1. Scope and responsibility
This policy explains how personal information is handled in the Kassa application operated by NSHETH (“we”, “us”, or “our”). It covers authorised users, people whose details appear in business records, and visitors to public pages or shared documents.
It covers operation of the software. A separate business privacy notice may explain how NSHETH uses information to provide its client services outside Kassa. Those activities and their purposes are not replaced by this policy.
For this installation, NSHETH is the first contact for privacy questions. Where another organisation operates its own Kassa installation, that organisation is responsible for explaining its processing. Installing or rebranding Kassa does not, by itself, give NSHETH access to that installation's records.
2. Information handled by Kassa
Depending on your role and how Kassa is used, information may include:
- Account and contact details: names, email addresses, telephone numbers, company details, roles, permissions, account status and password hashes.
- Business records: client and vendor details, project information, payment and expense amounts, currencies, transaction references, dates, allocations and refund reasons.
- Content and communications: proposals, contracts, tasks, comments, chat messages, notes, imported records, uploaded files and information submitted through public forms.
- Evidence and activity: document versions, acceptance or rejection responses, task changes, reasons, account identifiers, timestamps, login activity, IP addresses and browser/user-agent information.
- AI and support information: prompts, relevant business context, assistant responses, proposed actions, confirmation history, usage metadata and information you provide when requesting help.
We receive information from you, authorised users entering business records, imports and permitted integrations. Some information, such as session activity, is generated when the service is used.
The financial record fields are not a card-payment form. Please do not enter card security codes, passwords, one-time passcodes or unrelated sensitive information into general-purpose fields or attachments.
3. Why information is used
We use information to:
- Authenticate users, manage permissions and provide the requested workspace and client portal.
- Organise records, display balances and produce authorised reports, documents and exports.
- Support project communication, document review and delivery tracking.
- Investigate problems, prevent misuse, maintain security and keep appropriate evidence.
- Meet applicable legal obligations, handle requests and resolve disputes.
Where enabled, information is also used to provide the AI assistance described below.
We process information on a basis permitted by the law that applies to the particular activity. Where consent is required, it must be obtained separately and can be withdrawn as described below. This policy, or merely visiting Kassa, is not blanket consent to every possible use of information.
We do not sell personal information from this Kassa installation or use its private business records for targeted advertising.
4. Who can access information
Authorised administrators can access and manage workspace information. Partners and clients have role- and assignment-based access. Information such as client-facing documents, task changes and project communications may be visible to the people involved in that work.
Administrators can use an audited account-viewing feature to troubleshoot a partner's or client's portal. This does not reveal that user's password. Kassa prevents administrators using that feature from submitting client agreement or delivery acceptance.
Hosting, infrastructure, backup and other service providers may process information needed to operate the service. Authorised support personnel or professional advisers may receive information where necessary for their work. We may disclose information when legally required or reasonably necessary to investigate misuse, protect rights or respond to a security incident, subject to applicable law.
Export and backup functions allow authorised administrators to download records. A complete backup can contain sensitive information across the installation and must be protected accordingly.
5. Public documents and sharing links
Public proposal links and other sharing features can make selected information accessible to anyone who receives the link, within the feature's access and expiry rules. Public policy pages are intended to be openly accessible.
A link can be forwarded, and recipients may download or copy content. Revoking or expiring a link stops future access through that link; it cannot recall copies already obtained.
Check the intended audience before publishing. Contact [email protected] if you believe information has been shared incorrectly.
6. AI processing
The current administrative AI integration uses Groq. When an administrator submits a request to the assistant, Kassa sends the request, relevant conversation history and application-provided context to Groq.
Context can include client names, companies and telephone numbers; project names, client associations and statuses; product and vendor information; recent payment and expense records; and financial summaries. It is not limited to the text typed into the current message.
An administrator's confirmation is required before proposed record changes are executed. That confirmation happens after the AI request has already been sent; it is not a separate permission step for sending the request to Groq.
Kassa also retains AI conversations, responses and action/audit history in its own database. Groq's processing is governed by its Services Agreement and Data Processing Addendum, together with the operator's account configuration.
Do not assume zero retention simply because the feature is an AI assistant. Contact [email protected] for questions about AI use involving your information. Administrators should use ordinary forms when external AI processing is not appropriate.
7. Cookies and browser storage
Kassa uses a session cookie to keep users signed in and support secure access. Browser storage may remember interface preferences, such as whether the sidebar is collapsed. List filters and similar view settings may appear in page URLs.
These features support operation of the interface. The standard Kassa interface uses locally hosted fonts and interface libraries. Additional hosting-layer or optional tracking arrangements, if introduced, must be disclosed and any required choices provided.
You can manage cookies and browser storage through your browser settings. Blocking session cookies may prevent login or normal use. A display feature that hides amounts does not encrypt or delete the underlying records.
8. Storage, security and international processing
Information is stored in the systems used to host this installation and in authorised backups or exports. External providers used for enabled features may process information in other countries. In particular, Groq's Data Processing Addendum describes processing in the United States and other countries.
Contact [email protected] for information about the hosting and processing arrangements applicable to your records.
Kassa includes controls such as password hashing, session management, role-based access, request protection and activity logging. Their effectiveness also depends on hosting configuration, administrator practices and users protecting their credentials. No system can guarantee absolute security.
We will investigate reported security incidents and provide notices where required by applicable law.
9. Retention and deletion
We retain information while it is needed for the purposes described here, including ongoing work, accounting, agreement evidence, security and applicable legal obligations. Retention depends on the record type, the business relationship and any applicable retention requirement or dispute.
Account deactivation, project cancellation, task replacement and conversation archiving do not automatically erase the related history. Published document versions, financial records and audit events may be retained to preserve evidence and explain changes.
Kassa does not provide a universal automatic deletion period or a self-service “erase everything” function. Contact [email protected] to request deletion or discuss a particular record. We will assess what can be deleted, corrected or restricted and explain any lawful reason for retaining information.
Copies may remain in backups until their applicable retention cycle ends. Previously downloaded copies cannot necessarily be recalled. Retained information remains subject to appropriate protection and applicable legal requirements.
10. Requests, choices and complaints
Contact [email protected] to ask about your information, request access or a copy, seek correction or deletion, withdraw consent where processing relies on consent, or raise a privacy complaint.
Include the account or project involved and a description of your request. We may ask for proportionate information to verify your identity or authority; do not send passwords or one-time passcodes.
The rights available, any exceptions and response deadlines depend on applicable law. We will handle requests within the period that law requires. Withdrawing consent does not invalidate processing that was lawful before withdrawal, but may affect a feature that needs the information.
You may also use any complaint or other remedy available from a competent regulator, court or authority under applicable law.
11. Children and policy changes
Kassa is intended for adult business use and is not designed for children. If you believe a child has supplied personal information without appropriate authority, contact [email protected] so we can investigate.
We may update this policy when processing practices or requirements change. The published version will show its effective date. Material changes will be communicated through an appropriate channel; new consent will be obtained where required. Publishing an updated notice does not override existing legal obligations.
For privacy questions or complaints, use [email protected]. For general help, use [email protected].