Finantly

PRIVACY POLICY OF THE FINANTLY SERVICE

Effective from: 21 August 2026 Version: 1.0

This is an English translation of the Polish-language policy. In case of any discrepancy between the language versions, the Polish version prevails.

Dear User,

we make every effort to ensure the security and confidentiality of your personal data — both when you visit our service, register an account and use our services, and when you contact us by e-mail. We act in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter: “GDPR”).

Below, in a question-and-answer format, we present the most important information about why, on what basis and for how long we process your data, who may have access to it and what rights you have.


Who is the controller of your personal data?

The controller of your personal data is Jakub Karwowski, carrying out unregistered business activity (działalność nierejestrowana), address: ul. Marysińska 88A/27, 91-850 Łódź, Poland (hereinafter: “Controller”, “we”).

For all matters concerning personal data you can contact us at: help@finantly.com.

The Service is available at finantly.com (hereinafter: the “Service”). The Service is intended for adults (persons who are at least 18 years old).


How do we obtain your personal data?

Most of the data you provide yourself:

  • when registering an account (first name, last name, e-mail address) — including when you register or log in via your Google account;
  • when you use the Service and enter financial data (transactions, wallets, budgets, categories, net-worth data);
  • when you contact us by e-mail;
  • if you give separate consent — when you sign up for the newsletter.

Some data is collected automatically while you use the Service (e.g. IP address, information about your browser and system) — to the extent necessary for operation, security and correct settlement of the service (see the sections on cookies, geolocation and logs).


What data do we process?

  • Identification and contact data: first name, last name, e-mail address; when logging in with Google — data from your Google account (first name, last name, e-mail address).
  • Financial data you enter: transactions, wallets, budgets, categories, net worth, data used in calculators. This is data you enter yourself in order to use the application.
  • Subscription and payment data: subscription status, plan, billing dates, customer/subscription identifiers at the payment operator. We do not process or store your payment card data — it is handled solely by the payment operator (see below).
  • Technical and security data: IP address, browser/device information (User-Agent), dates and types of events (e.g. login, password change) — in security logs.
  • Service usage data: the financial goal you indicate during onboarding and your settings (language, currency, regional format).
  • Marketing consents (if granted).

Why, on what legal basis and for how long do we process your data?

1. Setting up and maintaining the account and providing the services (registration, use of application features, subscription handling)

  • Basis: necessity for the performance of the contract (Art. 6(1)(b) GDPR).
  • Period: until the service ends (account deletion / termination of the contract).

2. Processing payments and subscriptions (accepting payments, renewals, refunds, controlling access to paid features)

  • Basis: performance of the contract (Art. 6(1)(b) GDPR) and legal obligations, including accounting/settlement (Art. 6(1)(c) GDPR).
  • Period: for the duration of the subscription; data required by law — for the periods provided for by law (incl. limitation of claims).

3. Automatic categorisation and data-import feature (AI) — suggesting transaction categories and, where you use it, AI-assisted import of statements/CSV files

  • Basis: performance of the contract (Art. 6(1)(b) GDPR) — the feature is part of the service you use voluntarily.
  • Scope: to recognise the file structure, column statistics (including header names) and fragments of the file: its first and last lines and a sample of transaction rows, are transmitted to the AI tool provider. We never transmit the entire file. These fragments are transmitted unchanged and may contain actual data — including dates, amounts, payment descriptions/titles, counterparty names and balances, as well as information placed by the bank in the statement header or footer (e.g. the account number or account holder details, if present in the file). The file itself is not uploaded to our server — it is read in your browser, and only the transactions you choose to import reach us. Using AI-assisted import is voluntary — alternatively you can map the columns manually, without transmitting any data to the AI provider.
  • Period: data processed for the purpose of operating the feature. In accordance with the commercial terms of the AI provider (Anthropic), data submitted via the API is not used to train models.

4. Ensuring the security of the Service and keeping event logs

  • Basis: legitimate interest (Art. 6(1)(f) GDPR) consisting in protecting the account and the Service against abuse.
  • Period: security logs (including IP address and User-Agent) are kept for 1 year, after which they are automatically deleted. These logs remain for that period also after the account is deleted.

5. Fulfilling legal obligations (settlements, documentation, data protection)

  • Basis: legal obligation (Art. 6(1)(c) GDPR).
  • Period: for the period required by applicable law.

6. Establishing, pursuing and defending claims

  • Basis: legitimate interest (Art. 6(1)(f) GDPR).
  • Period: until the limitation periods for claims expire.

7. Handling correspondence and support requests (replies to questions sent to our e-mail and handling requests submitted through the in-app form)

  • Basis: legitimate interest (Art. 6(1)(f) GDPR).
  • Scope: the content of the request and any attachments you choose to add to it. Requests reach our mailbox via the e-mail provider listed in the table below.
  • Period: until the matter is concluded and the limitation periods for claims expire.

8. First-party marketing / newsletter (if you consent)

  • Basis: your voluntary consent (Art. 6(1)(a) GDPR).
  • Period: until consent is withdrawn (withdrawal does not affect the lawfulness of processing before withdrawal). You can withdraw consent at any time.

9. Collecting feedback about the Service (voluntary in-app feedback form)

  • Basis: legitimate interest (Art. 6(1)(f) GDPR) consisting in developing and improving the quality of the service.
  • Scope: the feedback text you enter and basic account information (plan, subscription status, account age, indicated financial goal). Feedback is stored without a link to your account identifier.
  • Period: until it is no longer useful for the purpose for which it was collected.

10. Service usage analytics (Google Analytics — visit statistics, in-app journeys and the effectiveness of our promotional activities)

  • Basis: your voluntary consent (Art. 6(1)(a) GDPR) given in the cookie banner. Without your consent analytics is not started — the Google Analytics script is not loaded at all.
  • Scope: a pseudonymous identifier assigned by Google, IP address (truncated by Google before storage), browser and device information, visited addresses and funnel events (registration, login, onboarding completion, checkout start, subscription activation). We do not send Google any financial data you enter in the application, nor your e-mail address.
  • Period: data in Google Analytics is retained for 14 months and then deleted automatically. You may withdraw your consent at any time in Settings → Privacy and consents; withdrawal does not affect the lawfulness of processing before withdrawal.

11. Establishing the acquisition source of an account (recording which channel brought you to the Service — e.g. a newsletter link or a specific campaign)

  • Basis: legitimate interest (Art. 6(1)(f) GDPR) consisting in assessing the effectiveness of our own promotional activities.
  • Scope: campaign parameters contained in the address you used to enter the Service (utm_source, utm_medium, utm_campaign, utm_term, utm_content), the domain only of the page you came from (never the address of a specific page) and the address of the first page you visited with us. This data contains no information about your activity outside our Service. Until registration we keep it solely in your browser's session storage — it disappears when you close the tab. When you create an account we store it once alongside your account.
  • Period: for as long as the account exists. You may object to this processing at any time.

Remember: we process data for as long as necessary to achieve the above purposes, unless you submit an effective request for deletion and the law does not require us to retain it (e.g. settlement documentation). After deletion, data may temporarily remain in backups. We maintain backups in two forms: automated daily snapshots taken by our database hosting provider and retained for up to 8 days, and our own encrypted copies — daily copies retained for 30 days and monthly copies retained for 12 months. After these periods the copies are permanently deleted. Backups are not used for ongoing processing, and if a backup is restored we re-apply any deletion requests previously carried out.


Who may be a recipient of your data? (processors)

We use trusted service providers who process data solely on our instructions and under concluded data-processing agreements. Recipients may include:

ProviderRoleScope of data
MongoDB Atlas (MongoDB, Inc.)Database hostingAll account data and data entered in the application
Render (Render Services, Inc.)Application/server hostingData transmitted as part of operating the service
Cloudflare (Cloudflare, Inc.)Network layer of the Service (CDN, protection against attacks)IP address, browser/device information and data transmitted in traffic to the Service
Polar (payment operator — Merchant of Record)Payment and subscription handling, seller towards the customerFirst and last name, e-mail address, IP address, subscription and payment data (no card data passed to us)
Google (Google Ireland/LLC)Login via Google and — only after you give consent — Service usage analytics (Google Analytics)E-mail address and Google account data used for login; for analytics: a pseudonymous identifier, IP address, browser and device information, visited addresses and events in the Service
Brevo (Brevo SAS, France)Sending transactional e-mail messages (verification, password reset, etc.)E-mail address, content of transactional messages
Anthropic (Anthropic PBC)AI service recognising the structure of the imported fileColumn statistics (including header names), the first and last lines of the file and a sample of transaction rows, which may contain dates, amounts, payment descriptions/titles, counterparties, balances and statement header/footer details (e.g. account number)
Frankfurter (public exchange-rate API)Fetching currency exchange ratesNo personal data (rate queries)
Yahoo FinanceFetching and searching instrument pricesSymbols/tickers and the instrument search phrase you enter (no identifying data)
Have I Been PwnedChecking whether a password has leakedOnly a pseudonymised partial password hash (k-anonymity model)

Your data may also be disclosed to authorised public authorities where required by law.


Do we transfer data outside the European Economic Area (EEA)?

Some of our providers are established or process data on servers outside the EEA (in particular in the United States): Anthropic, Polar, Google and Cloudflare.

In such cases the transfer takes place under mechanisms provided for in the GDPR, in particular standard contractual clauses approved by the European Commission (Art. 46(2)(c) GDPR) or other appropriate bases (e.g. adequacy decisions). You can find more information in those providers’ privacy policies.

Hosting of the database (MongoDB Atlas) and the application (Render) is configured in the European Union region (Frankfurt). This means your core data (account data and data entered in the application) is stored and processed within the EEA. Outside the EEA, only data necessary for the operation of the services listed above (Anthropic, Polar, Google, Cloudflare) is transferred — on the basis of standard contractual clauses or other appropriate GDPR mechanisms.


Do we use cookies?

In the Service we use cookies that are strictly necessary for the operation of the application and your security, and — only with your consentanalytics cookies. We do not use marketing or advertising cookies (e.g. the Facebook Pixel) and we do not share data from the Service with advertising networks.

On your first visit you will see a banner where you decide about analytics. Until you give consent, the Google Analytics script is not loaded at all and no analytics cookies are stored on your device. We remember your choice in your browser's local storage and you can change it at any time in Settings → Privacy and consents. After you withdraw consent we disable analytics and delete its cookies.

Strictly necessary cookies — no consent required:

CookiePurposeLifetime
accessTokenMaintaining the logged-in session15 minutes
refreshTokenRenewing the session without re-login7 days
csrfTokenProtection against CSRF attacks7 days
Google cookiesHandling login via Googleper Google’s rules

Analytics cookies — stored only after you give consent:

CookiePurposeLifetime
_gaDistinguishing users in Google Analytics2 years
_ga_*Maintaining session state in Google Analytics2 years

The necessary cookies are set by us; Google cookies appear when you use Google login. You can also manage cookies in your browser settings, however disabling necessary cookies will make logging in and using the service impossible.

In addition to cookies, we also use the browser's local and session storage for functional purposes only — including keeping your session and CSRF protection, remembering your chosen theme (light/dark), interface state, your settings (language, currency, regional format), your decision about analytics cookies and — until the end of your visit — information about the channel that brought you to the Service. This storage is not used to track you across other websites or to profile you. You can clear it in your browser settings.


IP-based geolocation

In order to display prices in the appropriate currency, we determine your approximate country based on your IP address (geolocation is performed locally, on our server side). We do not determine your exact location and do not use this data for any other purpose.


Do we make automated decisions or profile data?

The automatic categorisation feature suggests a transaction category based on data you previously entered, and the AI-assisted import feature helps recognise the file structure. These are auxiliary — the final decisions are always yours, and this processing does not produce legal effects towards you nor affect the terms of the contracts concluded.


How do we protect your data?

We apply adequate technical and organisational measures, including:

  • encryption of connections using TLS,
  • encryption of data in the database: e-mail address, wallet names and transaction descriptions,
  • password hashing (passwords are not stored in plain text) and password-strength checking,
  • protection against CSRF attacks, limiting the number of login attempts,
  • security event logs (audit) and access control to data,
  • regular, encrypted backups stored within the European Union.

What rights do you have?

You have the right to:

  • access your data,
  • rectify data,
  • erase data (“right to be forgotten”),
  • restrict processing,
  • object to processing,
  • data portability,
  • withdraw consent at any time (where processing is based on consent).

You can delete your account together with your data yourself in the application (in account settings), with confirmation by e-mail. For other matters, write to help@finantly.com — we will respond promptly, no later than within one month (in justified cases this period may be extended by a further two months, of which we will inform you).


Complaint to a supervisory authority

If you consider that we process your data unlawfully, you have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO) in Poland.


Server logs

Using the Service involves sending requests to the server. Requests may be recorded in the hosting-infrastructure logs (incl. IP address, date and time, browser and system information). They serve to administer the Service and ensure its security. Infrastructure logs are distinct from the application security event log referred to above (point 4), which is retained for 1 year.


Can we change this Privacy Policy?

Yes. We may update the Policy in connection with the development of the service or changes in the law. We will inform you of changes in the Service, and of significant changes — registered users by electronic means. Each version is marked with a number and an effective date.


Version 1.0 — effective from 21 August 2026.