Privacy Policy

Operator and scope

CashZ9 is an early-stage project, not a registered company. The operator identified below is responsible for personal data processed through this website and waitlist. This policy covers the current website and waitlist.

Information we collect

The waitlist requires your email address and country. First and last names are optional and used to personalize our communication. We also record your language, consent timestamp, purpose and notice version. We do not ask for your home address, phone number, date of birth, identity documents, balance or brokerage credentials.

Purpose and legal basis

With your consent, we maintain your waitlist request and contact you about country-relevant pilot opportunities and early access. This does not cover unrelated advertising or partner marketing. Leaving your name blank does not prevent joining. Technical security data is processed on the basis of legitimate interests in preventing abuse and operating the service.

Technical data and the portfolio demo

The hosting provider may process IP addresses, request times and technical request information to deliver and protect the website. For rate limiting, the server derives a daily rotating keyed hash from the IP address; raw IP addresses are not saved in the waitlist. Portfolio demo adjustments stay in your browser. Allocations submitted to the separate risk endpoint are processed to answer the request, not stored as a portfolio or sent to an AI provider.

Service providers and transfers

The deployment is prepared for Vercel hosting and Supabase PostgreSQL storage. Waitlist information is sent to the database only by the server. No advertising, behavioral analytics, payment or automated email SDK is currently integrated. We do not sell your data. Provider processing locations depend on the selected region and service terms; applicable cross-border transfer safeguards must be reviewed before collection opens. Contact us for information about providers and transfers.

Retention

Waitlist records expire 365 days after signup and are removed by the daily cleanup. You can request earlier deletion by withdrawing consent. Temporary rate-limit hashes expire after one hour and are deleted by a subsequent request or the daily cleanup. Hosting logs and backups follow separate provider retention cycles; deleted records must not be returned to active use if a backup is restored.

Withdrawal and your rights

Email the contact below to leave the waitlist, access, correct or delete your information. We may verify your identity using the minimum information necessary. Depending on applicable law, you may also have rights to restriction, objection and portability. Withdrawing consent does not affect earlier lawful processing. Where GDPR applies, requests are normally answered within one month, with notice of any necessary extension. You may complain to the competent data protection authority where you live, work or where an alleged infringement occurred.

Security and age

Database access is restricted through server credentials and access controls; the list cannot be read through a public API. No system can guarantee absolute security or complete anonymity. The waitlist is intended for people aged 18 or over. If we learn that we collected a child's information, we will delete it.

Cookies and changes

Our Cookie Policy explains preferences stored in your browser. Before introducing new purposes or optional tracking, we will update this notice and seek separate consent where required. The current website does not make automated decisions with legal or similarly significant effects.

Contact and operator