Privacy Policy

Cashflow Positive (“we”, “us”) provides a web application for tracking cashflow related to Hong Kong residential properties. Contact for privacy matters: support@cashflow-positive.com

2.1. Account data

• Email address
• Authentication identifiers (including if you sign in with Google or similar)
• Account preferences (for example reminder settings)

2.2. Property and cashflow data you enter

• Property details (e.g. address components, size, purchase price, rateable value, lease dates)
• Income and expense items, amounts, dates, and related notes

2.3. Plan interest and product signals

• Optional plan interest or contact details if you request product updates
• Product signals such as when a free plan limit is reached (used to improve the product)

2.4. Billing data

• Subscription status, plan, and billing period
• Payment processor identifiers and limited billing metadata (full card numbers are handled by Stripe, not stored by us)

2.5. Technical data

• Basic logs needed for security, debugging, and reliability (e.g. IP address, device/browser type, timestamps)
• Optional product analytics (page/route level) from our hosting provider

2.6. We do not require identity card numbers, bank login credentials, or full payment card numbers to use the core Service.

3.1. We use data to:

• provide and operate the Service
• authenticate you and secure your account
• send transactional messages (e.g. password reset, optional cashflow reminders you enable)
• manage plan limits and paid subscriptions
• improve reliability and fix errors
• comply with law

3.2. We do not sell your personal data.

3.3. Calculated figures (yields, nets, estimates) are generated from data you enter. They are estimates only — see our Terms. Cashflow Positive is a personal tracking and organisation tool only. All yields, net cashflow figures and calculations are estimates generated solely from the data you enter. They are not verified, not financial advice, not investment advice, and not tax advice. You remain solely responsible for any decisions you make. We exclude all liability to the maximum extent permitted by Hong Kong law.

4.1. We use service providers to run the Service, including:

• Supabase — database and authentication
• Vercel — hosting and optional route analytics
• Resend — transactional email
• Stripe — payment and subscription processing

4.2. They process data on our instructions to provide those functions. We may disclose data if required by law or to protect rights, safety, or security.

When you purchase a paid plan, billing is handled by Stripe. We receive confirmation of payment status and subscription identifiers needed to unlock features. You can manage or cancel a subscription from Settings (Stripe Customer Portal), subject to Stripe’s and our Terms.

6.1. We keep account and property data while your account is active. Plan-interest or product-signal records may be kept for product planning.

6.2. After account closure or deletion request, we delete or anonymise personal data within a reasonable period, unless we must retain it for legal, security, dispute, or tax/accounting purposes (including billing records where applicable).

6.3. Anonymised or aggregated data may be retained indefinitely.

We use industry-standard measures appropriate to a service of this type (including encrypted transport and access controls). No method of transmission or storage is completely secure.

8.1. Under the Personal Data (Privacy) Ordinance, you may request:

• access to personal data we hold about you
• correction of inaccurate personal data

8.2. You may also request deletion of your account and associated personal data. You may request deletion via the in-app account settings (when the feature is available) or by emailing support@cashflow-positive.com. After we verify your identity we will delete or anonymise the personal data within 30 days, except where we are required to retain certain records for legal, tax, accounting, security or dispute-resolution purposes.

8.3. You may complain to the Privacy Commissioner for Personal Data (Hong Kong) if you are not satisfied with our response.

Our providers may process data in data centres outside Hong Kong, including in Japan (Tokyo region / ap-northeast-1). We use established providers and contractual/security arrangements appropriate to the Service.

The Service is not directed at individuals under 18. We do not knowingly collect personal data from children.

We may update this Privacy Policy from time to time. We will post the updated version and revise the “Last updated” date.

Privacy requests and questions: support@cashflow-positive.com