CONSUMER PRIVACY & PLAID LINK MANDATE: CashOut Financial Technologies Inc. ("CashOut") provides authoritative digital financial services deployed at cashout.demuregram.com. We respect consumer financial privacy and strictly prohibit selling, renting, monetizing, or brokering consumer personal or financial data to third parties. Financial data collected through Plaid Link is processed exclusively for identity verification, account balance synchronization, fraud mitigation, and ACH funds transfer execution under federal banking standards.
1. Explicit Consumer Consent Framework
CashOut obtains explicit, affirmative, and unambiguous consent prior to collecting, processing, or storing consumer data:
- Onboarding Electronic Consent: During registration on cashout.demuregram.com, users affirmatively accept the CashOut Terms of Service, E-Sign Consent Agreement, and this Privacy Policy.
- Plaid Link Authorization: When linking external bank accounts, consumers explicitly launch the Plaid Link interface, review institution disclosures, and authorize tokenized account and balance synchronization.
- Audit-Logged Consent Records: All consent events are recorded in our compliance database with an immutable cryptographic ID, User ID, document version, timestamp, and IP address.
- Step-Up Security Authorization: Sensitive operations require re-authentication via 4-digit security PIN or RFC 6238 Multi-Factor Authentication.
2. Categories of Consumer Data Collected
| Category |
Data Elements Collected |
Business & Statutory Purpose |
| Personal Identifiers |
Full Legal Name, Residential Address, Phone Number, Email, DOB, Social Security Number (SSN/ITIN). |
Customer Identification Program (CIP), USA PATRIOT Act, account registration. |
| Financial & Depository Data |
CashOut balance, transaction ledger history, card PAN/CVV tokens, ACH routing numbers. |
Double-entry payment execution, ledger accounting, and funds disbursement. |
| Plaid Open Banking Data |
Institution name, account names, masked account numbers (•••• 1234), balances, encrypted access tokens. |
External account linking, real-time balance checks, and ACH transfer authorizations. |
| Device & Security Telemetry |
IP address, browser fingerprint, device model, operating system, MFA challenge tokens. |
Fraud prevention, rate-limiting, session protection, and unauthorized access mitigation. |
3. Data Retention & Deletion Compliance
CashOut maintains a defined and enforced Data Retention and Deletion Policy reviewed annually by the Chief Compliance Officer and Chief Information Security Officer:
- Financial Transaction Records: Retained for 5 years from transaction date pursuant to the Bank Secrecy Act (31 CFR § 1010.430) and FinCEN statutory mandates.
- Plaid Token Disconnection: When an account is unlinked, the Plaid access token is immediately invalidated via Plaid's
/item/remove API, and local records are permanently deleted.
- Consumer Deletion Requests ("Right to Delete"): Consumers may request data deletion under CCPA/CPRA. Non-statutory data is permanently destroyed within 30 days.
4. Contact & Privacy Inquiries
For privacy inquiries, consumer data access requests, or regulatory disclosures: