Effective from: 21 August 2026
Version: 1.0
This is an English translation of the Polish-language policy. In case of any discrepancy between the language versions, the Polish version prevails.
Dear User,
we make every effort to ensure the security and confidentiality of your personal data — both when you visit our service, register an account and use our services, and when you contact us by e-mail. We act in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter: “GDPR”).
Below, in a question-and-answer format, we present the most important information about why, on what basis and for how long we process your data, who may have access to it and what rights you have.
The controller of your personal data is Jakub Karwowski, carrying out unregistered business activity (działalność nierejestrowana), address: ul. Marysińska 88A/27, 91-850 Łódź, Poland (hereinafter: “Controller”, “we”).
For all matters concerning personal data you can contact us at: help@finantly.com.
The Service is available at finantly.com (hereinafter: the “Service”). The Service is intended for adults (persons who are at least 18 years old).
Most of the data you provide yourself:
Some data is collected automatically while you use the Service (e.g. IP address, information about your browser and system) — to the extent necessary for operation, security and correct settlement of the service (see the sections on cookies, geolocation and logs).
1. Setting up and maintaining the account and providing the services (registration, use of application features, subscription handling)
2. Processing payments and subscriptions (accepting payments, renewals, refunds, controlling access to paid features)
3. Automatic categorisation and data-import feature (AI) — suggesting transaction categories and, where you use it, AI-assisted import of statements/CSV files
4. Ensuring the security of the Service and keeping event logs
5. Fulfilling legal obligations (settlements, documentation, data protection)
6. Establishing, pursuing and defending claims
7. Handling correspondence and support requests (replies to questions sent to our e-mail and handling requests submitted through the in-app form)
8. First-party marketing / newsletter (if you consent)
9. Collecting feedback about the Service (voluntary in-app feedback form)
10. Service usage analytics (Google Analytics — visit statistics, in-app journeys and the effectiveness of our promotional activities)
11. Establishing the acquisition source of an account (recording which channel brought you to the Service — e.g. a newsletter link or a specific campaign)
utm_source, utm_medium, utm_campaign, utm_term, utm_content), the domain only of the page you came from (never the address of a specific page) and the address of the first page you visited with us. This data contains no information about your activity outside our Service. Until registration we keep it solely in your browser's session storage — it disappears when you close the tab. When you create an account we store it once alongside your account.Remember: we process data for as long as necessary to achieve the above purposes, unless you submit an effective request for deletion and the law does not require us to retain it (e.g. settlement documentation). After deletion, data may temporarily remain in backups. We maintain backups in two forms: automated daily snapshots taken by our database hosting provider and retained for up to 8 days, and our own encrypted copies — daily copies retained for 30 days and monthly copies retained for 12 months. After these periods the copies are permanently deleted. Backups are not used for ongoing processing, and if a backup is restored we re-apply any deletion requests previously carried out.
We use trusted service providers who process data solely on our instructions and under concluded data-processing agreements. Recipients may include:
| Provider | Role | Scope of data |
|---|---|---|
| MongoDB Atlas (MongoDB, Inc.) | Database hosting | All account data and data entered in the application |
| Render (Render Services, Inc.) | Application/server hosting | Data transmitted as part of operating the service |
| Cloudflare (Cloudflare, Inc.) | Network layer of the Service (CDN, protection against attacks) | IP address, browser/device information and data transmitted in traffic to the Service |
| Polar (payment operator — Merchant of Record) | Payment and subscription handling, seller towards the customer | First and last name, e-mail address, IP address, subscription and payment data (no card data passed to us) |
| Google (Google Ireland/LLC) | Login via Google and — only after you give consent — Service usage analytics (Google Analytics) | E-mail address and Google account data used for login; for analytics: a pseudonymous identifier, IP address, browser and device information, visited addresses and events in the Service |
| Brevo (Brevo SAS, France) | Sending transactional e-mail messages (verification, password reset, etc.) | E-mail address, content of transactional messages |
| Anthropic (Anthropic PBC) | AI service recognising the structure of the imported file | Column statistics (including header names), the first and last lines of the file and a sample of transaction rows, which may contain dates, amounts, payment descriptions/titles, counterparties, balances and statement header/footer details (e.g. account number) |
| Frankfurter (public exchange-rate API) | Fetching currency exchange rates | No personal data (rate queries) |
| Yahoo Finance | Fetching and searching instrument prices | Symbols/tickers and the instrument search phrase you enter (no identifying data) |
| Have I Been Pwned | Checking whether a password has leaked | Only a pseudonymised partial password hash (k-anonymity model) |
Your data may also be disclosed to authorised public authorities where required by law.
Some of our providers are established or process data on servers outside the EEA (in particular in the United States): Anthropic, Polar, Google and Cloudflare.
In such cases the transfer takes place under mechanisms provided for in the GDPR, in particular standard contractual clauses approved by the European Commission (Art. 46(2)(c) GDPR) or other appropriate bases (e.g. adequacy decisions). You can find more information in those providers’ privacy policies.
Hosting of the database (MongoDB Atlas) and the application (Render) is configured in the European Union region (Frankfurt). This means your core data (account data and data entered in the application) is stored and processed within the EEA. Outside the EEA, only data necessary for the operation of the services listed above (Anthropic, Polar, Google, Cloudflare) is transferred — on the basis of standard contractual clauses or other appropriate GDPR mechanisms.
In the Service we use cookies that are strictly necessary for the operation of the application and your security, and — only with your consent — analytics cookies. We do not use marketing or advertising cookies (e.g. the Facebook Pixel) and we do not share data from the Service with advertising networks.
On your first visit you will see a banner where you decide about analytics. Until you give consent, the Google Analytics script is not loaded at all and no analytics cookies are stored on your device. We remember your choice in your browser's local storage and you can change it at any time in Settings → Privacy and consents. After you withdraw consent we disable analytics and delete its cookies.
Strictly necessary cookies — no consent required:
| Cookie | Purpose | Lifetime |
|---|---|---|
accessToken | Maintaining the logged-in session | 15 minutes |
refreshToken | Renewing the session without re-login | 7 days |
csrfToken | Protection against CSRF attacks | 7 days |
| Google cookies | Handling login via Google | per Google’s rules |
Analytics cookies — stored only after you give consent:
| Cookie | Purpose | Lifetime |
|---|---|---|
_ga | Distinguishing users in Google Analytics | 2 years |
_ga_* | Maintaining session state in Google Analytics | 2 years |
The necessary cookies are set by us; Google cookies appear when you use Google login. You can also manage cookies in your browser settings, however disabling necessary cookies will make logging in and using the service impossible.
In addition to cookies, we also use the browser's local and session storage for functional purposes only — including keeping your session and CSRF protection, remembering your chosen theme (light/dark), interface state, your settings (language, currency, regional format), your decision about analytics cookies and — until the end of your visit — information about the channel that brought you to the Service. This storage is not used to track you across other websites or to profile you. You can clear it in your browser settings.
In order to display prices in the appropriate currency, we determine your approximate country based on your IP address (geolocation is performed locally, on our server side). We do not determine your exact location and do not use this data for any other purpose.
The automatic categorisation feature suggests a transaction category based on data you previously entered, and the AI-assisted import feature helps recognise the file structure. These are auxiliary — the final decisions are always yours, and this processing does not produce legal effects towards you nor affect the terms of the contracts concluded.
We apply adequate technical and organisational measures, including:
You have the right to:
You can delete your account together with your data yourself in the application (in account settings), with confirmation by e-mail. For other matters, write to help@finantly.com — we will respond promptly, no later than within one month (in justified cases this period may be extended by a further two months, of which we will inform you).
If you consider that we process your data unlawfully, you have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO) in Poland.
Using the Service involves sending requests to the server. Requests may be recorded in the hosting-infrastructure logs (incl. IP address, date and time, browser and system information). They serve to administer the Service and ensure its security. Infrastructure logs are distinct from the application security event log referred to above (point 4), which is retained for 1 year.
Yes. We may update the Policy in connection with the development of the service or changes in the law. We will inform you of changes in the Service, and of significant changes — registered users by electronic means. Each version is marked with a number and an effective date.
Version 1.0 — effective from 21 August 2026.