remote MCP engine: live·1M tokens · no card
finstat/legal
Privacy policy

FINSTAT.AI - PRIVACY POLICY

Effective Date: July 25, 2026 Version: 1.4 Organization: FINSTAT INC. Product: FinStat.ai Website: https://www.finstat.ai

TABLE OF CONTENTS

  1. Introduction
  2. Key Definitions
  3. Information We Collect
  4. How We Use Your Information
  5. AI Processing and Third-Party Services
  6. Data Sharing and Disclosure
  7. Data Security
  8. Data Retention
  9. Your Privacy Rights
  10. GDPR - European Privacy Rights
  11. CCPA - California Privacy Rights
  12. Cookies and Tracking Technologies
  13. International Data Transfers
  14. Children's Privacy
  15. Changes to This Policy
  16. Contact Us

1. INTRODUCTION

Welcome to FinStat.ai (the "Product" or "Services"), operated by FINSTAT INC. ("FinStat," "we," "us," or "our").

This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you:

Your privacy is important to us. We are committed to protecting your personal information and being transparent about our data practices. This Privacy Policy is designed to help you understand:

By using our Products or Services, you agree to the collection, use, and disclosure of your information as described in this Privacy Policy. If you do not agree, please do not use our Products or Services.

Important Notice About AI Processing

Our Products utilize artificial intelligence (AI) and machine learning technologies provided by third-party services, including OpenAI and Anthropic, to analyze and categorize financial transactions. When you upload documents or transaction data to our Products, that data may be processed by these AI services. We have configured these integrations to protect your data (see Section 5 for details).

2. KEY DEFINITIONS

"Personal Data" or "Personal Information" means any information relating to an identified or identifiable individual.

"Processing" means any operation performed on personal data, including collection, storage, use, disclosure, or deletion.

"Licensee" means an organization or individual that has subscribed to our Products under a License Agreement.

"Authorized User" means an individual authorized by a Licensee to access and use the Products.

"AI Services" means third-party artificial intelligence and machine learning services we use to provide transaction categorization and document processing, including OpenAI (ChatGPT, GPT-4), Anthropic (Claude), and xAI (Grok).

"Controller" means the entity that determines the purposes and means of processing personal data (typically the Licensee for account data).

"Processor" means the entity that processes personal data on behalf of the Controller (FinStat acts as a processor for Licensee data).

"Sub-processor" means a third-party service provider engaged by FinStat to process personal data (e.g., AI Services, cloud infrastructure providers).

3. INFORMATION WE COLLECT

We collect several categories of information when you use our Products and Services:

3.1 Information You Provide Directly

(a) Account and Identity Data

(b) Financial and Payment Data

(c) Documents and Files

(d) Communications Data

(e) Preferences and Profile Data

3.2 Information We Collect Automatically

(a) Usage and Analytics Data

(b) Technical and Device Data

(c) Authentication and Security Data

3.3 Information from Third-Party Sources

(a) Bank and Financial Institutions

(b) OAuth and SSO Providers

(c) Payment Processors

3.4 Information We Do NOT Collect

We do not knowingly collect:

4. HOW WE USE YOUR INFORMATION

We process your personal information for the following purposes:

4.1 To Provide and Maintain the Products

Lawful Basis: Performance of contract, legitimate interests

4.2 To Improve and Develop the Products

Lawful Basis: Legitimate interests, consent (where required)

4.3 For Security and Fraud Prevention

Lawful Basis: Legitimate interests, legal obligations

4.4 For Communication and Marketing

Lawful Basis: Consent, legitimate interests, performance of contract

You can opt out of marketing communications at any time by clicking "unsubscribe" in emails or contacting us at support@finstat.ai.

Lawful Basis: Legal obligations, legitimate interests

4.6 For Business Operations

Lawful Basis: Legitimate interests

5. AI PROCESSING AND THIRD-PARTY SERVICES

5.1 Artificial Intelligence Services

Our Products use third-party AI services to analyze and categorize your financial data. This is a core feature of how FinStat.ai works.

(a) AI Providers We Use:

(b) What Data Is Processed by AI Services: When you use our transaction categorization, Chart of Accounts mapping, or financial report generation features, the following data may be sent to AI Services:

(c) How We Protect Your Data with AI Services:

(d) AI Provider Data Policies: While we take steps to protect your data, please note that data sent to AI Services is subject to those providers' privacy policies and terms. We recommend reviewing:

(e) AI Provider Security and Compliance Certifications: All AI Services integrated with our Products maintain industry-leading security and compliance certifications:

These third-party certifications provide additional assurance that AI Services handling your data maintain:

For more information about AI provider security practices, see:

5.2 Other Third-Party Services

Our Products integrate with the following third-party services:

Service Purpose Data Shared Privacy Policy
WorkOS Authentication and user management Name, email, authentication credentials https://workos.com/legal/privacy
Stripe Payment processing Name, email, payment card details, billing address https://stripe.com/privacy
VULTR Cloud infrastructure hosting All data stored on our platform https://www.vultr.com/legal/privacy/
Filestack File upload and management Uploaded document files https://www.filestack.com/privacy/
Zendesk Customer support ticketing Name, email, support inquiries https://www.zendesk.com/company/agreements-and-terms/privacy-notice/

All third-party services are carefully vetted for security and privacy compliance. We require that they:

(f) FinStat's Own Model Improvement (Document Structure Only): To improve accuracy for all users, FinStat may use documents you upload to train and improve FinStat's own document-recognition and data-extraction systems — specifically, by learning the structure and format of financial documents (for example, how a particular bank's statement is laid out). FinStat does not sell your data, does not use your or your clients' personal or account information (such as names, account numbers, or login credentials) to train models, and does not expose that personal or account information to anyone outside FinStat other than the service providers listed in this Policy that are needed to operate the Services.

5.3 Data Processing Agreements

For Licensees subject to GDPR, we have Data Processing Agreements (DPAs) in place with key sub-processors, including AI Services, to ensure GDPR-compliant processing. A list of current sub-processors is available at https://www.finstat.ai/subprocessors.

5.4 Beta / Pre-Release Use

If you participate in a pre-release or "beta" version of the Services as an invited Beta Partner, your use is additionally governed by the Beta Program Terms in Section 25 of our Terms of Service. As with our generally available Services, data you upload during the Beta — including your clients' data — is used to provide and improve the Services (including learning the structure and format of financial documents, as described in Section 5(f) above), and is not sold. FinStat does not use your or your clients' personal or account information to train models and does not expose it outside FinStat except to the service providers needed to operate the Services. You may request deletion of your Beta data at any time (see Section 8, Data Retention, and Section 9, Your Privacy Rights). As a Beta Partner, you remain responsible for obtaining any client consent your professional or contractual obligations require before uploading client data, and you may anonymize client data before uploading.

6. DATA SHARING AND DISCLOSURE

We do not sell, rent, or trade your personal information to third parties for their marketing purposes.

We share your information only in the following limited circumstances:

6.1 With Service Providers and Sub-Processors

We share personal information with third-party service providers who perform services on our behalf, including:

All service providers are contractually obligated to:

We may share your information when you explicitly direct us to do so, such as:

We may disclose personal information when required by law or when we believe disclosure is necessary to:

We will notify you of legal requests for your data unless prohibited by law.

6.4 In Business Transactions

If FinStat is involved in a merger, acquisition, asset sale, financing, bankruptcy, or other business transaction, your personal information may be transferred or disclosed as part of that transaction. We will provide notice before your information is transferred and becomes subject to a different privacy policy.

6.5 With Professional Advisors

We may share personal information with professional advisors, including:

These advisors are bound by confidentiality obligations and may use data only for the purposes of advising FinStat.

6.6 Aggregated and Anonymized Data

We may share aggregated, anonymized, or de-identified data that cannot reasonably be used to identify you. For example:

This data does not identify you personally and is not subject to this Privacy Policy.

7. DATA SECURITY

7.1 Security Measures

We implement industry-standard administrative, technical, and physical safeguards to protect your personal information, including:

(a) Administrative Safeguards:

(b) Technical Safeguards:

(c) Physical Safeguards:

7.2 Payment Security

We use Stripe, a PCI-DSS Level 1 certified payment processor, to handle all payment transactions. We do not store full credit card numbers on our servers. Stripe handles payment card data securely and in compliance with PCI-DSS requirements.

7.3 Security Incident Response

In the event of a data breach or security incident that affects your personal information, we will:

7.4 Your Role in Security

While we implement robust security measures, you also play a role in protecting your data:

7.5 Limitations

No system is 100% secure. Despite our efforts, we cannot guarantee absolute security of your data. Unauthorized access, hacking, data loss, or other breaches may occur. By using our Products, you acknowledge and accept these risks.

8. DATA RETENTION

8.1 How Long We Retain Your Data

We retain your personal information for as long as necessary to:

Specific retention periods:

Data Type Retention Period Reason
Account and profile data Duration of account + 7 years after closure Legal and tax compliance
Transaction and financial data Duration of account + 7 years after closure IRS and accounting regulations
Uploaded documents Duration of account + 30 days after deletion request User access and legal requirements
Support communications 3 years Customer service and dispute resolution
Usage and analytics data 2 years (anonymized after 90 days) Product improvement
Marketing data Until consent is withdrawn or 2 years of inactivity Marketing compliance (GDPR, CAN-SPAM)
Security logs 1 year Fraud prevention and security

8.2 Data Deletion Upon Account Closure

When you close your account or request deletion of your data:

We may retain certain data for longer periods when required by law, including:

8.4 Data Deletion Requests

You may request deletion of your personal data at any time by contacting us at privacy@finstat.ai. We will honor your request within 30 days, subject to legal retention requirements. See Section 9 for details on exercising your rights.

9. YOUR PRIVACY RIGHTS

You have the following rights regarding your personal information:

9.1 Right to Access

You have the right to request access to the personal information we hold about you. You can:

We will provide your data in a structured, commonly used, and machine-readable format (e.g., CSV, JSON) within 30 days.

9.2 Right to Rectification (Correction)

If your personal information is inaccurate or incomplete, you have the right to:

We will update your information within 30 days of your request.

9.3 Right to Erasure (Deletion)

You have the right to request deletion of your personal information in certain circumstances, including:

To request deletion, contact us at privacy@finstat.ai. We will comply within 30 days, except where retention is required by law.

9.4 Right to Restriction of Processing

You have the right to request that we restrict processing of your personal information in certain circumstances, such as:

9.5 Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit that data to another service provider. This right applies when:

You can export your data directly from your account dashboard or request a data export at privacy@finstat.ai.

9.6 Right to Object

You have the right to object to processing of your personal information when processing is based on legitimate interests or for direct marketing purposes.

To object, contact us at privacy@finstat.ai. For marketing objections, click "unsubscribe" in any marketing email.

Where processing is based on your consent, you have the right to withdraw consent at any time. Withdrawal does not affect the lawfulness of processing conducted before withdrawal.

9.8 Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority if you believe we have violated your privacy rights. In the United States, you may contact:

For EU/EEA residents, contact your local data protection authority: https://www.edpb.europa.eu/about-edpb/about-edpb/members_en

9.9 How to Exercise Your Rights

To exercise any of the rights above:

  1. Email us: privacy@finstat.ai
  2. Include: Your name, email address, account information (if applicable), and a description of your request
  3. Verification: We may ask for proof of identity to verify your request (to prevent unauthorized access)

We will respond to your request within 30 days. If your request is complex or we receive multiple requests, we may extend the response time by an additional 60 days (we will notify you of any extension).

10. GDPR - EUROPEAN PRIVACY RIGHTS

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR).

We process your personal data under the following lawful bases:

Processing Activity Legal Basis
Providing the Products and Services Performance of contract (our Terms of Service)
Processing financial data and transactions Performance of contract
Sending transactional emails Performance of contract
Improving and developing the Products Legitimate interests (product improvement)
Security and fraud prevention Legitimate interests (security and safety)
Usage analytics (in-product) Legitimate interests (business operations)
Marketing communications Consent (you can opt out anytime)
Compliance with legal obligations Legal obligation (tax, accounting, law enforcement)

10.2 International Data Transfers

Our servers and AI Services are primarily located in the United States. If you are located in the EEA, UK, or Switzerland, your personal data will be transferred to the US, which has not received an "adequacy decision" from the European Commission.

To protect your data, we rely on the following safeguards:

A copy of our Standard Contractual Clauses is available upon request at privacy@finstat.ai.

10.3 Controller vs. Processor Roles

If you have questions about how your organization (Licensee) handles your data, please contact your organization's privacy or HR team.

10.4 Data Protection Officer

For GDPR-related inquiries, you may contact our Data Protection Officer (DPO) at:

11. CCPA - CALIFORNIA PRIVACY RIGHTS

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA).

11.1 Categories of Personal Information We Collect

Under CCPA, we collect the following categories of personal information (refer to Section 3 for details):

CCPA Category Examples from Our Collection
Identifiers Name, email, IP address, username
Financial Information Bank account details, payment card information, transaction data
Commercial Information Subscription history, purchase records, payment history
Internet or Electronic Activity Browsing history, usage data, clicks, interactions
Geolocation Data IP-based approximate location (city/state level)
Professional Information Job title, company name (if provided)
Inferences Preferences, categorization patterns, product usage insights

We do not collect sensitive personal information such as Social Security numbers, driver's license numbers, precise geolocation, race, ethnicity, health data, or sexual orientation (except to the extent contained in documents you voluntarily upload).

11.2 Sources of Personal Information

We collect personal information from:

11.3 Purposes for Collecting Personal Information

See Section 4 for detailed purposes. In summary:

11.4 Personal Information We Disclose

We disclose personal information to the following categories of third parties (see Section 6 for details):

11.5 We Do Not "Sell" or "Share" Personal Information

FinStat does not sell or share your personal information for monetary consideration or cross-context behavioral advertising.

We may share anonymized, aggregated data that cannot identify you, but this is not considered a "sale" under CCPA.

11.6 Your CCPA Rights

California residents have the following rights:

(a) Right to Know: Request disclosure of:

(b) Right to Delete: Request deletion of your personal information (subject to legal exceptions)

(c) Right to Correct: Request correction of inaccurate personal information

(d) Right to Opt Out of Sales/Sharing: Not applicable (we do not sell or share personal information)

(e) Right to Limit Use of Sensitive Personal Information: Not applicable (we do not use sensitive personal information for purposes beyond CCPA-permitted uses)

(f) Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights

11.7 How to Exercise Your CCPA Rights

To exercise your rights:

  1. Email us: privacy@finstat.ai
  2. Call us (toll-free): 1-800-614-1423
  3. Include: Your name, email, account information (if applicable), and request details

Verification: We will verify your identity before fulfilling your request (to prevent unauthorized access). We may ask for:

Response Time: We will respond within 45 days. For complex requests, we may extend by an additional 45 days (with notice).

Authorized Agents: You may designate an authorized agent to make requests on your behalf. The agent must provide proof of authorization (e.g., power of attorney).

11.8 California "Shine the Light" Law

Under California Civil Code Section 1798.83, California residents may request information about our disclosure of personal information to third parties for direct marketing purposes. We do not share personal information with third parties for their direct marketing purposes.

12. COOKIES AND TRACKING TECHNOLOGIES

12.1 What Are Cookies?

Cookies are small text files stored on your device when you visit a website. They help websites remember your preferences, authenticate your identity, and track usage for analytics.

12.2 Types of Cookies We Use

Cookie Type Purpose Duration Can You Disable?
Necessary Cookies Essential for login, security, and site functionality (e.g., session management, authentication) Session or up to 1 year No (site won't work properly without them)
Functionality Cookies Remember your preferences (e.g., language, theme, account settings) Up to 1 year Yes (but may affect user experience)
First-Party Analytics Cookie (_fs_vid) Anonymous visitor identifier for product research, security, fraud prevention (including free-trial abuse detection), quality assurance, and marketing attribution (including UTM parameters). Stored in FinStat's own database; not shared with advertising networks Up to 2 years Yes (via browser cookie controls; site remains usable)

We DO NOT use:

During beta we operate a first-party attribution warehouse that may record IP address, user-agent, approximate IP-based location, pages viewed, UTM parameters, and (after sign-in) a link from the visitor cookie to your authenticated account for security and research purposes. See also Section 3 (Information We Collect) and Section 4 (How We Use Your Information).

12.3 Third-Party Cookies

Our website and Products may include cookies from third-party services:

12.4 How to Manage Cookies

(a) Browser Settings: Most browsers allow you to:

Instructions for popular browsers:

(b) Cookie Consent Manager: When you first visit our website, you may see a cookie consent banner. You can:

You can update your cookie preferences at any time by clicking the "Cookie Settings" link in the footer of our website.

Note: Disabling necessary cookies may affect site functionality (e.g., you may not be able to log in).

12.5 Do Not Track (DNT)

Some browsers offer a "Do Not Track" (DNT) signal. We do not currently respond to DNT signals, as there is no industry-wide standard for how to interpret them. However, you can control cookies and tracking through browser settings as described above.

13. INTERNATIONAL DATA TRANSFERS

13.1 Where Your Data Is Stored

Our primary data storage and processing facilities are located in the United States. When you use our Products, your personal information may be transferred to, stored in, and processed in the US.

Additionally, our sub-processors (AI Services, cloud hosting, etc.) may store or process data in other countries, including:

13.2 Safeguards for International Transfers

We implement appropriate safeguards to protect your data when it is transferred internationally:

(a) For EEA, UK, and Switzerland residents:

(b) For all users:

13.3 Questions About International Transfers

If you have questions or concerns about how your data is transferred internationally, contact us at privacy@finstat.ai.

14. CHILDREN'S PRIVACY

14.1 Age Restriction

Our Products and Services are not intended for children under 13 years of age (or the applicable age of consent in your jurisdiction, such as 16 in the EU).

We do not knowingly collect personal information from children. If you are under 13 (or the applicable age in your jurisdiction), do not use our Products or provide any personal information to us.

If we discover that we have collected personal information from a child without parental consent, we will:

14.3 Parents and Guardians

If you believe your child has provided personal information to us without your consent, please contact us immediately at privacy@finstat.ai. We will investigate and take appropriate action.

15. CHANGES TO THIS PRIVACY POLICY

15.1 Updates

We may update this Privacy Policy from time to time to reflect:

When we make changes, we will:

15.2 Material Changes

For material changes that significantly affect your rights or how we process your data, we will:

Material changes may include:

15.3 Acceptance of Changes

By continuing to use our Products or Services after changes take effect, you agree to the revised Privacy Policy. If you do not agree to the changes, you may:

15.4 Prior Versions

We will maintain prior versions of this Privacy Policy for reference. You can request previous versions by contacting us at privacy@finstat.ai.

16. CONTACT US

16.1 Privacy Inquiries

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, contact us:

Email: privacy@finstat.ai Data Protection Officer: dpo@finstat.ai Support: support@finstat.ai Phone (toll-free): 1-800-614-1423

Mailing Address: FINSTAT INC. Attn: Privacy Team c/o REPUBLIC REGISTERED AGENT LLC 898 South State Street, Suite 310 Orem, Utah 84097 United States of America

16.2 Response Time

We aim to respond to all privacy inquiries within 30 days. For complex requests or GDPR/CCPA data requests, we may extend the response time by an additional 30-60 days (we will notify you of any extension).

16.3 Complaints and Disputes

If you have a complaint about our privacy practices:

  1. Contact us first: We want to resolve your concerns directly
  2. Supervisory Authority: If you are not satisfied with our response, you may lodge a complaint with a data protection authority (see Section 9.8 or 10.5)

16.4 Business Inquiries

For business-related inquiries (partnerships, vendor relationships, media requests), contact:

General Inquiries: info@finstat.ai Business Development: business@finstat.ai Media/Press: press@finstat.ai

APPENDIX: SUMMARY OF KEY POINTS

This summary provides a quick overview of our privacy practices. For complete details, please read the full Privacy Policy above.

Topic Key Points
What We Collect Name, email, financial data, uploaded documents, COA structures, report configurations, usage data, device/technical data
How We Use It Provide Products, AI categorization, COA mapping, financial report generation, improve features, security, support, legal compliance
AI Processing We use OpenAI, Anthropic, and xAI (Grok) AI services to categorize transactions, map to Chart of Accounts, and generate financial reports. Data is encrypted and not used to train third-party models. AI providers maintain SOC 2, ISO, GDPR, and CCPA certifications.
Data Sharing We share data with service providers (AI, hosting, payment) but DO NOT sell your data.
Your Rights Access, correct, delete, export, object to processing, withdraw consent
GDPR (EU) Legal basis: contract performance, legitimate interests, consent. Standard Contractual Clauses for US transfers.
CCPA (California) Right to know, delete, correct. We do NOT sell or share personal information.
Security Encryption, access controls, SOC 2 certified hosting, PCI-DSS payment processing
Retention Account data: 7 years after closure (tax/legal compliance). Marketing: until opt-out or 2 years inactivity.
Cookies Necessary (required), Functionality (preferences). NO third-party analytics or advertising cookies.
Children Not intended for users under 13. We do not knowingly collect children's data.
Changes We will notify you of material changes with 30 days' notice.
Contact privacy@finstat.ai or 1-800-614-1423

Thank you for trusting FinStat.ai with your financial data. Your privacy is our priority.

END OF PRIVACY POLICY

Document Version: 1.3 Effective Date: July 11, 2026 Organization: FINSTAT INC.