Privacy Policy
How we protect and handle your personal and financial data.
Last Updated: January 15, 2024
Your Privacy Matters
At FinKitty Ltd ("we", "our", or "us"), we understand that your financial data is among your most sensitive information. This Privacy Policy explains how we collect, use, protect, and share your personal information when you use our financial management services.
We are committed to transparency and your right to control your personal data. This policy is written in plain English to make it easy to understand exactly what we do with your information.
💡 In simple terms: We only collect the information needed to provide our service, we never sell your data, and you're always in control of your information.
1. Information We Collect
Personal Information
When you create an account, we collect:
- • Your name and email address
- • Password (encrypted and never stored in plain text)
- • Business name and type (if applicable)
- • Phone number (optional, for account security)
- • Profile preferences and settings
Financial Data
Through Open Banking connections, we access:
- • Bank account balances and transaction history
- • Account details (account numbers, sort codes, bank names)
- • Transaction descriptions and categories
- • Account holder names (for verification purposes)
Important: We only have read-only access to your bank accounts. We cannot move money, make payments, or modify your accounts in any way.
Usage Information
We automatically collect:
- • How you use our service (features accessed, time spent)
- • Device information (browser type, operating system)
- • IP address and general location
- • Log files and error reports
- • Cookies and similar tracking technologies
💡 What this means: We only collect information that's necessary to provide our service or required by law. We don't collect unnecessary personal details or browse through unrelated data.
2. How We Use Your Information
Service Provision
- • Categorize and analyze your transactions
- • Generate cash flow forecasts and insights
- • Create financial reports and dashboards
- • Provide scenario planning and goal tracking
- • Sync data across your connected accounts
Account Management
- • Verify your identity and prevent fraud
- • Provide customer support and technical assistance
- • Send important account notifications
- • Process billing and subscription management
- • Maintain account security
Service Improvement
- • Analyze usage patterns to improve our service
- • Develop new features and functionality
- • Fix bugs and technical issues
- • Optimize performance and user experience
Legal and Compliance
- • Comply with legal obligations and regulations
- • Prevent fraud and ensure platform security
- • Respond to legal requests and court orders
- • Maintain audit trails as required by law
💡 What this means: We only use your information to provide our service, keep your account secure, and meet legal requirements. We don't use your data for advertising or sell it to third parties.
3. How We Share Your Information
We Do NOT Sell Your Data
We never sell, rent, or trade your personal or financial information to third parties for marketing purposes. Your data is not our product—our service is.
Limited Sharing for Service Provision
We only share your information in these specific circumstances:
Service Providers
- • GoCardless (for Open Banking connections)
- • Supabase (for secure data storage)
- • Stripe (for payment processing)
- • Email service providers (for notifications)
All service providers are contractually bound to protect your data and only use it for providing services to us.
Legal Requirements
We may share information when required by law:
- • Court orders or legal subpoenas
- • Regulatory investigations
- • Fraud prevention and law enforcement
- • National security requirements
Business Transfers
If FinKitty is acquired or merged, your information may transfer to the new company. You would be notified of any such change and your rights would remain protected.
💡 What this means: We only share your information when absolutely necessary to provide our service or when required by law. We never share data for marketing or commercial purposes.
4. How We Protect Your Information
Encryption and Security
- • All data is encrypted in transit using TLS 1.3
- • Sensitive data is encrypted at rest using AES-256
- • Passwords are hashed using industry-standard algorithms
- • Regular security audits and penetration testing
- • Multi-factor authentication available
Access Controls
- • Role-based access controls for our team
- • Regular access reviews and revocation
- • Principle of least privilege
- • Comprehensive audit logging
Infrastructure Security
- • Data stored in secure, monitored data centers
- • Automatic security updates and patches
- • Intrusion detection and prevention systems
- • Regular backups with encryption
- • Disaster recovery procedures
Incident Response
If a security incident occurs, we will:
- • Notify affected users within 72 hours
- • Report to relevant authorities as required
- • Investigate and remediate the issue
- • Implement additional safeguards to prevent recurrence
💡 What this means: We use bank-grade security measures to protect your data. Your information is encrypted, access is strictly controlled, and we monitor for threats 24/7.
5. Your Rights and Choices
Under GDPR and UK Data Protection Law
You have the following rights regarding your personal data:
Right to Access
Request a copy of all personal data we hold about you. We'll provide this in a structured, commonly used format within 30 days.
Right to Rectification
Correct any inaccurate or incomplete personal data. You can update most information directly in your account settings.
Right to Erasure
Request deletion of your personal data. Note that some data may be retained for legal compliance or legitimate business purposes.
Right to Portability
Export your data in a machine-readable format to transfer to another service.
Right to Object
Object to processing of your data for specific purposes, including marketing communications.
Right to Withdraw Consent
Withdraw consent for any processing based on consent, though this won't affect previously lawful processing.
How to Exercise Your Rights
Contact us at privacy@finkitty.com or through your account settings. We'll respond within 30 days and verify your identity before processing requests.
💡 What this means: You're in control of your data. You can access it, correct it, export it, or delete it at any time. We make exercising these rights as simple as possible.
6. Cookies and Tracking
Essential Cookies
We use cookies that are necessary for our service to function:
- • Authentication and session management
- • Security and fraud prevention
- • Load balancing and performance
- • User preferences and settings
Analytics Cookies
We use analytics tools to understand how our service is used and improve user experience. This includes:
- • Page views and feature usage
- • Error tracking and performance monitoring
- • Aggregated usage statistics
All analytics data is anonymized and cannot be used to identify individual users.
Managing Cookies
You can control cookies through your browser settings, but disabling essential cookies may affect service functionality.
💡 What this means: We use minimal cookies necessary for our service to work and to understand how to improve it. We don't use tracking cookies for advertising purposes.
7. Data Retention
Active Accounts
While your account is active, we retain your data to provide our service and improve it over time.
Account Deletion
When you delete your account:
- • Personal data is deleted within 30 days
- • Financial data is anonymized for regulatory compliance
- • Backup copies are purged within 90 days
- • Some data may be retained longer if required by law
Legal Retention Requirements
Some financial data must be retained for up to 7 years for regulatory compliance, but this data is anonymized to protect your privacy.
💡 What this means: We don't keep your data forever. When you're no longer using our service, we delete your personal information while maintaining anonymized records only as required by law.
8. International Data Transfers
Your data is primarily processed and stored within the UK and EU. When we do transfer data internationally:
- • Transfers are only to countries with adequate data protection
- • We use appropriate safeguards like Standard Contractual Clauses
- • All transfers comply with GDPR requirements
- • You'll be notified of any changes to transfer arrangements
💡 What this means: Your data stays within secure, regulated jurisdictions. If we ever need to transfer data internationally, it's done with appropriate legal protections.
9. Children's Privacy
FinKitty is not designed for or directed at children under 18. We do not knowingly collect personal information from children. If we discover that we have collected information from a child under 18, we will delete it immediately.
If you believe a child has provided us with personal information, please contact us at privacy@finkitty.com.
💡 What this means: Our service is for adults only. We don't collect information from children and will delete any that we accidentally receive.
10. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we make changes:
- • We'll update the "Last Updated" date at the top
- • For minor changes, we'll post the updated policy on our website
- • For significant changes, we'll notify you by email
- • We'll give you 30 days' notice before major changes take effect
Your continued use of FinKitty after changes take effect means you accept the updated policy.
💡 What this means: If we change how we handle your data, we'll let you know clearly and give you time to review the changes before they take effect.
Contact Us
If you have any questions about this Privacy Policy or how we handle your data, please contact us:
Data Protection Officer: privacy@finkitty.com
General Inquiries: hello@finkitty.com
Address: FinKitty Ltd, 123 Financial Street, London EC2V 8AB, United Kingdom
Phone: +44 20 1234 5678
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe we have not handled your data appropriately. Visit ico.org.uk for more information.