Privacy policy

Last updated: 31 October 2026

1. Controller

The controller under the EU General Data Protection Regulation (GDPR) is the provider named in the legal notice: CashXChain Inc., 48 Wall Street, Suite 1100, PMB 1024, New York, NY 10005, United States, email legal@cashxchain.com.

2. What PayLorya AI does with data

PayLorya AI is an AI CFO for businesses. You can upload financial documents, chat with the AI CFO, connect wallets and accounts, plan budgets and draft and approve payments. To do this, we process the data described below. We do not sell personal data, do not show ads and do not use tracking or analytics tools.

3. Data we process

Data	Purpose	Legal basis
Account data: name, email address, password (stored only as a hash), or the Google account data described in section 4	Creating and running your account	Art. 6(1)(b) GDPR (contract)
Session data: session token, IP address and browser user agent of each login session	Keeping you signed in; security and abuse prevention	Art. 6(1)(b) and (f) GDPR
Workspace content: uploaded documents (invoices, receipts, statements, contracts and others), data extracted from them, ledger entries, budgets, payees including bank details or wallet addresses, payments, chat messages, activity log	Providing the service you use	Art. 6(1)(b) GDPR
Connected wallets and accounts: public wallet addresses, account balances	Showing balances and executing payments you allow	Art. 6(1)(b) GDPR
Server and access logs: IP address, time, requested URL, status, user agent	Operating, securing and troubleshooting the service	Art. 6(1)(f) GDPR (legitimate interest in a secure service)

Documents you upload may contain personal data of third parties (for example names and bank details of your suppliers). You are responsible for having a legal basis to share them with us; we process them on your behalf only to provide the service.

4. Sign in with Google

If you choose "Continue with Google", PayLorya AI uses Google's OAuth sign-in and requests only the basic scopes openid, email and profile. We receive from Google:

your Google account ID,
your name,
your email address and whether Google has verified it,
the URL of your profile picture.

How we use it: only to create your PayLorya AI account, sign you in and show your name and email in the app. If an account with the same verified email already exists, the Google sign-in is linked to it.

What we do not do: we do not access your Gmail, Drive, Calendar, contacts or any other Google data; we do not post on your behalf; we do not sell or share Google user data with third parties, use it for advertising, or use it to train AI models. Google user data is not sent to our AI provider.

Storage and deletion: the data is stored with your account in our database (Cloudflare D1) and kept as long as your account exists. Google access tokens are used only during sign-in. To delete your account and this data, write to legal@cashxchain.com. You can also remove PayLorya AI's access at any time at myaccount.google.com/permissions.

PayLorya AI's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

5. AI processing

To read documents and answer chat messages, the content you submit is sent to the Claude API of Anthropic PBC (USA). Anthropic acts as our processor. According to Anthropic's commercial terms, API inputs and outputs are not used to train its models. AI results can be wrong; the AI CFO does not make decisions that produce legal effects for you on its own. Whether the agent may execute a payment without your approval is decided by rules and limits you set (autonomy level, limits, known payees), not by the model.

6. Recipients and processors

Cloudflare, Inc. (USA): hosting, content delivery, database (Cloudflare D1, primary location Western Europe) and file storage for uploaded documents (Cloudflare R2). Server logs are processed by Cloudflare.
Anthropic PBC (USA): AI processing of documents and chat messages (section 5).
Google Ireland Ltd. / Google LLC: only if you choose "Continue with Google". Google confirms your identity and sends us your name, email address and profile picture URL; we do not get access to your Google account otherwise.
Stripe, Inc. (USA): only if you link a bank account. Stripe Financial Connections handles the bank login in its own dialog; we never see your bank credentials. We receive the linked account's institution name, account name, last four digits and balances. Read-only: no money moves through this connection.
Blockfrost: Cardano blockchain data provider; receives the Cardano addresses whose balances we look up.
publicnode.com: public RPC endpoints for Ethereum, Base and Polygon; receive the EVM addresses whose balances we look up.
CashXChain UG (haftungsbeschränkt) (Germany), operator of the CashXChain platform: payment rails for fiat payouts (currently a sandbox with test money); receives payee and payment details for payouts you approve or allow.
Public blockchains: Cardano transactions (currently on the Preprod test network) are public and permanent by design. They cannot be deleted.

7. Transfers outside the EU

Some processors are located in the USA or may process data there. Transfers are based on the EU-U.S. Data Privacy Framework where the recipient is certified, and otherwise on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). Uploaded files are currently stored in a Cloudflare R2 bucket that is not restricted to the EU.

8. Cookies and local storage

We only use what is strictly necessary to run the service:

Session cookies (better-auth.session_token and a short-lived signed session cache cookie): keep you signed in. Deleted when you sign out or after the session expires (up to 14 days).
Local storage (cxc-theme): remembers whether you chose light or dark mode. Stays in your browser until you clear it.

We do not use cookies for tracking, analytics or advertising. Legal basis: § 25(2) no. 2 TDDDG and Art. 6(1)(b) GDPR.

9. Retention

We keep account and workspace data for as long as your account exists. Sessions expire after 14 days of validity. When you delete documents, payees, budgets or chats, they are removed from our database and file storage. When your account is closed, we delete its data, except where we must keep it to meet legal retention obligations. To close your account, write to legal@cashxchain.com.

10. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21 GDPR). To exercise them, contact us at legal@cashxchain.com. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live or work.

11. Security

Data is transmitted over HTTPS. Passwords are stored only as hashes. Uploaded files are served back only to signed-in members of the workspace they belong to. No system is perfectly secure; tell us about suspected vulnerabilities at legal@cashxchain.com.

12. Changes

We will update this policy when the service or the law changes. The date at the top shows the current version.