CAS · OVERFOX
Last published: 2026-10-31
PRIVACY POLICY
Control, Análisis y Seguimiento (CAS)
Operated by Overfox LLC. Last updated: October 31, 2026.
Version: 2026-10-31-r2.
This Policy explains how Overfox LLC collects, uses, shares, retains and protects information when you use the CAS website and iOS and Android apps. CAS is offered to users in the United States.
Reading this Policy or accepting the Terms does not replace specific consent required by law. Planned features process data only when enabled and used; mentioning them does not mean they are already available.
1. What CAS Does
CAS helps organize and analyze financial information through records, accounts, categories, budgets, goals, planning, groups and reports. It may process AI requests and, when enabled, information from banks linked through Plaid.
CAS does not hold, manage, invest or move user funds. Transactions and shared transfers recorded in CAS are organizational information, not bank transfers. CAS does not provide financial, accounting, tax, legal or investment advice.
2. Information Collected and Sources
Account and authentication: name, email, user identifier, sign-in method, profile image when supplied, account dates and status, sessions and security data. Passwords are stored as hashes, not in plain text. We also process protected tokens, device credentials and recovery codes for access and security features. Do not send them to the assistant or support.
Google Sign-In and Sign in with Apple: we may receive a name, email, provider identifier and other basic information authorized for authentication. Apple may provide a private relay email address. Information depends on what the provider supplies and you authorize.
Information you enter: income, expenses, amounts, currencies, recorded accounts, categories, notes, budgets, goals, planning, reminders, documents and other data needed for features you use. It may contain information about customers, suppliers or others; provide only data you are authorized to process.
Groups and shared records: invitations, participant emails and identifiers, membership, roles, permissions, shared accounts, transactions, references, accounting transfers and related activity. Information visible to other participants depends on the feature and their permissions.
Planned Plaid bank linking: when enabled and authorized by you, we may receive the institution, connection and account identifiers, account name and type, last digits, currency, balance, available balance where supplied, update dates and connection status. The planned feature covers United States deposit accounts, not general importing of bank transactions. CAS does not receive or store your bank password through this feature.
Payments and plans: plan, channel, product, amount and currency where supplied by the provider, purchase, receipt or subscription identifiers, verification status, entitlement periods, renewals, cancellations, refunds and support or reconciliation records. CAS does not store the full card number or security code.
AI and files: messages, instructions, conversation context, authorized CAS data relevant to the request, images, receipts, audio, transcripts, extracted text, responses, proposals, confirmations and request status. Photos and recordings may include additional information about you or others.
Support, privacy and representation: email, inquiry content and attachments, references necessary to resolve it and proportionate data to verify identity or a representative’s authority when requested. We do not need passwords, full card details or unnecessary documents.
Technical and usage information: IP address, browser, device and operating system, dates, language and preferences, session and visitor identifiers, pages or modules used, registration and feature-use events, visit source, referrer and campaign, errors and operational metrics. Sources are your interactions, your device or browser and providers involved in authorized features.
3. Processing Purposes
We use information to create and protect accounts, authenticate users, store and display financial records, calculate balances and reports, operate shared features, process AI requests and confirmations, manage plans, verify payments and access, reconcile incidents and respond to support or privacy requests.
We also process information to detect fraud, prevent duplicate actions, recover interrupted requests, maintain security and traceability, diagnose errors, measure use and improve the product. Product analytics may link events to an account when there is an identified session.
We may send operational communications about security, access, invitations, payments, support and Service changes. Promotional communications, if offered, must respect your choices and applicable legal requirements.
We do not use your records to move money, evaluate credit, invest funds or make banking decisions for you. We do not use the assistant as an automated eligibility decision service for credit, employment, housing or insurance.
4. AI, Providers and Authorization
AI features use Vercel AI Gateway and model providers involved according to the feature: OpenAI, Google for features using Gemini and TypeSafe AI for the JEV evaluation model. The message, context, transcript, image or relevant financial information needed for a request may be transmitted, and responses or evaluation results received.
Before transmitting personal information to AI providers, we will disclose what data is shared and request the specific permission required. Accepting the Terms does not replace that permission. Confirming an expense entry authorizes that change, not any additional processing of data.
Provide only necessary information. Do not send passwords, codes, full card details or third-party data without authorization. Results may contain errors and should be reviewed before use or action confirmation.
Provider processing and retention depend on the applicable service, contract and settings. This Policy does not assert that all providers immediately delete messages, files or technical records, or that a zero-data-retention setting is enabled. Using a business API must not be confused with a guarantee of immediate deletion.
For questions about providers or processing of a specific request, contact [email protected]. A provider or purpose change requiring new information or consent must be communicated before implementation.
5. Conversations, Files and Recovery
The conversation visible in the assistant should not be treated as a permanent archive. Some context may become unavailable after closing or reloading the interface; this does not mean all information has been deleted from systems.
CAS retains information about pending requests, proposals, confirmations, results and references needed to recover interruptions and prevent repeated actions. Text and recovery metadata may be saved in protected device storage on mobile. Closing a screen does not necessarily cancel an operation already received by the server.
Images may be stored temporarily through Cloudinary and audio processed for transcription. Link expiration, file deletion, metadata cleanup and backup cycles are separate processes. We do not promise all finish when an attachment disappears from the interface.
Financial records you confirm remain as account data or part of the corresponding shared history even after the conversation ends or the original file is removed. Retention is governed by section 9.
6. Authentication and Local Data
Email and password, Google and Apple are used to authenticate and manage access. They do not give CAS general access to your email, files or bank accounts. Authorized provider data is limited to the sign-in method and feature used.
The website may use cookies, local storage and session storage for authentication, preferences, process recovery and the analytics described in section 11. The app uses protected storage for sessions and certain recovery references, and device storage for preferences or selected files.
You may manage device or provider permissions. Revocation may prevent the related feature from working; it does not automatically delete information CAS already received. Do not assume uninstalling the app deletes the account or server records.
7. Payments and Native Purchases
Square processes purchases on the CAS website, including visits from a mobile device. App Store and Google Play will process in-app purchases when enabled in their respective apps. These purchases are distinct from the Apple Pay and Google Pay wallets.
The payment provider or store processes necessary billing and verification data under its terms and notices. CAS receives purchase information needed to validate and reconcile payments, manage access, prevent duplicates, provide support and meet accounting or legal obligations.
Do not send full card details or security codes to CAS through support or AI. Canceling a subscription, deactivating an account and requesting deletion are separate processes. Purchase, renewal, cancellation, restoration and refund conditions are described in the Terms.
8. Storage and Security
CAS uses third-party infrastructure, including MongoDB Atlas for Platform data, Vercel for hosting and related functions, Cloudinary for files in features that use it, and email and authentication providers.
We apply reasonable technical and organizational measures, such as access controls, protected connections, credential protection, administrative restrictions and traceability and recovery mechanisms. Applicable measures depend on the data and system.
No system guarantees absolute security. Protect devices and credentials and report incidents to [email protected]. We address incidents and notifications according to applicable obligations.
9. Retention, Deletion and Other Users’ Records
While an account is active, we retain data needed to provide the features used and protect the Service. Plan expiration or cancellation does not automatically delete the account.
If you request temporary deactivation, access is blocked and the account is retained to allow reactivation after identity verification. This action does not request or schedule deletion. An already deactivated account is not scheduled for deletion merely because of that status.
When requesting closure for deletion, you may choose to end valid subscription access or retain it until its confirmed expiration. If you retain it, deactivation for deletion takes effect when that access ends. Voluntary closure does not automatically generate a refund, without limiting mandatory rights or applicable provider rules.
Only if you expressly request deactivation for deletion with recovery does a three-calendar-month period apply, measured from effective deactivation after your chosen access ends. Recovering the account during that period cancels scheduled deletion. If not canceled, controlled deletion begins and must finish within six additional months: up to nine months after that deactivation for deletion, subject to this section’s justified exceptions.
Controlled deletion protects the integrity of other users’ data. In linked records, groups or shared accounts, indiscriminate deletion may alter others’ transactions, references, balances or history. Relationships are therefore reviewed and private data separated from necessary shared information before removal.
CAS payment receipts are retained in a company-only archive to meet its tax and accounting obligations; deleting an account does not erase them or make them available to other users. This retention does not include the profile or the private financial records entered by the user, and is limited to the data and retention criterion required by the applicable obligation.
The profile and private data are deleted. Shared history strictly necessary for other participants may be retained, with unnecessary personal identifiers removed and “Deleted user” displayed where appropriate. The entire profile is not retained merely because it is linked to others. A replacement name does not guarantee anonymization: notes, receipts, references and any other identifying information must also be assessed.
Where retained records still contain personal data, retention must be limited to a purpose and basis permitted by law, with access restricted to those who need it and a justified period or criterion. Once that need ends, the corresponding personal data must be deleted or de-identified. Other users’ records do not authorize advertising or incompatible uses of retained data.
You may expressly request deletion without a recovery period before or after deactivation through [email protected] and any enabled deletion controls. This option is separate from temporary deactivation and deactivation for deletion with recovery. The request is handled under applicable legal deadlines and is not mandatorily subject to the three-month recovery period or ordinary subsequent deletion period. We will verify identity proportionately and explain applied exceptions.
Identified data may be retained when required by a tax or accounting obligation, a valid order or request, a specific claim or a legally permitted security need. Retention is limited to the necessary data, purpose and time; the entire account is not kept merely because of a hypothetical future investigation. If part of a request is denied, we explain the basis unless legally prohibited.
Backups must not be used to reactivate deleted data or for ordinary use. Deletion of private data in backups under CAS’s control is included in the periods above, subject to justified legal retention. If a backup is restored for technical recovery, corresponding deletions must be reapplied. Records retained by providers acting as independent controllers, such as store billing records, follow their own obligations and notices.
Irreversible deletion prevents recovery of the account or erased data. During identity review or a valid retention obligation, access to and use of data must be limited to what is necessary. You may ask about status and retained categories at [email protected].
10. Who Receives Information
Other participants: shared features expose information according to their permissions, including certain records, amounts, accounts, activity and participant identity. Sharing a record does not give them general access to private data or credentials. Deleting your profile does not automatically delete others’ legitimate records.
Authentication: Google and Apple receive or supply information needed for their sign-in method. Payments: Square, App Store and Google Play participate according to the channel described in section 7. Plaid will participate in bank linking when enabled and authorized.
Infrastructure and files: MongoDB Atlas, Vercel and Cloudinary participate in storage, hosting or files according to the feature. Resend participates in operational emails using its service. AI: Vercel AI Gateway and the model providers described in section 4 receive content and context necessary to process requests.
Internal Overfox operational systems may receive activity signals, status, errors and metrics for administration, support and monitoring. This does not authorize other CAS users to access that data.
Each provider’s role depends on its services and contracts. Providers processing on CAS’s behalf must limit processing to the corresponding purposes and conditions; stores, payment processors and other providers may act as independent controllers for some purposes, such as fraud prevention, billing and legal obligations.
We may disclose necessary information to comply with law, respond to valid proceedings, protect rights or address incidents. Disclosures must be limited and justified. Overfox LLC does not sell personal information or share it for cross-context behavioral advertising.
11. Cookies, Analytics and Device Permissions
CAS uses technologies to maintain sessions, protect accounts, remember language or theme and recover processes. It also records product analytics about navigation, modules, source and campaign, account creation and feature use.
Technical information is used for the purposes in this Policy. We do not track your searches or general browsing outside CAS to sell profiles or serve cross-context behavioral advertising. Where law requires consent or choices for processing, the corresponding controls must be provided.
You may manage cookies and storage through your browser. Microphone and image use require the corresponding device permissions or selections. You may send text or choose supported files without granting unnecessary permissions; declining a permission may prevent the feature requiring it. Microphone or image permission does not authorize other uses of data.
The app may store tokens and recovery references in protected storage. Device preferences and temporary files may have different cycles from server records; deleting one does not automatically delete the others.
12. Minors
CAS requires a minimum age of 13. Anyone who has not reached the age of majority under their applicable law needs prior, mandatory authorization from a parent or legal guardian. The representative must review this Policy and the Terms before authorizing use.
CAS is not intended for children under 13 and does not seek to knowingly collect their data. If we learn of an account that fails these requirements, we will take required measures, including restriction and deletion where appropriate. Parental authorization for a teenager does not make CAS a service intended for children under 13.
A parent or guardian may contact [email protected] with questions, to withdraw authorization or to exercise applicable rights. We may proportionately verify identity and authority. Additional protections for teenagers apply where required by law.
13. Rights and Requests
Depending on applicable law and its applicability requirements, you may have rights of access, knowledge of categories and recipients, correction, deletion, portability, consent withdrawal, objection or opt-out of certain processing and appeal of a denial.
To exercise rights, email [email protected] describing your request, preferably from the account’s email address. You do not need another account or to send passwords. We may request proportionate information to verify identity and will accept authorized representatives where applicable.
We respond within applicable deadlines. If a permitted extension is needed, we will communicate it and the reason. If a request is denied in whole or part, we explain why and the applicable appeal route; you may seek review through the same contact. We do not discriminate for exercising protected rights.
You may complain to a competent authority. Where applicable, we will honor legally recognized opt-out signals. Mandatory rights do not depend on a particular interface button. This does not remove the obligation to provide controls required by law or distribution platforms.
14. Small Businesses and Information About Others
If you use CAS for a business or enter data about customers, employees, suppliers or participants, you must have the appropriate authorization or basis. Avoid unnecessary personal data.
A record may relate to several people. When handling a request, we will assess the requester’s data and others’ rights; third parties’ private data will not be disclosed or their records indiscriminately deleted. This assessment does not automatically suspend legal deadlines or permit unjustified retention.
15. International Processing and Planned Features
Overfox LLC is formed in Maryland, United States. Although CAS is offered to United States users, infrastructure and AI providers may process information in other countries where they operate, subject to applicable conditions and safeguards.
Future features may require new data categories, providers or permissions. Information will be updated and required authorizations obtained before introducing incompatible new processing. Mentioning a future feature does not mean we currently collect its associated data.
16. Changes to This Policy
We may update this Policy for changes to features, providers, practices or legal requirements. The date and version identify the updated text. Material changes will be notified through CAS, email or another appropriate means.
Where specific consent is required, it will be obtained before the new processing. Continuing to use CAS does not replace that consent or retroactively authorize purposes incompatible with what was disclosed when data was collected.
17. Applicable Law
This Policy is interpreted under applicable Maryland and United States law without limiting mandatory privacy or consumer rights under other applicable state laws. Retention or disclosure exceptions must be assessed under the law applicable to each case.
18. Privacy Contact
Service operator: Overfox LLC. Address: 119 Buttonwoods, Elkton, Maryland, United States. Official email for privacy, support, requests and appeals: [email protected]. Website: https://www.app-cas.com.
Public documents: https://www.app-cas.com/public/privacidad and https://www.app-cas.com/public/terminos. Availability of account controls will be indicated in CAS; do not send unnecessary sensitive data by email.