Security and your data

What happens to your statement

1. You upload a PDF or CSV statement over an encrypted connection.
2. Our servers read the transactions and build your report.
3. The statement file is kept for 30 days after upload, so a report can be checked or regenerated, then deleted automatically. You can delete it sooner by deleting your account.
4. Your report keeps the figures and summaries worked out from the statement, such as totals, categories and the names of your main sources of income, but not the statement file or its transactions. Reports made before 1 October 2026 also list the five largest payments. Reports stay in your account until you delete it, so you can compare months.

How it is protected

• In transit: every connection to Fincharta uses HTTPS (TLS).
• At rest: our database and file storage (Supabase) encrypt everything with AES-256. Your data is stored in the UK (London).
• Your account only: every request is checked on our servers against your signed-in account, so no customer can open another customer's reports or files.
• Sign-in: handled by Clerk. We never see or store your password, and you can sign in with Google.
• Payments: handled by Stripe. Card numbers never reach our servers.
• Uploads: only PDF and CSV files are accepted, with size and rate limits.
• Report fingerprints: each report is given a SHA-256 fingerprint when it is created, so a later change to it can be detected.

AI and your data

Plain-English summaries and Ask Finch answers are written by Anthropic's Claude. If we can't read your file automatically, we'll ask your permission before sending it to our AI provider to read. Otherwise, the AI only sees summary figures with names replaced by labels: customers and suppliers appear as "Customer A", "Customer B" and so on, and the names are put back only when the answer reaches you. Your data is not used to train any AI model, ours or anyone else's.

Who else handles your data

A small number of providers help us run the service, each under a written contract: Supabase (database and storage), Vercel (hosting), Clerk (sign-in), Stripe (payments), Anthropic (AI summaries), Resend (email), Plausible (cookie-free page counts) and Sentry (error reports). What each one receives and where is set out in section 5 of our privacy policy. We never sell your data or share it with advertisers or credit agencies.

Deleting your data

In the portal, go to Settings → Danger zone → Delete my account. When you confirm, we:

• cancel any paid plan, so you are not charged again;
• delete your stored statement files, reports, upcoming bills, budgets and team access;
• delete your sign-in account.

This happens straight away and cannot be undone, so download any reports you want to keep first. Copies in our encrypted backups are removed within 90 days. Stripe keeps billing records for 7 years because UK tax law requires it.

Cancelling a paid plan on its own does not delete anything: your account moves to the free plan and your reports stay. If you would rather we handle the deletion, or you can't sign in, email privacy@fincharta.com from your account's email address.

ICO registration and your rights

Fincharta Limited is registered with the Information Commissioner's Office as a data controller, registration number ZB985385.

Under UK GDPR you can ask for a copy of your data, have it corrected or deleted, restrict or object to how we use it, and take it elsewhere. Email privacy@fincharta.com and we will reply within 30 days. If you are unhappy with how we handled your data, you can complain to the ICO at ico.org.uk. Full details are in our privacy policy.

Reporting a security problem

If you think you have found a security weakness in Fincharta, please email security@fincharta.com with the details and how to reproduce it. Please don't access other people's data, change or delete anything, or disrupt the service while looking.