Privacy Policy

This Privacy Policy explains how Kashimi, UAB (“FinTest”, “we”, “us”) collects, uses and protects personal data when you visit our website or use our payment integration testing platform. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable national data protection laws.

1. Who we are

FinTest provides a marketplace where payment companies (“Companies”) commission real-world tests of their integrations and individuals (“Testers”) carry out those tests using their own bank accounts. The data controller for personal data processed through the platform is Kashimi, UAB, Vilnius, Lithuania. Contact details are available in our Legal Notice. Our lead supervisory authority is the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija).

2. Data we collect

From all users

• Account data: name, email address, password hash, role (tester or company).
• Authentication data when you sign in via Google OAuth.
• Technical data: IP address, browser, device identifiers, log timestamps.
• Communications you send us (support emails, in-app messages).
• A record of which version of our legal documents you accepted, together with the time, IP address and browser user agent at the moment of acceptance. We keep this to evidence agreement (Art. 6(1)(c) and (f) GDPR).

From Testers

• Country of residence and phone number.
• The banks you hold accounts with and the payment methods you can access. We do not collect or store your online banking passwords, PINs or authentication codes.
• Evidence you upload when completing a test (screenshots, screen recordings, transaction references).
• Payment information needed to pay you: payout method identifier (e.g. IBAN) and tax-related fields where required.

From Companies

• Company name, billing address, VAT identifier, contact persons.
• Test case content you create on the platform.

3. Purposes and legal bases

• Providing the service — performance of a contract (Art. 6(1)(b) GDPR).
• Matching testers to test cases — performance of a contract and legitimate interest in operating the marketplace (Art. 6(1)(b) and (f) GDPR).
• Paying testers and invoicing companies — performance of a contract and legal obligation (Art. 6(1)(b) and (c) GDPR).
• Fraud prevention and platform security — legitimate interest (Art. 6(1)(f) GDPR).
• Service improvement and aggregated analytics — legitimate interest (Art. 6(1)(f) GDPR).
• Marketing emails — only with your consent, which you may withdraw at any time (Art. 6(1)(a) GDPR).

4. Recipients of personal data

We share personal data only as necessary to operate the service. Categories of recipients include:

• Companies that commission tests you participate in — they receive the evidence you submit and the minimum tester identifier required to attribute the test.
• Cloud hosting and database providers acting as processors under written contract.
• Payment service providers that disburse tester payouts and process company invoices.
• Email delivery providers used for transactional and account-related messages.
• Authorities and courts where we are legally required to disclose information.

Sub-processors

We currently engage the following processors. We will update this list before engaging a new one, and Companies may request notification of changes under their data processing agreement.

• Supabase — database and authentication. Hosted in the EU (AWS, Stockholm).
• Cloudflare — storage of test evidence files, including screen recordings. Stored in the EU.
• Vercel — application hosting and content delivery.
• Resend — delivery of transactional email.

Companies requiring a data processing agreement (Art. 28 GDPR) can request one using the contact details in our Legal Notice.

5. International transfers

Where personal data is processed outside the European Economic Area, we rely on the European Commission’s Standard Contractual Clauses or another lawful transfer mechanism to ensure an adequate level of protection.

6. Retention

We retain personal data for as long as your account is active and afterwards only for the period required to comply with our legal obligations (in particular tax and accounting law, typically up to ten years) or to defend legal claims.

Evidence uploaded for a completed test is retained for as long as the commissioning Company’s workspace remains active, because it is the record of the test that Company commissioned. Where a shorter retention period is agreed with a Company, that period applies to their evidence instead. You may request erasure of your personal data at any time under section 8; this may require the associated evidence to be deleted or anonymised where it identifies you.

7. Cookies and similar technologies

We use a small number of strictly necessary cookies to keep you signed in and to protect the service against abuse. We do not use third-party advertising cookies.

We also use PostHog for product analytics. Until you accept analytics cookies in the banner, analytics data is held in page memory only, nothing is stored on your device, and your session is not recorded. If you accept, PostHog stores a first-party cookie and local storage entries to recognise your browser across visits, and may record your session with all text and inputs masked. You can withdraw consent at any time by clearing the site data for FinTest in your browser, after which the banner is shown again.

8. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you,
• request correction of inaccurate data,
• request erasure (subject to our legal retention obligations),
• request restriction of processing or object to processing based on legitimate interest,
• receive your data in a portable format,
• withdraw any consent at any time, and
• lodge a complaint with a supervisory authority in your EU country of residence.

To exercise any of these rights, contact us using the details in our Legal Notice.

9. Security

We apply industry-standard technical and organisational measures to protect personal data, including encryption in transit, role-based access controls and regular security reviews.

10. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be announced through the platform or by email. The date at the top of this page always reflects the latest revision.