Privacy Policy
Last updated: 1 October 2026
This policy explains how FinQuaris Ltd handles personal data in connection with the CasualSome performance review platform, available at casualsome.com. It covers the General Data Protection Regulation (EU and UK GDPR), the Mauritius Data Protection Act 2017, and the California Consumer Privacy Act as amended by the CPRA, as well as a general baseline that applies to everyone else.
1. Introduction and who we are
CasualSome is a performance review, KPI tracking and appraisal platform for small and medium businesses. It is owned and operated by FinQuaris Ltd, a company registered in the Republic of Mauritius ("we", "us", "our").
You can reach us about anything in this policy at contactus@finquaris.com.
Registered details: FinQuaris Ltd, Business Registration Number (BRN): C26233917, registered address: Orangers Street, Morcellement Montreal 2, Coromandel 1714-07, Mauritius.
This policy applies to our website, our marketing pages, the CasualSome application, and the emails we send. It does not apply to third-party websites we link to.
2. Our role: controller and processor
We are the controller for data about visitors to our website, the people who sign up for an account, billing contacts, and anyone who contacts our support team. We decide why and how that data is used.
We are a processor for the content a customer company puts into the platform about its own people — employee records, KPI answers, journal entries, private manager notes, peer feedback and appraisals. The customer company is the controller of that data and decides what is collected, who can see it and how long it is used.
If you are an employee using CasualSome because your employer asked you to, please direct requests about your review data to your employer first. We will help them respond, and we will always act on their lawful instructions.
3. Summary at a glance
- We collect account details, the review content you enter, billing information, and basic usage data.
- We use it to run the service, generate AI draft appraisals on your instruction, keep the platform secure, and bill you.
- We never sell personal data and we never share it for cross-context behavioural advertising.
- AI drafts are suggestions; a human at your company always reviews them before they are published.
- Every company's data is isolated at the database level so one customer can never see another's records.
- You can access, correct, export or delete your data, and you can close your account at any time.
4. The data we collect
We only collect what the platform needs in order to work. The table below lists every category of personal data we handle.
| Category | Examples | Where it comes from |
|---|---|---|
| Account data | Name, work email, password (stored hashed, never in plain text), company name, role (owner, manager, employee), language and theme preference | You, when you sign up or update settings |
| Employee records | Employee name, work email, department, job title, team membership, manager assignment, employment status | Your employer or company owner, entered in the platform |
| Review and KPI content | KPI definitions, self-assessment answers, justifications, ratings and scores, submission status and timestamps | Employees and managers using the platform |
| Journal entries | Free-text notes an employee writes about their own work over the review period | The employee |
| Manager notes and feedback | Private manager notes, manager comments on KPI answers, peer and 360 feedback, star ratings | Managers and colleagues in your company |
| Appraisals and goals | Generated and edited appraisal text, performance summaries, goals with metrics, targets and due dates | Generated by AI on request, then edited and approved by a manager |
| Billing data | Plan, subscription status, trial dates, invoice history, billing email. Card details are handled by our payment provider and never reach our servers. | You and our payment provider |
| Support and contact data | Messages you send through the contact form or by email, and our replies | You |
| Usage and device data | Pages visited, features used, approximate location derived from IP, browser type, operating system, error logs and timestamps | Collected automatically as you use the service |
| Cookie data | Session and authentication identifiers, preference values, aggregate analytics identifiers | Set in your browser — see section 15 |
We do not intentionally collect special category data such as health, religion, ethnicity, biometrics or trade union membership. Please do not enter such information into free-text fields like journal entries or manager notes.
5. Why we use it and our legal basis
Where the GDPR or a comparable law applies, we must have a lawful basis for each use of your personal data. Ours are set out below.
| Purpose | Data used | Legal basis |
|---|---|---|
| Creating and maintaining your account and providing the platform | Account data, employee records, review content | Performance of a contract with you, or our legitimate interest in serving our customer where you are their employee |
| Generating AI draft KPIs, suggestions and appraisals when a user requests it | Review content, journal entries, department and job title descriptions | Performance of a contract; carried out on the documented instruction of the customer company |
| Sending essential service emails: invitations, confirmations, password resets, deadline reminders, submission notifications | Account data, employee records, cycle dates | Performance of a contract and our legitimate interest in keeping reviews on schedule |
| Taking payment and managing subscriptions | Billing data, account data | Performance of a contract and compliance with tax and accounting obligations |
| Keeping the platform secure: rate limiting, abuse prevention, audit and error logs | Usage and device data, account data | Legitimate interest in protecting our service and our customers' data |
| Improving the product and understanding how features are used | Aggregated usage data | Legitimate interest in improving our service; consent where analytics cookies require it |
| Responding to your questions and support requests | Support and contact data | Legitimate interest in supporting our users |
| Marketing emails about our product, where you opted in | Name and email | Consent, which you may withdraw at any time |
| Meeting legal obligations and defending legal claims | Any relevant data | Legal obligation and legitimate interest |
6. Artificial intelligence processing
CasualSome uses large language models to draft KPI sets, suggest answers from an employee's own journal, improve writing, and produce appraisal summaries. This only happens when a user actively asks for it by pressing a button in the app.
- What is sent: only the content needed for that request — for example the KPI question, the relevant department and job title description, the employee's own answers or journal entries, and the review cycle's focus.
- What is not sent: passwords, billing data, and data belonging to any other company.
- Training: our AI providers process this content to return a response to us. We do not permit customer content to be used to train publicly available models.
- Human review: every AI output is a draft. A manager reads, edits and approves it before it becomes part of an employee's record.
- No automated decisions: we do not make decisions producing legal or similarly significant effects about anyone by automated means alone. Employment decisions remain entirely with the employer.
8. International transfers
We are based in Mauritius and our providers operate in the European Union and the United States, so personal data may be transferred across borders.
- For transfers out of the EEA or the UK, we rely on the safeguards our providers offer under their own terms (such as the European Commission's Standard Contractual Clauses, where a provider includes them), together with technical measures such as encryption in transit and at rest.
- For transfers out of Mauritius, we comply with the transfer conditions in section 36 of the Data Protection Act 2017, relying on the safeguards set out in each provider's terms.
- You may request a copy of the safeguards applying to a specific transfer by emailing us.
9. How long we keep data
We keep personal data only as long as we need it for the purposes in section 5, then delete or anonymise it.
| Data | Retention period |
|---|---|
| Account data | For the life of the account. If you cancel your subscription, your data is kept so you can reactivate; it is permanently deleted as soon as the company owner deletes the account in Settings |
| Employee records, KPI submissions, appraisals, goals | For as long as the customer company keeps them, and deleted when the company deletes the record or deletes its account |
| Journal entries and private manager notes | Until deleted by their author or with the account |
| Billing records and invoices | Up to 10 years, to meet accounting and tax obligations |
| Email delivery logs | Up to 12 months |
| Security, audit and error logs | Up to 12 months |
| Analytics data | Up to 24 months, in aggregated form |
| Support correspondence | Up to 24 months after the request is closed |
| Backups | Kept for a limited period, then automatically overwritten |
When a company owner deletes the account in Settings, we permanently delete the company and all of its data — employee records, KPI submissions, appraisals, journal entries and notes — together with the sign-in accounts of everyone in that company, and we cancel any active subscription. An individual employee who wants their data deleted can ask their employer, or email us at contactus@finquaris.com.
10. Security
- All traffic is encrypted in transit with TLS, and data is encrypted at rest.
- Row-level security is enforced in the database so each company can only read and write its own records — isolation does not depend on application code alone.
- Role-based access means employees see only their own review data, managers see only their assigned team, and owners see their company.
- Passwords are stored as salted hashes and are never visible to us.
- Access to customer data on our side is limited to the owner of FinQuaris Ltd, and only to operate and support the service.
- If a personal data breach is likely to result in a risk to your rights, we will notify the relevant supervisory authority within 72 hours where required, and notify affected users and customer companies without undue delay.
No online service can be completely secure. Please use a strong, unique password and tell us immediately if you suspect unauthorised access.
11. Your privacy rights
Subject to the law that applies to you, you have the right to:
- Access — get a copy of the personal data we hold about you.
- Correct — have inaccurate or incomplete data fixed.
- Delete — ask us to erase your data where we no longer need it.
- Restrict — ask us to pause processing while a dispute is resolved.
- Object — object to processing based on our legitimate interests, and to direct marketing at any time.
- Portability — receive your data in a structured, machine-readable format.
- Withdraw consent — where we rely on consent, withdraw it without affecting prior processing.
- Complain — lodge a complaint with your data protection authority.
To exercise a right, email contactus@finquaris.com. We respond within 30 days and may ask you to verify your identity. There is no charge unless a request is manifestly unfounded or excessive.
If your request concerns review data entered by your employer, we will forward it to them as the controller and support them in responding.
12. Mauritius Data Protection Act 2017
As a Mauritian company, we process personal data lawfully, fairly and transparently in line with the principles in section 21 of the Data Protection Act 2017, and we maintain records of processing as required.
Under the Act you have rights of access, rectification, erasure, restriction and objection, and the right not to be subject to a decision based solely on automated processing. If you are not satisfied with our response, you may complain to the Data Protection Office of Mauritius, which supervises compliance with the Act.
13. UK and EU GDPR
If you are in the United Kingdom or the European Economic Area, the legal bases in section 5 apply to you, and you hold all the rights listed in section 11.
- We do not carry out solely automated decision-making with legal or similarly significant effects, including profiling.
- Where we rely on legitimate interests, we have balanced those interests against your rights, and you may ask us for a summary of that assessment.
- You may complain to your national supervisory authority — for example the Information Commissioner's Office in the UK, or your country's data protection authority in the EEA.
14. California privacy rights (CCPA/CPRA)
If you are a California resident, the following applies in addition to the rest of this policy.
In the last 12 months we have collected the categories of personal information described in section 4 — identifiers, professional or employment-related information, commercial information (subscriptions), internet activity, and inferences drawn from usage. We disclosed these categories to the service providers listed in section 7 for business purposes only.
We do not sell personal information, and we do not share it for cross-context behavioural advertising. We have not done so in the preceding 12 months, including for anyone under 16.
You have the right to:
- know what personal information we collect, use and disclose;
- request deletion of your personal information;
- request correction of inaccurate personal information;
- opt out of the sale or sharing of personal information (we do neither);
- limit the use of sensitive personal information (we do not collect it for that purpose);
- be free from discrimination for exercising any of these rights.
Submit a request to contactus@finquaris.com. An authorised agent may act for you with written permission; we may still verify your identity directly.
16. Children's data
CasualSome is a workplace tool intended for adults. It is not directed at anyone under 16, and we do not knowingly collect their personal data. If you believe a child has provided us with data, contact us and we will delete it promptly.
17. Changes to this policy
We may update this policy as the product and the law change. The "last updated" date at the top always reflects the current version. For material changes we will notify account owners by email or with an in-app notice before the change takes effect, and where the law requires it we will ask for your consent again.
18. How to contact us
FinQuaris Ltd (operator of CasualSome)
Business Registration Number (BRN): C26233917
Orangers Street, Morcellement Montreal 2, Coromandel 1714-07, Mauritius
Email: contactus@finquaris.com
You can also reach us through the contact form on our home page. We aim to reply to every privacy request within 30 days.