Privacy Policy

This is the privacy policy for Fincharta, a service operated by Fincharta Limited (Company No. 16401198), registered office 124 City Road, London, EC1V 2NX ("we", "us", "Fincharta"). We are the data controller for the personal information described in this policy.

We take your privacy seriously. This policy explains what we collect, why, who we share it with, how long we keep it, and the rights you have over your data. We have tried to write it in plain English.

1. Who this policy applies to

• Visitors to our website at fincharta.com and users of our portal at app.fincharta.com
• Anyone who creates an account on our portal
• Anyone who uploads bank statement data for analysis
• Anyone who emails hello@fincharta.com or otherwise contacts us

2. What we collect

2.1 Information you give us directly

When you create an account: email address (sign-in and service emails), name (optional), business name and industry classification (used to format reports), authentication credentials (managed by Clerk; we do not store your password).

When you upload a bank statement: the PDF or CSV file you upload, the transactions extracted (date, amount, description, balance), any categorisation or annotation you provide.

When you contact us: contents of your message and any attachments, your email address.

2.2 Information collected automatically

IP address (rate limiting and security), browser type and version (compatibility), approximate location based on IP (currency defaults; no precise geolocation stored), pages visited and actions taken on the service (product improvement and security monitoring), timestamps of activity.

We do not use behavioural advertising trackers. We do not sell, share, or rent personal information to advertisers.

2.3 Information from third parties

From Stripe (our payment processor): billing email, payment method type — we never see your card number. From Clerk (our authentication provider): your verified email and authentication metadata.

2.4 If a partner referred you

Some people come to Fincharta through a partner, such as their accountant or bookkeeper. If you sign up through a partner's link or enter their referral code, we record which partner referred you and when you signed up, so we can credit them and work out what we owe them. Partners see only totals across everyone they have referred: how many signed up, how many uploaded a statement, how many pay, and the commission they are owed. They never see your name, your reports, your figures or your transactions. Partners who use Fincharta for their own clients must only upload a client's statement with that client's permission.

3. Why we collect it (lawful basis)

UK GDPR requires us to identify a "lawful basis" for each type of processing. Ours are:

You have the right to object to processing based on legitimate interests. See section 8.

4. Sensitive financial data

Bank statement data is sensitive. We treat it as such:

• We process bank statements only to produce the reports you request and to operate features you choose to use
• We do not use your transaction data to train or improve any AI model, ours or any third party's
• If we can't read your file automatically, we'll ask your permission before sending it to our AI provider to read. Otherwise, the AI only sees summary figures with names replaced by labels.
• We do not share your transaction data with credit reference agencies, advertising networks, or anyone not strictly necessary to deliver the service
• Bank statement files are encrypted at rest and in transit, and deleted automatically 30 days after upload (or straight away, if you delete your account). Your reports keep the figures and summaries worked out from them, including the names of your main income sources, but not the files or their transactions (reports made before 1 October 2026 also list the five largest payments)
• Our employees do not access your transaction data unless you specifically grant access for support (e.g., when responding to a support ticket where you have shared a report ID)

5. Who we share data with (data processors)

We use a small number of carefully selected third-party services. Each one is a "data processor" — they process data on our instructions, only for the purposes we tell them to, under written contracts.

If we add a new processor, we update this list before they begin processing your data. We do not transfer personal data outside the UK or EEA except to the providers listed above, under appropriate safeguards (UK Standard Contractual Clauses or UK Adequacy Regulations).

6. How long we keep it

Backup copies are deleted within 90 days of deletion from our live systems. See our security page for how to delete your account.

7. Security

• Encryption in transit — all data flows over HTTPS/TLS 1.2+
• Encryption at rest — Supabase encrypts all stored data with AES-256
• Authentication and access control — Clerk handles password hashing (bcrypt) and session security; every request is checked on our servers against your signed-in account, so no customer can read another customer's data
• Network isolation — application services communicate over private networks where possible
• Vulnerability management — we apply security patches promptly. Report a weakness to security@fincharta.com
• Limited employee access — only with two-factor authentication, only when strictly necessary for support
• Incident response — documented response plan; if a breach risks your rights we will notify you and the ICO within 72 hours as required by UK GDPR

8. Your rights

UK GDPR gives you several rights over your data. Exercise any of them by emailing privacy@fincharta.com.

• Right of access — copy of all personal data we hold (we respond within 30 days)
• Right to rectification — correct inaccurate or incomplete data
• Right to erasure ("right to be forgotten") — delete your data, unless we have a legal obligation to keep it. You can do this yourself in Settings → Danger zone → Delete my account
• Right to data portability — your data in machine-readable format (CSV/JSON). You can also download your reports as CSV or PDF in the portal
• Right to object — object to processing based on legitimate interests
• Right to restrict processing — pause processing while a dispute is resolved
• Right to withdraw consent — for marketing emails, anytime
• Right not to be subject to automated decisions — we do not make automated decisions with legal or similarly significant effects about you
• Right to complain — to the ICO. See section 11.

We may need to verify your identity before fulfilling a rights request, to make sure we are not giving someone else's data away.

9. Cookies and tracking

See our separate Cookie Policy. In short: we use cookies necessary for the service to work (authentication, security, and remembering your cookie choice), plus one optional referral cookie that we set only if you agree to it. We do not use advertising cookies, tracking pixels, or third-party behavioural advertising.

10. Children's data

Fincharta is not directed at, or intended for, children under 18. We do not knowingly collect data from anyone under 18. If you believe we have collected such data, please email privacy@fincharta.com and we will delete it.

11. Complaints

If you are unhappy with how we have handled your data, please contact us first at privacy@fincharta.com. We aim to resolve complaints within 30 days.

You also have the right to complain to the UK supervisory authority:

Our ICO registration number is ZB985385.

12. Changes to this policy

We may update this policy from time to time. When we do, we will post the new version at this URL, update the "Last updated" date at the top, and email you about material changes at least 30 days before they take effect.

13. Contact us

For privacy questions or to exercise your rights:

• Email: privacy@fincharta.com
• Post: Privacy Officer, Fincharta Limited, 124 City Road, London, EC1V 2NX

For all other questions: hello@fincharta.com