How your data is handled

What is collected

• Account details — your email address and a password hash. Passwords are never stored in readable form.
• Files you upload — the bank statement, receivables ageing and payables ageing you choose to analyse, plus an optional settings file.
• Generated reports — the forecast, diagnostic, risk ranking and brief derived from those files.
• Activity records — which account uploaded, ran or downloaded what, and when, with the originating IP address. This exists so you can see who touched your financial data.

If you sign in with Google, Google shares your email address and name. No access to your Google account, files or contacts is requested or granted.

Where it is stored

Account records and uploaded files are held in Supabase (PostgreSQL and object storage). Analysis runs on a container hosted in Frankfurt, Germany, with a persistent disk. Everything is encrypted in transit over HTTPS and encrypted at rest by the hosting providers.

Who can reach it

Access is enforced by the database itself, not by the interface. Every row and every stored file carries an owner, and PostgreSQL refuses to return anything the requesting account does not own. Changing a URL, guessing another customer’s folder name, or calling the API directly with a valid session all return nothing.

Operators of the service can access data only through an administrative key that is never sent to a browser, and such access is used for support and incident response, not routine review.

What is never done with it

• Your files and figures are never sold or shared with advertisers.
• They are never used to train machine-learning models.
• They are never combined with another customer’s data.
• No third-party analytics or advertising trackers run on this site.

How long it is kept

Uploaded files and generated reports are retained while your account is open, so that each run can be compared against the last. Uploads are grouped into dated folders and are not overwritten, which is what makes a figure traceable back to the exact file that produced it.

Delete an individual run at any time from the Runs page. Close your account and all files, reports and records are removed.

Your rights

You can request a copy of everything held about you, correction of anything inaccurate, or complete deletion. Deletion requests are actioned within 30 days and confirmed in writing.

Contact: support@datariteconsulting.com

Processors used

• Supabase — authentication, database, file storage.
• Render — the analysis, on a container in Frankfurt, Germany.
• Vercel — hosting of this website.
• Resend — transactional email (sign-in links, receipts, one reminder).
• Anthropic — only for “Ask about this run”, and only if you use it. It receives the question and that run’s computed summary (the figures on your dashboard), never the files you uploaded. Under Anthropic’s API terms that data is not used to train its models.
• Paddle (international) and Paystack (Nigeria) — payment. Card details go to them directly and are never seen by CashLens.

Each processes data only to deliver the service, under its own contract with Datarite Consulting. This list is the complete list; if it changes, this page changes and the date above moves.

Who is responsible for what

For your account — your email, plan, settings and the audit log of what happened in it — Datarite Consulting decides why and how the data is used, and is the controller.

For the files you upload — bank statements, ledgers, and the names of your customers and suppliers inside them — you are the controller and Datarite Consulting is a processor acting on your instruction, which is: compute the analysis and give it back to you. Nothing else is done with them. A data processing agreement that sets this out formally is available on request at the address below.

Which law applies

Datarite Consulting is registered in Nigeria and handles personal data under the Nigeria Data Protection Act 2023. Customers in the European Economic Area and the United Kingdom are additionally protected by the GDPR and UK GDPR; for them, Datarite Consulting processes uploaded files under the data processing agreement above, incorporating the Standard Contractual Clauses for any transfer outside those territories. Customers elsewhere have the rights their own law gives them, and every right listed on this page is honoured for everyone regardless.

Where your data physically is: analysis runs in Frankfurt, Germany; account records and files are held by Supabase in the region chosen for the project; this website is served by Vercel from locations near the visitor. Your data is never moved to a country for any reason other than delivering the service.