Privacy notice
Last updated 21 September 2026
What personal data CashRelay handles, why, and what your rights are, whether you visit this website, use CashRelay for your business, or are a customer of a business that uses it. It describes what the service actually does.
Who we are
CashRelay is a trading name of Keelson Holdings Ltd, a company registered in England and Wales under number 17359226, whose registered office is 71-75 Shelton Street, Covent Garden, London WC2H 9JQ.
Keelson Holdings Ltd is registered with the Information Commissioner's Office under registration number 00015117984. For anything on this page, email triggsoliver@gmail.com.
Controller or processor?
When a business uses CashRelay to chase its unpaid invoices, that business is the data controller for its customers' details, and Keelson Holdings Ltd is its processor. We handle that data only on the business's instructions, under a written agreement, and only to run its credit control.
We are the controller for our own business data: the accounts of people who use CashRelay, messages people send us, and the technical records needed to run and protect the website.
What we collect
- Customers of businesses using CashRelay
- Company name, contact name and email address, invoice numbers, amounts, dates and payments, and the emails sent and received about unpaid invoices, including what each reply was read as.
- People who use CashRelay
- Name, work email, company and role, and a password stored only as a one-way hash.
- Website visitors
- Our hosting provider keeps standard request logs (network address and pages requested) for security and operations. We use no analytics and no advertising.
- Demo visitors
- The demo company is fictional. To stop abuse we keep a one-way hash of your network address when you start a demo.
- If you email us
- Your email address and what you send, so we can reply.
Why we use it, and our lawful basis
- Chasing unpaid invoices for a business
- That business's legitimate interest in being paid what it is owed. We act on its instructions.
- Running and securing the service
- Performance of our contract with the business, and our legitimate interest in running a secure service.
- Replying to you
- Legitimate interests: you wrote to us.
- Legal obligations
- For example, keeping accounting records.
We do not sell personal data, and we never use a business's customer data for our own purposes.
Automated processing and AI
Customers' replies are read by fixed rules that recognise things like a promise to pay, a dispute, a request to stop, or an out-of-office reply.
An optional AI reader can be switched on for trickier replies. It is currently switched off. When it is on, the text of a reply is sent to Anthropic to be read, and Anthropic does not use it to train its models.
Either way, the reader only describes a reply. Fixed rules decide what happens next, anything unclear goes to a person, and a balance changes only when a payment is recorded. CashRelay does not make decisions with legal or similarly significant effects about anyone, and it does not profile or score people.
Who we share it with
- Vercel (hosting)
- Runs the website and the application. The application runs in London.
- Neon (database)
- Stores account, invoice and message data, in London.
- Anthropic (optional AI reader)
- Reads reply text only if the AI reader is switched on, which it currently is not. Processes data in the United States.
Reminders go to the business's own customers, which is the point of the service. Otherwise we share data only with the suppliers that run it:
Suppliers not yet in use
Real email sending is not switched on yet. When it is, the email delivery provider will be added to this page before it handles any personal data. No payment provider is used at present.
International transfers
Data is stored in London. Where a supplier processes data outside the UK, we rely on UK adequacy regulations or the International Data Transfer Addendum to the EU Standard Contractual Clauses.
How long we keep it
- A business's invoice and customer data
- For as long as the business uses CashRelay, then returned or deleted as the business instructs.
- Audit history
- Kept with the business's data, because its purpose is to show what happened.
- User accounts
- While the account is in use; deleted when you ask or when your company stops using CashRelay.
- Emails you send us
- As long as needed to deal with them, and deleted if you ask.
- Billing records
- 6 years, as required for UK tax purposes.
- Demo companies
- Fictional data only. They stop being processed after 14 days.
Cookies
CashRelay sets one cookie: a strictly necessary sign-in cookie when you sign in or open the demo. It is not used for tracking and needs no consent. There are no analytics, advertising or social media cookies.
Your rights
Under UK GDPR you can ask for a copy of your data, ask for it to be corrected or deleted, object to or restrict how it is used, and ask for it in a portable form. Email triggsoliver@gmail.com and we will respond within a month.
If you are a customer of a business that uses CashRelay, that business controls your data, so it is usually best to contact it first. You can also write to us and we will help, or pass your request on.
If you are unhappy with how we handle your information, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Security
How CashRelay protects data, including what has not been done yet, is on the security page.
Changes
If what we collect or how we use it changes, this page changes first, with a new date at the top.