymous nickname and avatar. Cashout does not require a student user's legal name, and merchant users are not provided access to student identities.
• Optional demographic information (consent-based). A student user may elect to provide class year, gender, major, and organizational affiliation. Provision of such information is voluntary, is not a condition of any feature, is stored separately from the public profile, and may be withdrawn within the application at any time.
• Activity data. Videos viewed and viewing duration; Dough balance and transaction history; coupons acquired; and coupon redemptions, including the time and the participating business at which each redemption occurred.
• Attribution records. Where a student user views a business's video and subsequently redeems an offer at that business, Cashout records the association as a verified visit. Such records reference the student by a one-way cryptographic hash rather than by name or email address.
• Order totals. A merchant may record the total value of an order at redemption. Such amounts are associated with the redemption record and not with a student user's identity.
• Merchant personnel data. Where a business invites staff to the Service, the invited individual provides a name and an in-application photograph, as described in Section 7.
• Device and diagnostic data. Device model, operating-system and application version, crash logs, and, where notifications are enabled, a push-notification token.

3. Purposes of Processing

Cashout processes personal information to: (a) operate the Service, including accounts, Dough rewards, coupon wallets, and redemptions; (b) measure content effectiveness by associating video views with subsequent redemptions; (c) provide business users with aggregate, group-level insights that do not identify any individual student; (d) deliver notifications the user has enabled, which the user may disable in the application or in operating-system settings; (e) detect, investigate, and prevent fraud and abuse; and (f) comply with legal obligations.

4. Pseudonymization; Aggregation Threshold

Student users appear within the Service under a chosen nickname. Business users receive only aggregated, de-identified metrics; no interface within the merchant product discloses an individual student. Attribution and redemption records identify students by one-way hash. Demographic trends are disclosed to a business only after the number of consenting students exceeds a threshold designed to prevent the singling out of any individual; below that threshold, no demographic information is disclosed.

5. Disclosures

Cashout discloses personal information only: (a) to service providers processing on Cashout's behalf and under contractual restrictions, namely Google Firebase (hosting, database, storage, and push delivery), Stripe, Inc. (merchant billing; Cashout does not receive or store full payment-card numbers), and Google AI services (used solely to phrase merchant-facing insight text; student identities are not transmitted); (b) to merchants, solely in the form of aggregate metrics and anonymous group trends as described in Section 4; and (c) where required by law or reasonably necessary to protect the rights, property, or safety of Cashout, its users, or the public. Cashout does not sell, rent, or trade personal information.

6. Rights and Choices

• Demographics. Users may edit or withdraw shared demographic details at any time within the application; withdrawal deletes the stored record.
• Notifications. Users may opt in or out within the application or in operating-system settings.
• Deletion. Users may delete their account within the application or by written request to support@cashoutmobile.com. Cashout deletes personal information within thirty (30) days of a verified request; aggregate statistics that cannot reasonably identify the user may be retained.
• Access and correction. Users may request access to or correction of their personal information at the address above. Cashout will honor rights afforded by applicable law.

7. Merchant Personnel Data

Where a business invites staff to its scanning role, the invited individual provides a name and photograph within the application. Such information is visible only to that business's owner and managers, and is not disclosed to students or to other businesses. As between Cashout and the business, the business is the controller of such data and is responsible for providing notice to, and where required obtaining consent from, its personnel. Upon removal of a personnel account by the business, the associated photograph is deleted from active storage.

8. Security

Personal information is encrypted in transit (HTTPS/TLS) and stored on infrastructure maintained by Google Firebase. Reward balances, redemptions, and billing meters are computed server-side and are not modifiable from client devices. No method of transmission or storage is guaranteed to be secure, and Cashout does not warrant absolute security.

9. Age Restriction

The Service is intended for university students who are at least eighteen (18) years of age. Cashout does not knowingly collect personal information from any individual under eighteen. If you believe a minor has provided personal information, contact Cashout immediately at the address in Section 11.

10. Changes to this Policy

Cashout may amend this Policy from time to time. Material changes will be announced within the application or by email at least fourteen (14) days before their effective date. Continued use of the Service after the effective date constitutes acceptance of the amended Policy.

11. Contact

Cashout Mobile LLC, Columbus, Ohio, USA · support@cashoutmobile.com