Privacy Policy

Last updated: 26-Sep-2026

FinPera Inc.

What this policy applies to

This policy covers everything FinPera makes available: our website and every page on it; tools, calculators, templates, checklists and generators, wherever they appear and whatever address they are published at; articles, guides, research, reports, newsletters and other content; the application, any account, workspace or portal, and every product, module, solution and service we offer; any demonstration, preview, trial, pilot or beta; our profiles, pages, handles, posts and messages on social and third-party platforms; and any other material or communication we publish or provide.

It applies whether you browse, read, download, use, refer to, share or otherwise interact with any of it, and whether or not you have an account, are signed in, or pay us anything.

How much we collect depends on what you use. Browsing a page or using a tool without signing up generally involves far less personal data than running a workspace. Some tools and features process what you enter in your browser, and others send it to us in order to work at all - where a feature needs to send something to us, we say so at the point you use it. The sections below describe the full range; not all of it applies to every visitor.

Keep personal information out unless it is needed

FinPera is built for businesses - companies, professional firms and investors. Do not add or upload personal information about yourself or others unless your organisation's work requires it. Where it does, use the fields and features designed for it - for example, sensitive identifier fields that are encrypted and masked.

Exercise your data rights

Your own account data. You can view and export the personal data held about your account, and manage your consents, from your settings. Once you belong to no organisation, you can also close and delete your account there. This is subject to the rights available to you under applicable law.
Data an organisation controls. Where data belongs to an organisation you are part of - its workspace content, and records about you that it holds - your rights are exercised through that organisation and its administrators, who control that data and decide what is kept or deleted. Contact them directly. We act on that organisation's instructions.
Marketing emails. To stop them, use the unsubscribe link in any such email.
Anything else. For any other request - including a grievance, a nomination, a legal notice, or a suspected security or data incident - use our request form. You don't need an account.

Information Collection

Personal Information We Collect

What we collect depends on what you use. In summary:

Account and profile: name, email address, phone number, job title, profile photo, the organisations you belong to, and your roles and preferences in them
Sign-in and security: sessions, devices, sign-in history, multi-factor settings, API tokens you create, and connected accounts
Billing: subscription and plan records, invoices, transactions, tax identifiers and billing address. Card details are handled by our payment providers, not stored by us
Workspace content: documents, records and other material you or your organisation add to a workspace, which we process on behalf of the organisation that controls it (see "Our Role" below)
Marketing and enquiries: your contact record, how you reached us, and your marketing preferences
Consent and request records: your cookie choices, policy acceptances, consents, and any request you make to us
Recruitment: if you apply for a role, your application, CV and correspondence

We also collect, generate and receive information allied to these categories in the course of providing, securing and supporting the Service - for example technical, usage, device, log, communications and support information, and information derived from any of these.

How We Collect Information

Directly from you when you register, use features, submit a form, or contact us
Automatically as you use the site and application, including through cookies and similar technologies
From your organisation - an administrator or colleague may create your account or add your details
From third-party services when you connect an integration, sign in through an identity provider, or pay through a payment provider
From public and licensed sources, where a feature enriches a record you have created
Derived or inferred by us, including data our systems generate about your content in order to make features work

Information Usage

We use your information to:

Provide, operate and maintain the Service, including its tools and features
Process your transactions and manage your account
Improve the Service and develop its tools and features
Send product updates, announcements about new tools and features, and marketing communications where you have opted in to receive them. You can withdraw that at any time.
Ensure security and prevent fraud
Comply with legal obligations and regulatory requirements
Provide customer support and respond to inquiries

Information Sharing

We do NOT sell personal information to third parties

Limited Sharing Occurs With:

Service providers for hosting, database, authentication, payment processing, email delivery, AI processing, analytics, and support, each engaged on contractual terms that restrict how it may use the data
Our group companies, which help us develop, support and operate the Service
Legal authorities when required by law or court order
Potential acquirers in business transfer scenarios
Professional advisors bound by confidentiality obligations

When an organisation invites you, or you invite others

Any organisation using FinPera can invite others - its own members, or other people and organisations such as advisors, clients and investors - and can itself be invited. If you accept an invitation to join an organisation, your membership and what you do in its workspace form part of that organisation's data, handled as described under "Our Role" below. When an invitation connects two organisations, the organisation that sent it may see that it was accepted and the name of the organisation that accepted it. Once connected, each organisation sees what the other shares with it through that connection and the members assigned to it, not the rest of the other's workspace. We record which organisation's invitation led to a workspace, and when. We use that to apply a referral benefit where one is offered, and for our own records; it is not sold.

Our Role: Controller or Processor

For the information we hold about you as a user - your account, sign-in, billing, support and marketing data, and how you use the Service - FinPera is the data controller (in India, the data fiduciary). For the content you and your organisation put into a workspace - including the personal data of employees, shareholders, directors, investors and, for a professional firm, its clients and their people - the organisation that owns the workspace decides what is collected and why, and FinPera processes it on that organisation's instructions under our Data Processing Agreement. Where a professional firm records a client's data in its own workspace, the firm is our customer for that data, and the firm is responsible for the notices, authorisations and professional duties that let it hold and share it. Requests about data inside a workspace are for the organisation that controls that workspace.

Third-Party Service Providers (Sub-Processors)

We rely on a small set of established third-party providers for infrastructure (cloud hosting, database, authentication), transactional email, payment processing, AI processing, and analytics. We require each provider to process data only for the contracted service under appropriate confidentiality, security, privacy, and transfer terms. The current list of sub-processors is published at /legal/sub-processors.

AI / LLM Processing

Where a product feature requires AI to generate output, your inputs may be sent to FinPera's AI infrastructure or to third-party AI providers listed on our sub-processor page. We use commercial or enterprise API configurations where available and require providers to process data only to provide the contracted service. We do not use your content to train AI models, and we do not authorise our AI providers to train on it, unless you agree otherwise in writing. Provider retention, safety-review, abuse-monitoring, and training terms can change and can vary by provider, model, feature, endpoint, and account configuration. You should review the linked provider terms on the sub-processor page for the current provider position. If a provider materially changes its terms in a way that reduces the protections we rely on, we may change configuration, route processing to another provider, suspend the affected feature, or update this Policy. AI requests are made through our own AI gateway, which records which feature ran, for whom, and what it cost, so that usage can be metered and audited. AI features are not included on the Base plan (free of charge).

Data Security

Encryption

Industry-standard encryption for data at rest (database and file storage)
HTTPS/TLS encryption for all data in transit
Secure file storage with time-limited access links

Infrastructure Security

Hosted on enterprise-grade cloud infrastructure with industry-leading providers
Private storage architecture with access-controlled file sharing
Backups are maintained by our database and storage providers
DDoS protection provided by our infrastructure partners

Access Controls

Role-based access control (RBAC) with granular permissions
Secure authentication via industry-leading identity provider
Session management through our authentication provider
Logging of selected security-relevant events

Application Security

Secure credential storage and handling
Regular security updates and dependency monitoring
Automated checks, including dependency and secret scanning, before changes are deployed
Monitoring industry security standards and best practices

Ongoing Security Improvements

As a rapidly evolving platform, we continuously enhance our security posture through regular dependency updates, security-focused development practices, and monitoring of industry standards. We are working toward formal security certifications as we scale.

The security measures described here are for information, reflect our practices at the time of writing, and may change. Our commitments are those in the Terms of Service and the Data Processing Agreement.

Security Reporting: If you discover a security vulnerability, please report it through the legal, data and privacy request form. We take security reports seriously and investigate them using our internal triage process.

International Data Privacy Compliance

What these references mean

References in this policy to laws and frameworks - including India's Digital Personal Data Protection Act, 2023, the GDPR and the CCPA - describe how we approach privacy as a matter of good governance. They do not mean that a particular law applies to you or to us, and they do not add to our obligations beyond those that applicable law or our agreements impose.

DPDP Act, 2023 (India)

Two different situations, and they work differently. For personal data in an organisation's workspace, that organisation decides what is collected and why, and we act on its instructions. For data we hold about you directly - your login and contact details, marketing preferences, enquiries, billing records and job applications - we decide those things ourselves, and this policy explains how.

A request about data an organisation controls is for that organisation to decide, and should be made to it directly. A request about data we hold about you directly is decided by us once we have verified your identity. We may decline a request we cannot verify.

For the data we hold about you directly, our approach draws on the Act's principles:

Notice at the point of collection
Data principal rights - access, correction, erasure, grievance redressal, and nomination
Withdrawal of consent as easily as it was given
A named Grievance Officer, published below
Accountability and security safeguards
Safeguards for cross-border transfer

GDPR - as a reference point

We are not established in, and do not offer the Service to, the EU/EEA or the UK (see below). We draw on the GDPR's core principles as a reference point:

A lawful basis for processing (contract performance, legitimate interests, consent)
Data subject rights including access, rectification, erasure, and portability
Breach notification to the relevant authority where, and within the time, the law requires
Cross-border data transfers using appropriate safeguards

CCPA / CPRA (California) - as a reference point

We draw on the California Consumer Privacy Act's principles as a reference point:

Consumer rights to know, delete, and opt-out
We do not sell personal information
Non-discrimination for exercising privacy rights

Where we offer the Service, and our UK/EU position

FinPera Inc. is established in the United States. The Service is offered to customers in India, the United States, Canada, the United Arab Emirates, and Singapore.

We have no establishment, branch, office, representative, or personnel in the United Kingdom, the European Union, or the European Economic Area - no employee, contractor, or officer of FinPera Inc. is based there - so we do not process personal data in the context of the activities of an establishment in the UK or the Union under Article 3(1) of the UK GDPR or the GDPR. We also do not market or direct the Service to those territories, do not price it in pounds sterling or euro, and do not offer it to data subjects located there, so we do not consider Article 3(2) - and with it the Article 27 representative requirement under either regime - to be engaged. The Service being reachable from a country is not, by itself, an offer to that country.

We will keep this position under review and will appoint and publish a UK or EU representative here if that changes or if we are otherwise required to.

Wherever you are, you can reach us through the legal, data and privacy request form, which produces a tracked reference. Requests are handled as described under "Your Rights". You may also be able to complain to your local supervisory authority.

Compliance Status: Our practices draw on these frameworks. We do not currently hold a SOC 2, ISO 27001, or equivalent certification and we do not claim one.

Children's Data

The Service is for businesses and for users aged 18 or over. It is not directed at children, and we do not knowingly collect personal data from anyone under 18.

Our Terms require every user to be 18 or older. We do not direct advertising at children or knowingly track or profile them. How we use analytics generally is set out in our Cookie Policy, and you can switch it off.

If you believe a child's personal data is in the Service, tell us through the legal, data and privacy request form. Where it sits in an organisation's workspace, we will pass the report to that organisation, which controls that data. Where it is data we hold directly, we will take the steps we consider appropriate. Organisations that add material containing a child's personal data are responsible for having any consent the law requires.

If There Is a Data Breach

We maintain an incident-response process for suspected or confirmed personal-data breaches. On becoming aware of a breach affecting your personal data, we will:

investigate and take reasonable steps to contain and remediate it;
notify the affected customer without undue delay, with the information reasonably available to us at the time - what happened, the categories of data involved, the likely consequences, and the steps taken or proposed;
notify the relevant authority where, and within the time, the law requires; and
provide the affected customer with the information it reasonably needs to meet its own notification obligations, as our agreement with it provides.

An initial notification may be preliminary, and we may supplement it as the investigation develops. Notifying you is not, and must not be read as, an admission of fault or liability by FinPera.

Your Rights

Depending on where you are and the law that applies, you may have some or all of the following rights regarding your personal data:

Access: Request a copy of your personal data
Rectification: Correct inaccurate or incomplete information
Erasure: Request deletion, subject to records we are required to keep and to any active legal hold
Portability: Receive your data in a machine-readable format
Opt-out: Unsubscribe from marketing communications
Objection: Object to certain types of data processing
Withdraw consent: For consent-based processing activities

How to Exercise Your Rights:

Your own account data: view and export it, and manage your consents, from your settings. Once you belong to no organisation, you can also close and delete your account there.
Data an organisation controls: contact that organisation and its administrators, who decide on the request. We act on their instructions.
Marketing emails: use the unsubscribe link in any such email.
Anything else: use the data and privacy request form.

We may need to verify your identity, and your authority where you act for someone else, before acting on a request, and we may decline a request we cannot verify or that concerns data an organisation controls. Where applicable law sets a period for responding to a request, we respond within that period.

Data Retention

Active Account Data

Retained for the life of your active account to provide ongoing service

Plans With No Subscription Fee

A workspace on the Base plan never lapses through billing. It ends only through dormancy: if no member of the workspace has signed in for 12 months, access is treated as having ended on that anniversary, and the lapsed-workspace lifecycle below applies. Any sign-in by any member resets the 12 months. To apply that rule we keep the date each member was last seen.

Lapsed and Dormant Workspaces

When your access ends - a trial or complimentary period finishes, a subscription is cancelled or a payment failure is not cured, or a Base workspace goes dormant - and no paid subscription starts, what happens next depends on whether the Base plan is available for your kind of workspace.

Where the Base plan is available and your workspace was on a paid plan, we move it onto the Base plan once the notice period for the lapse has passed. The workspace stays open and your data stays where it is: nothing is deleted and no member is removed. The Base plan's limits then apply - how many people can open the workspace, how much storage it has, and which features are included - so if the workspace holds more people than the Base plan includes, the ones beyond that number cannot open it until somebody chooses a paid plan again. Their accounts, history and assignments are untouched and return in full on upgrade.

Where the Base plan is not available for your kind of workspace, or the workspace is already on the Base plan and has gone dormant, it becomes read-only: you can view and export your data for 60 days after your access ends, and we remind you before that window closes. After it closes the workspace is deactivated and can no longer be opened, but its data is not deleted: you can reactivate it exactly as you left it by choosing a plan within 30 days of deactivation. We do not delete a deactivated workspace automatically. After that reactivation window closes, the workspace is shown as closed and can only be reopened by contacting us. We may also permanently delete its content at that point - we will try to contact the owners first, using the contact details we hold - subject to the retention periods below.

Inactive Workspaces

If a workspace has not been used for a long time, we may email its owners and administrators asking them to sign in by a stated date. If nobody does, we may close it - it then follows the same steps as any closure, including a 7-day period in which any owner or administrator can cancel - and we may later permanently delete its content, as described above. A Base workspace is only treated this way after 12 months without use.

Post-Termination Retention

During the hold, read-only period and reactivation window: everything stays exactly as it was - nothing is deleted, and an owner or administrator can reopen it
After that: we may permanently delete a closed workspace's content. We will try to contact the owners first, using the contact details we hold; an owner can also ask us to delete it sooner, and we contact them to confirm before we do
Up to 8 years: Transaction records, invoices, discounts, offers, tax documents and all such records required in line with regulatory requirements - this is the longest we expect to need them, and the period may extend if regulations change
Kept for as long as we reasonably need them: your organisation's customer record with us (name, billing contact, tax identifiers, address), audit trails and security logs, consent records, and our communications with your organisation - for example for disputes, audits or security, or for as long as the law requires
Legal holds: Data subject to an active legal hold is kept until the hold is lifted

Usage, Analytics and AI Logs

Usage, diagnostic, analytics and AI request logs are retained for no longer than is necessary for the purpose they were collected for - operating, securing, supporting and improving the Service, and meeting our legal and accounting obligations - after which they are deleted or aggregated so that they no longer identify you. Retention varies by the type of record and the system that holds it.

Marketing and Consent Records

Marketing lists: Until you unsubscribe or ask us to delete your record
Consent records: Kept for as long as we may need to evidence that consent was given or withdrawn, and to meet our accountability obligations. These records are the proof that we handled your choices correctly, so they are retained even after the consent itself ends

Backups

Encrypted backups are held by our infrastructure providers on a rolling basis for operational continuity and disaster recovery, and are overwritten or erased in the ordinary course of that cycle. Data deleted from live systems may persist in a backup until the cycle turns over, and is not restored to live systems except as part of a recovery event.

What you can do from Settings, and what your organisation decides. From your settings you can see the personal data held about your account, download a copy of your account data, and manage your consents. If your account is part of an organisation's workspace, the account and the work in it belong to that organisation, and closing the account is handled by an administrator there - your settings show who to approach. Once you belong to no organisation, you can close the account yourself.

When a workspace is closed, it first goes read-only, then is deactivated, with a further window in which an owner or administrator can reactivate it. Nothing is deleted automatically during that process. We may permanently delete it once that window has passed - we will try to contact the owners first, using the contact details we hold - and you can also ask us to delete it sooner instead of waiting that out; we contact you to confirm before we do. Records we are required to keep by law, and anything under an active legal hold, survive either route.

See our Terms of Service for how closure and termination work. Requests about data in an organisation's workspace are for that organisation, which decides on them. Requests about data FinPera holds about you directly are decided by us - use the data and privacy request form.

AI and Machine Learning

FinPera is AI-native, so processing your data with AI is core to how the platform works rather than an optional extra. This section covers the privacy position; the AI Processing Notice explains in detail how we use AI on workspace data, what our masking and anonymisation controls do, and - importantly - what they cannot do.

Third-Party AI Service Providers

FinPera uses third-party AI service providers to power AI features
When you use AI features, your data may be transmitted to listed third-party providers for processing
Each AI provider operates under its own terms, privacy policy, technical controls, and retention settings
Provider terms can change; our commitments are limited to the protections we configure, contract for, and can reasonably enforce

Important: AI provider terms, retention periods, model-training exclusions, safety-review processes, and abuse-monitoring rules may change over time. We use commercially reasonable efforts to select appropriate provider configurations and to avoid authorizing external model training on customer content, but we cannot guarantee that third-party terms will remain unchanged. Review the provider links on our sub-processor page for the current terms.

FinPera's Data Practices

FinPera does not independently use your data to train AI models
We log AI usage for cost tracking, debugging, and service improvement purposes
AI interaction logs are retained as described in Data Retention above

AI Limitations and Disclaimers

AI-generated content may contain errors, inaccuracies, or "hallucinations"
All AI outputs should be reviewed by qualified professionals before use
FinPera is not responsible for decisions made based on AI-generated content
AI features are provided "as-is" without warranties of accuracy or fitness
See our Terms of Service for complete AI disclaimers and limitations of liability

Cookies and Tracking

We use cookies and similar technologies for essential operation and, where you choose, analytics and error monitoring. You can manage cookie preferences through our cookie controls and through your browser settings.

For detailed information about our cookie usage, see our Cookie Policy.

Third-Party Software

Our platform incorporates open source software and third-party services subject to their respective privacy policies and terms of service.

Updates to This Policy

FinPera may update this Policy to reflect changes in our services, providers, laws, or risk controls. The most current version is always available on this page. For material changes, we will provide notice through the platform, by email, or by another reasonable method where required by law or where we consider notice appropriate. Continued use of the Service after the effective date of an updated Policy constitutes acceptance to the extent permitted by applicable law.

Grievance Officer & Data Protection Officer

In line with India's Digital Personal Data Protection Act, 2023, you may contact our Grievance Officer about how your personal data is handled or to escalate an unresolved request:

Grievance Officer: Bhairav Kothari, Co-Founder, FinPera Inc.
Address: 2810 N Church St STE 90453, Wilmington, DE 19802, United States
Contact: Legal, data & privacy request form

The Grievance Officer acts in that capacity on behalf of FinPera Inc. and not in a personal capacity. Any claim arising from the handling of a grievance lies against FinPera Inc. alone.

Data Protection Officer: A Data Protection Officer will be appointed and published here if and when FinPera is designated a Significant Data Fiduciary or is otherwise required to appoint one. Until then, data-protection matters may be submitted through the same form.

If you are not satisfied with our response, you may have the right to complain to the Data Protection Board of India or your local supervisory authority.

Contact Information

Legal inquiries, privacy requests, data subject requests, grievances, copyright notices, and security reports: Legal, data & privacy request form

Response Time:
Where applicable law sets a period for responding to a privacy or data-rights request, we respond within that period. Other legal, security, copyright, and open-source notices are triaged and handled through the same tracked intake process.

Data Controller / Data Fiduciary (for the data described under "Our Role"):
FinPera Inc. (the United States)