Global Privacy Notice

Who is responsible

The intended controller is [LEGAL_ENTITY_NAME], [REGISTERED_ADDRESS]. The privacy contact is [PRIVACY_CONTACT]. These details must be completed before external invitations.

Information processed

Account data includes name, invited email, authentication identifiers, session and MFA metadata, workspace membership and security audit events.

Financial data may include accounts, balances, ledger entries, trades, fees, FX records, tax records, statement-derived rows, housing scenarios, reconciliation results, corrections, exports and backups. Public-data requests may include instrument symbols and provider responses.

Purposes and legal-basis candidates

Information is processed to authenticate users, isolate workspaces, import and reconcile records, perform requested calculations, generate exports and backups, secure the service, respond to requests and maintain evidence of changes.

Contract necessity, compliance with law and legitimate interests are drafting candidates only. Consent is used only where the specific activity legally requires it; optional consent must not be bundled with core service access.

Sources

Information comes from the user, invited workspace administration, application security events and configured public-data providers. The application does not currently connect to bank accounts or collect bank login credentials.

Recipients and service providers

The current local build stores its primary financial database and managed backups on the user's computer. A hosted deployment may use providers listed in the current Subprocessor and International Transfer List.

Personal financial records are not supplied to the Financial MCP market-data gateway or to the optional AI evidence layer under the current enforced design.

International processing

Hosting, authentication, email, support or AI services may create cross-border processing. The actual regions and transfer mechanisms are [DATA_HOSTING_REGION] and [TRANSFER_MECHANISM]. No claim of data localization is made until deployment is selected and verified.

Retention

Retention follows the documented schedule and applicable legal requirements. Current local records remain until corrected, reversed, archived or the database is removed; managed backups remain until separately deleted.

Final hosted retention periods are [RETENTION_PERIOD] and must be configured before beta activation.

Security

Controls include invitation-only access, password and MFA support, workspace scoping, security headers, validation, redacted operational errors, audit events and verified backups.

The current SQLite database and managed backups are not encrypted by FinPosition at the application layer. Local storage does not eliminate device, operating-system, malware or backup risk.

Your choices and rights

Depending on applicable law, you may request access, correction, export, deletion, restriction, objection, consent withdrawal or complaint review. Some requests may be limited by security, legal or record-preservation requirements.

Use [PRIVACY_CONTACT]. Identity verification and response timing will follow the applicable jurisdiction-specific procedure.

Children

The closed beta is not intended for minors and does not knowingly invite them. The final age threshold requires a jurisdiction decision.

Changes

Activated notices will carry a version and effective date. Material changes will be communicated in a manner appropriate to the change and applicable law.