Legal

Privacy Policy

Effective date: April 14, 2026 · Last updated: April 14, 2026

CashDesk ("we", "our", or "us") is operated by NorthShift Labs, based in British Columbia, Canada. This Privacy Policy explains what information we collect, how we use it, and how we protect it when you use CashDesk at cashdesk.ca.

We built CashDesk for small business owners who need to trust that their financial data is private and secure. Protecting your data is not an afterthought — it is fundamental to how we operate.

1. What information we collect

We collect only what is necessary to provide the service:

• Google account information — your name, email address, and profile photo, provided when you sign in with Google. We use this to identify your account.
• Business information — your business name and location, which you provide during onboarding.
• Cash tracking data — daily cash entries, bank deposits, cash counts, and notes that you enter into the app. This is the core data the service exists to store.
• Usage data — basic information such as when you signed in and when entries were created or modified. We do not use third-party analytics trackers.

We do not collect payment card numbers. If you purchase CashDesk via Interac e-Transfer, we receive only the confirmation of payment — no banking details.

2. How we use your information

• To provide and maintain your CashDesk account and data
• To identify you when you sign in and route you to your business data
• To manage your trial period and account status
• To respond to support requests you send us directly

We do not use your data for advertising. We do not sell your data to anyone. We do not share your data with third parties except as described in section 4.

3. How your data is stored and protected

Your cash tracking data is stored directly in Google Firebase Firestore, isolated to your own Google account space. NorthShift Labs does not own, operate, or store your financial data on any privately held servers — we simply provide the app interface that lets you interact with your own data in Google's cloud infrastructure. Firebase uses industry-standard encryption in transit (TLS) and at rest.

Each business's data sits in an isolated collection accessible only to the Google accounts you have explicitly authorized: the account that created the business, and anyone you invite through the Team Access feature. This isolation is enforced by Firestore security rules at the database level, so no other CashDesk customer can see or modify your data.

NorthShift Labs does not mine, analyze, sell, or share your financial information. We do not use your cash entries for advertising, model training, or business intelligence of any kind. We will only look at a specific business's data when you explicitly ask us to — for example, when you contact support about an issue that requires us to investigate — or when we are legally compelled to do so.

4. Third parties we work with

• Google Firebase — database, authentication, and hosting. Firebase Privacy Policy
• Google Fonts — fonts loaded from Google's CDN for the interface. Google may log font requests.
• Google Sheets (optional) — if you use the Google Sheets export feature, your data is sent to a Google Sheet you own and control.

We do not use advertising networks, behavioral trackers, or data brokers.

5. Your rights under Canadian privacy law

As a Canadian business, we comply with the Personal Information Protection and Electronic Documents Act (PIPEDA). You have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your account and all associated data
• Withdraw consent to our collection and use of your data

To exercise any of these rights, contact us at the address below. We will respond within 30 days.

6. Data retention

We retain your data for as long as your account is active. If you request account deletion, we will permanently delete your business data from our systems within 30 days. Backups may retain deleted data for up to an additional 30 days before being purged.

7. Children's privacy

CashDesk is intended for use by business owners and is not directed at anyone under the age of 18. We do not knowingly collect personal information from minors.

8. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. For significant changes, we will notify you by email or through a notice in the app. Continued use of CashDesk after changes constitutes acceptance of the updated policy.