1. Information We Collect

We collect information needed to operate the Services, support customers, and improve accuracy and reliability.

2. How We Use Information

We use collected information to:

• Process and analyze uploaded financial documents.
• Generate suggested matches, ledger classifications, and confidence indicators.
• Enable review, correction, and export of results.
• Provide billing and account management.
• Maintain reliability, security, and performance.
• Respond to support inquiries.
• Improve product functionality and system accuracy over time.

FinSnap does not sell user data.

3. Automated Processing and AI

FinSnap uses automated systems, including machine learning models, to assist with document extraction and transaction matching.

• Outputs are suggestions only.
• You remain responsible for review and final decisions.
• All results can be modified or overridden by the user.

Uploaded data is processed to deliver the Services. When required, data may be processed by third-party AI providers acting strictly on FinSnap’s instructions. We do not use customer data to train our own models. We do not permit third-party AI providers to use your content to train their shared or public models.

Access to customer data is limited to authorized personnel and only when necessary for support, security, or operational purposes.

4. Service Providers and Data Sharing

We share information only in limited circumstances:

• With service providers that help operate the Services, including:
  • Render.com (application hosting, infrastructure, and monitoring)
  • Amazon Web Services (AWS) (cloud storage, backups, and related infrastructure services)
  • OpenAI (AI-based document analysis via API)
  • Stripe (payment processing)
  • Google Analytics or equivalent analytics providers
  • LinkedIn Insight Tag (advertising attribution on limited public pages only)
  These providers act on FinSnap’s instructions and are subject to contractual confidentiality and data protection obligations.
• When required by law or valid legal process.
• In connection with a merger, acquisition, financing, or sale of assets, subject to appropriate confidentiality protections.

We do not sell customer data. We do not place advertising attribution tags inside the authenticated workspace where customers upload, review, or edit financial records, and we do not use those tools to share uploaded documents or reconciliation data.

5. Data Retention and Deletion

You may delete uploaded receipts, statements, and documents at any time within the Services. Deleted files are removed from active production systems.

Account deletion removes active account data from production systems. Backup copies may persist for up to 30 days on our systems or on service provider systems.

Diagnostic logs are retained for up to 90 days for operational and security purposes.

6. Data Security

We use technical and organizational measures appropriate to the nature of the Services to protect information from unauthorized access or misuse.

• Encryption in transit using HTTPS (TLS).
• Database encryption at rest.
• Server-side enforcement of organization-based access controls.
• Authentication required for all account access.

No system is completely secure. We do not guarantee absolute security.

7. Cookies and Analytics

We use cookies for authentication and session management. We also use analytics tools such as Google Analytics to understand usage patterns and improve the Services. On selected public marketing and sign-up pages, we may use LinkedIn Insight Tag to understand advertising campaign performance and attribution.

LinkedIn advertising attribution is not placed on authenticated workspace pages, documentation, legal pages, sign-in, password reset, invite flows, or sign-up links that include invite details such as tokens, email addresses, or organization names.

You can manage or disable cookies through your browser settings. Disabling certain cookies may affect functionality.

8. Children's Privacy

The Services are not directed to children under the age of 13, and we do not knowingly collect personal information from children. If we become aware that such information has been collected, we will take reasonable steps to delete it.

9. Your Rights (PIPEDA and GDPR)

Depending on your location, you may have rights under Canadian and European privacy laws, including:

• Access to personal data we hold about you.
• Correction of inaccurate information.
• Deletion of your account and associated data, subject to operational limits.
• Restriction or objection to certain processing.
• Data portability where applicable.

You also have the right to lodge a complaint with your local supervisory authority. To exercise your rights, contact us using the details below. We may need to verify your identity before responding.

10. Legal Bases for Processing (GDPR)

For users in the European Economic Area, we process personal data based on:

• Contractual necessity (to provide the Services).
• Legitimate interests (operating, securing, and improving the Services).
• Consent, where applicable.

11. International Data Processing

FinSnap operates from Canada. Information may be processed or stored in Canada, the United States, or other jurisdictions where our service providers operate. Data protection laws in these jurisdictions may differ from those in your own.

12. Changes to This Policy

We may update this Privacy Policy periodically. Updates will be posted within the Services, and the "Last updated" date will reflect the current version.

13. Contact

For privacy-related questions or requests:

Email: support@finsnap.ai