Privacy Policy

We process bank statements and the transactions inside them so you can see, search, and export your own financial data. You own your data. We don't sell it, we don't train models on it, and we don't share it with anyone you haven't authorized.

We hold your data only as long as you keep your account active (plus a short period after deletion for backups and legal reasons). You can export or delete it at any time. If you're in India, the EU/UK, or California, you have additional rights described below.

This summary is not the legal version — it's a guide. The full sections below are the authoritative text.

This Privacy Policy describes how [COMPANY NAME, INC.], a company incorporated in [STATE OF INCORPORATION], United States, with its registered address at [REGISTERED ADDRESS] (“FinOpsBricks,” “we,” “us,” or “our”), collects, uses, and shares personal data through the website statements.finopsbricks.com and related services (the “Service”).

We are the “data controller” (GDPR), “data fiduciary” (DPDP), or “business” (CCPA) for personal data we process about you, except where we act as a processor on behalf of your organization (e.g., when your employer has a paid account and you are an end user).

• Provide the Service: parse statements, store transactions, run rules, render dashboards, and export data on your instruction.
• Account and billing: authenticate you, manage organization membership, charge credits, and send receipts.
• Improve the Service: monitor performance, debug errors, and improve parser coverage. We use aggregated and de-identified data for this — never your individual transactions to train models or for any other purpose.
• Communicate with you: send transactional emails (account, billing, security), and — only if you've opted in — product updates.
• Security and fraud prevention: detect abuse, enforce limits, and protect the Service.
• Comply with law: respond to legal requests and meet regulatory obligations.

We do not: sell your data, share it with advertisers, use it to train third-party machine-learning models, or use it for any purpose unrelated to providing the Service to you.

Depending on the activity and where you live, we rely on one or more of:

• Contract: to provide the Service you signed up for.
• Consent: where required (e.g., marketing emails, certain cookies, DPDP). You can withdraw consent at any time.
• Legitimate interests: to keep the Service secure, prevent abuse, debug errors, and improve features — balanced against your rights.
• Legal obligation: to comply with laws applicable to us.

We share personal data only with:

• Subprocessors we use to run the Service (see section 6).
• Other members of your organization — anyone invited to your org account can see the data in that org, by design.
• Authorities, when required by valid legal process. We will, where lawful, notify you first.
• Acquirers, in the event of a merger, acquisition, or sale of assets — under confidentiality and continuity-of-protection commitments.

We never sell or rent personal data, and we do not share it with advertisers.

We rely on a small number of vendors to operate the Service:

• Hosting & infrastructure: AWS / cloud providers (United States and India regions)
• Database: managed PostgreSQL on the same cloud provider
• Email delivery: transactional email provider for receipts, password resets, etc.
• Error monitoring: Sentry (for crash reports and error context — we scrub financial values where feasible)
• Analytics: privacy-preserving product analytics (no third-party advertising trackers)
• Payments: card and UPI processing via Stripe / Razorpay or equivalent
• Authentication: Google OAuth (only if you choose Google sign-in)

A current, named list of subprocessors is available on request from [[email protected]]. Customers can subscribe to be notified before we add a new subprocessor that processes their data.

Personal data is stored on cloud infrastructure in the United States and/or India depending on your account region. Because we are a US company, data may be transferred to, accessed from, or processed in the United States.

For users in the European Economic Area, United Kingdom, or India, this means your data may leave your home jurisdiction. We rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission for EU/UK transfers, plus supplementary measures (encryption in transit and at rest).
• Contractual safeguards with subprocessors that bind them to comparable protections.
• Your explicit consent obtained at sign-up, where DPDP or local law requires it.

• Account data: while your account is active, plus up to 90 days after deletion for backups and account-recovery windows.
• Statements and transactions: until you delete them, or until your account is deleted plus the same 90-day window. You can delete individual statements at any time.
• Billing records: up to 7 years, where required by tax/accounting law in the United States.
• Support correspondence: up to 3 years.
• Server and security logs: typically 30–90 days.

We take engineering and operational measures to protect your data, including:

• Encryption in transit (TLS 1.2+) and at rest (AES-256)
• Strict authentication and least-privilege access for our team
• Multi-tenant data isolation enforced at the database query layer
• Regular dependency patching and security review of code changes
• Activity logs of administrative actions

No system is perfectly secure. If we become aware of a breach affecting your personal data, we will notify you and the relevant authorities as required by law (e.g., within 72 hours for GDPR, and to the Data Protection Board of India for DPDP).

Regardless of where you live, you can:

• Access the data we hold about you (most of it is visible in the app; for the rest, email us).
• Correct inaccurate data — either yourself in the app or by writing to us.
• Delete your account and the data inside it.
• Export your transactions and statements in standard formats.
• Withdraw consent at any time — note that this may limit what we can do for you.

To exercise these rights, write to [[email protected]]. We will respond within 30 days (or sooner where the law requires).

If you are in India, this section applies to you in addition to the rest of this policy. For the purposes of the DPDP Act, 2023, we are a Data Fiduciary and you are a Data Principal.

If you are in the European Economic Area, the United Kingdom, or Switzerland, this section applies to you in addition to the rest of this policy.

If you are a California resident, this section applies to you in addition to the rest of this policy.

We use a small set of cookies and similar technologies:

• Strictly necessary: session and authentication cookies (you can't opt out — the Service won't work without them).
• Functional: preferences like theme, currency, and last-used filters.
• Analytics: privacy-preserving product analytics to understand which features get used. No third-party advertising cookies.

You can clear or block cookies from your browser at any time.

The Service is not intended for individuals under 18. We do not knowingly collect data from children. If you believe a child has provided us personal data, contact us and we will delete it.

We may update this policy from time to time. When we make material changes, we will update the “Last updated” date at the top and, where required by law, notify you by email or in-app notice before the change takes effect. Your continued use of the Service after the effective date constitutes acceptance.

For any privacy question, request, or grievance, write to:

See our Terms of Service for the contract governing your use of the Service.