Privacy Policy

1. Data Controller

FINNY BV (company number BE 1039.106.758), Burg. Emile de Sadeleerstr. 1, 9450 Haaltert, Belgium, is the data controller for your personal data. Contact: privacy@finny.be.

2. Data We Collect

We collect the following categories of personal data:

• Account data - Name, email address, organisation membership.
• Financial plan data - Revenue projections, cost structures, stakeholder details, and other data you enter into your financial plans.
• Payment data - Processed by Stripe. We do not store card numbers.
• Technical data - IP address, browser type, timestamps for security and debugging.

3. Purpose & Legal Basis

• Contract performance (Art. 6(1)(b) GDPR) - Providing the financial planning service, managing your account, processing payments.
• Legitimate interest (Art. 6(1)(f) GDPR) - Security, fraud prevention, service improvement, audit logging.
• Legal obligation (Art. 6(1)(c) GDPR) - Tax and accounting record-keeping as required by Belgian law.

4. Data Retention

We retain your data as follows:

• Active account data: retained while your account is active.
• Deleted accounts: personal data erased within 30 days of deletion, except where legal retention applies.
• Audit logs: active entries retained for 3 days, archived entries for up to 1 year.

5. Sub-processors

We share data with the following service providers, all of which are GDPR-compliant:

• Supabase Inc. - Authentication and database hosting (EU region).
• Stripe Inc. - Payment processing.
• Anthropic PBC - AI-assisted plan generation and review, and our in-app chat assistant on starter plans (not the chat on existing companies' plans). May process names and business details you enter into your plan (not anonymized).
• OpenAI, L.L.C. - Semantic search embeddings for your dossier knowledge base. Emails, phone numbers, and ID numbers are redacted first; other personal details may remain. Chats about plans of existing companies are not sent for embeddings.
• Google Cloud (Google LLC) - Application hosting (Cloud Run, europe-west1).
• Google Cloud (Document AI) - OCR text extraction from documents you upload (EU region).
• Google Cloud Vertex AI - EU region. AI chat assistant for existing companies; processes the plan's business and bookkeeping data within the EU.
• Cloudflare Inc. - CDN, DNS, and DDoS protection.
• Resend Inc. - Transactional email delivery.
• Sentry (Functional Software Inc.) - Error and performance data, to find outages. Session replay only with your consent, and fully masked when it runs. EU region (Frankfurt).
• PostHog Inc. - Product analytics and session replay in which all text and form inputs are masked, so the figures you enter are never recorded. Only with your consent, and never on pages whose link carries a login token. EU region (Frankfurt).

6. Your Rights

Under the GDPR, you have the following rights:

• Right of access, request a copy of your personal data.
• Right to rectification, correct inaccurate data.
• Right to erasure, delete your account and data.
• Right to data portability, export your data in a structured format.
• Right to object, object to processing based on legitimate interest.
• Right to lodge a complaint with the Belgian Data Protection Authority (GBA/APD).

To exercise your rights, email privacy@finny.be or use the account deletion feature in your dashboard settings.

7. Cookies & Local Storage

We use only strictly necessary storage:

• x-org-slug - Session cookie to identify your active organisation. Strictly necessary for functionality.
• localStorage - Authentication tokens managed by Supabase. Strictly necessary for login.

We do not use tracking cookies, analytics cookies, or third-party advertising cookies.

8. Security

All data is encrypted in transit (TLS) and at rest. We use row-level security, rate limiting, and regular security reviews. See our Security documentation for details.

9. Contact

For privacy inquiries: privacy@finny.be. FINNY BV, Burg. Emile de Sadeleerstr. 1, 9450 Haaltert, Belgium (company number BE 1039.106.758).