Privacy Policy

Version 4.9.131 — Last updated: March 2026

1. Data controller

The controller of personal data collected through the Cash Machine Scanner application is:

Cash Machine Scanner
Contact: [email protected]

2. Data we process

Cash Machine Scanner may process the following categories of data:

Account data: unique identifier (UUID), Google ID or Telegram ID depending on the login method.
Usage preferences: display theme, filters, UI configuration, watchlists and alerts.
Technical logs: IP address, request timestamps, application errors — for security and stability purposes.
User-provided content: analyzed tickers, portfolio positions, price alerts.

No payment data is collected. The service is free.

3. Purposes and legal bases

Purpose	Legal basis (GDPR)
Authentication and account management	Contract performance (Art. 6(1)(b))
Providing features (scoring, alerts, portfolio)	Contract performance (Art. 6(1)(b))
Security, abuse detection, technical logs	Legitimate interests (Art. 6(1)(f))
Improving the service (aggregated statistics)	Legitimate interests (Art. 6(1)(f))

4. Retention

Account data and preferences: kept for as long as the account is active, then deleted 3 years after the last login.
Technical logs: rolling 90 days.
Cloud Storage backups: data hosted on Google Cloud Storage (profiles, portfolios, briefings) is deleted together with the user account. No backup copy is retained beyond account deletion.
AI analyses: analyses generated by third-party providers (OpenAI, Google Gemini, Perplexity) are subject to their own retention policies. Cash Scanner does not retain any personally identifiable copy beyond the account lifetime.
Deletion requests: processed within 30 days.

5. Processors and transfers

The service relies on the following providers. Transfers outside the EU may occur under the EU Standard Contractual Clauses (SCC):

Processor	Role	Location
Google Cloud Platform	Hosting (Cloud Run, Cloud Storage) — europe-west1	EU (Belgium)
Google OAuth 2.0	Authentication via Google account	United States (SCC)
Telegram	Authentication and notifications	International (SCC)
Yahoo Finance (API)	Market data (prices, metadata)	United States (no personal data)
OpenAI / Google Gemini / Perplexity	AI-generated analyses (tickers and briefings)	United States (SCC)

6. Your rights

Under the GDPR, you have the following rights:

Access: obtain a copy of your data.
Rectification: correct inaccurate data.
Erasure: request deletion of your account and data.
Restriction: restrict processing in certain cases.
Objection: object to processing based on legitimate interests.
Portability: receive your data in a structured format.

To exercise these rights, contact: [email protected]

You may also lodge a complaint with your supervisory authority (for France: CNIL): cnil.fr

7. Cookies and local storage

The application uses:

Session cookie (HttpOnly): required for authentication. Expires on logout or inactivity.
localStorage: UI preferences (theme, filters, display limits). No sensitive personal data. Cleared on logout.

If the publisher enables audience measurement (Cloudflare Web Analytics, aggregated), an analytics script may be loaded. Cloudflare Web Analytics is cookie-less and does not collect personally identifiable data — no prior consent is required.

If the publisher enables Google AdSense advertising zones, advertising scripts are loaded only after server-side configuration and user consent through the dedicated consent banner. Depending on your choice, Google may process advertising identifiers for non-personalized or personalized ads. You can refuse or change this consent from the consent banner; see also Google’s policy: policies.google.com/technologies/ads.

7.1 Detailed list of cookies

The exhaustive list of cookies used on this site (category, provider, retention period, purpose) is generated automatically by our IAB TCF v2.2 consent management platform:

7.2 Right to erasure (GDPR Art. 17)

You can permanently delete your account and all associated data (portfolio, movements, alerts, watchlist, usage history) from your user profile → "Delete my account" section. Deletion is immediate and irreversible. No recovery is possible beyond the legal retention period for technical logs (maximum: 30 days).