Privacy Policy

1. Data controller

The data controller is Arthur Capo, sole trader registered under SIREN 937 575 876, with registered office at 47 rue Vivienne, 75002 Paris, France.

This policy covers the Finerz mobile app and the finerz.app website. Contact: support@finerz.app

2. Data we collect

We collect only what the service needs to work.

• Account: email address, internal identifier, sign-in method (Google, Apple or email) and creation date.
• Banking data, through Bridge: the name and type of your accounts, their balance, then the label, amount, date and category of your transactions. We never receive your bank login credentials: you enter them directly with your bank.
• Subscriptions: those the app detects in your transactions, and those you add yourself.
• Your Finerz subscription: plan, status, renewal dates and customer identifier with our billing provider. We never receive any card details.
• Notifications: your device push token, only if you have allowed notifications.
• Technical data: server logs, IP address, device type, app version and error reports.
• Support: the content of the messages you send us.
• Website: waitlist email address, cookie preferences and analytics data if you accept them.

3. Why we process it, and on what basis

• Creating and managing your account, detecting your subscriptions, computing your remaining budget and your bank fees: performance of our contract with you.
• Accessing your bank accounts: your explicit consent, collected by Bridge under PSD2. You can withdraw it at any time by disconnecting the bank.
• Sending you alerts before a payment is taken: your consent, given when your phone asks you to allow notifications. You can withdraw it at any time in your device settings.
• Managing your subscription and its invoicing: performance of the contract and accounting obligations.
• Securing the service, preventing abuse and fixing incidents: our legitimate interest in providing a reliable service.
• Answering your support requests: our legitimate interest in assisting you.
• Measuring website audience: your consent, through the cookie banner.

4. How long we keep it

• Account and manually added subscriptions: for as long as your account exists. Everything is deleted when you delete it.
• Banking data: for the duration of your subscription. As soon as it ends, this data is deleted automatically and your user is deleted at Bridge.
• Technical logs: kept for as long as your account exists, and deleted with it. Our hosting providers' logs and the error reports sent to our monitoring tool follow those providers' own retention periods, from a few days to a few months.
• Billing records: the subscription row kept in the app is deleted with your account. The corresponding accounting records, held by Apple and carried into our books, are kept for 10 years as French law requires.
• Support conversations: a message sent from the app creates an internal ticket containing your email address, kept for as long as handling and follow-up require. You can ask us to delete it at any time.
• Waitlist sign-up: up to 24 months, or sooner if you ask us to delete it.

5. Who else accesses your data

We do not sell any data and do not share any for advertising purposes. Your data is processed by the providers strictly necessary to the service, each bound by a data processing agreement:

• Bridge (Bankin' Engineering, France), a provider licensed and supervised by the ACPR, for read-only access to your accounts.
• Supabase Inc. (Ireland), for authentication and the database.
• Railway Corp. (Netherlands), for API hosting.
• Apple Inc., for app distribution and subscription payments.
• RevenueCat Inc. (United States), for subscription management.
• Expo / 650 Industries Inc. (United States), for push notifications.
• Sentry / Functional Software Inc. (United States), for technical error monitoring.
• Resend (United States), for transactional emails.
• GitHub / Microsoft (United States), for tracking messages sent to support from the app.
• Vercel Inc. (United States), for hosting the finerz.app website.

6. Transfers outside the European Union

Your banking data is processed in France by Bridge, and stored within the European Union at Supabase and Railway.

Some providers listed above are established in the United States. Those transfers rely on the European Commission's standard contractual clauses, supplemented where applicable by the provider's certification under the Data Privacy Framework.

7. Your rights

You have the right to access, rectify, erase, object to, restrict and port your data, as well as the right to withdraw your consent at any time and to give instructions on what happens to your data after your death.

To exercise them, write to support@finerz.app. We reply within one month.

If our answer does not satisfy you, you may refer the matter to the CNIL.

8. Deleting your account

You can delete your account at any time from the app, under Profile then Delete my account. No email request is needed.

Deletion removes your account, your banking data and your subscriptions, and deletes your user at Bridge. Only data we are legally required to keep remains, in particular the accounting records tied to your subscription.

9. Security

Traffic to and from the app is encrypted in transit, and data is encrypted at rest at our hosting providers. Access to your bank accounts is read-only: the app cannot initiate any transfer or payment.

Access to production data is restricted and logged. Despite these measures, no system is infallible: in the event of a breach posing a risk to your rights, we will inform you and notify the CNIL within the deadlines set by the GDPR.

10. Changes

This policy may be updated to reflect changes to the service or to regulations. If a change is substantial, we will tell you in the app or by email. The date shown at the top of the page is authoritative.