This Privacy Notice explains how Finova ("Finova", "we", "us", "our") collects, uses, shares and protects your personal data when you use the Finova web application and related services (the "Service").
1. Data controller
Finova is the data controller for personal data processed through the Service. You can contact us at privacy@fin-ova.tech for any privacy-related question.
2. Personal data we collect
- Account data — name, email address, password (stored hashed), profile photo, language preference.
- Authentication data — sign-in method (email/password, Google, Apple), passkeys (WebAuthn) registered on trusted devices, session tokens.
- Financial data you enter — accounts, transactions, categories, savings goals, savings circles (xitique) and related notes. This is user-generated content that you control.
- Subscription and billing metadata — plan, billing period, subscription status, trial status, invoice references. Card details are handled by Paddle, not by Finova.
- Support communications — messages you send us and any attachments.
- Technical data — IP address, device and browser information, log data, error reports, and basic usage telemetry needed to operate and secure the Service.
- Cookies and similar technologies — see section 8.
3. How we use your data and legal bases
- To provide the Service (create your account, store your financial data, sync across devices) — performance of a contract.
- To manage your subscription (activate plans, apply feature access, log billing events) — performance of a contract.
- To secure the Service (prevent fraud, abuse, unauthorised access) — legitimate interests.
- To improve the product (aggregate usage analytics, diagnose bugs) — legitimate interests.
- To send transactional emails (sign-in, password reset, receipts, security alerts) — performance of a contract.
- To comply with legal obligations (tax, accounting, responding to lawful requests) — legal obligation.
- For optional AI insights, only for accounts that use that feature — consent which you can withdraw at any time.
4. Who we share data with
We do not sell your personal data. We share it only with:
- Paddle.com — our Merchant of Record. Paddle handles checkout, payment processing, subscription management, invoicing, tax collection and remittance, refunds and billing support. Paddle receives the personal data required to process your purchase (name, email, billing address, payment details, transaction data).
- Infrastructure providers — hosting, database, storage, authentication and email delivery providers acting as our processors and bound by contractual data-protection commitments.
- Analytics and error monitoring providers — used to keep the Service reliable and secure.
- Professional advisers — lawyers, accountants and auditors, where necessary and under confidentiality obligations.
- Authorities — where we are required to disclose data to comply with the law, a court order, or to protect the rights, property or safety of Finova, our users or the public.
5. Data retention
We retain your personal data for as long as your account is active and for a reasonable period afterwards to comply with legal, tax and accounting obligations, to resolve disputes and to enforce our agreements. When data is no longer needed, we delete or anonymise it. You can request deletion of your account at any time (see section 7).
6. Security
We use appropriate technical and organisational measures to protect your data, including encryption in transit (HTTPS), encryption at rest for stored data, access controls, hashed passwords, optional passkeys (biometric authentication) and audit logging. No system is perfectly secure — please use a strong, unique password and enable passkeys where possible.
7. Your rights
Depending on where you live, you may have the right to:
- Access the personal data we hold about you and receive a copy;
- Correct inaccurate or incomplete data;
- Request deletion of your data ("right to be forgotten");
- Restrict or object to certain processing;
- Receive your data in a portable format;
- Withdraw consent for processing that relies on consent;
- Lodge a complaint with your local data-protection authority.
To exercise any of these rights, email privacy@fin-ova.tech. We will respond within the time frame required by applicable law (typically within one month).
8. Cookies
We use a small number of cookies and similar technologies:
- Essential — needed to sign you in and keep your session secure. These cannot be turned off.
- Preferences — remember your theme (light/dark) and language.
- Analytics — help us understand how the Service is used so we can improve it. We use aggregated, non-identifying analytics wherever possible.
You can control cookies through your browser settings. Blocking essential cookies may prevent parts of the Service from working.
9. International transfers
Your data may be processed in countries other than your own, including by our service providers. Where data is transferred outside the UK/EEA, we rely on appropriate safeguards such as Standard Contractual Clauses or adequacy decisions.
10. Children
Finova is not directed to children under 16, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.
11. Changes to this notice
We may update this Privacy Notice from time to time. When we do, we will update the "Last updated" date above and, for material changes, notify you in the Service or by email.
12. Contact
Privacy questions: privacy@fin-ova.tech. General support: support@fin-ova.tech.