Privacy Policy

Last updated: November 2025

1. Overview

Finotaur respects your privacy. This policy explains how we collect, use, and protect your data.

2. Data We Collect

Personal information such as name, email, and preferences during account creation.
Technical data such as IP address, browser type, and cookies.
Usage data related to how you interact with our dashboard and features.

3. How We Use Data

To provide and improve our Services.
To send system notifications and updates.
To analyze user behavior for better performance and experience.

4. Data Sharing

We do not sell personal data. We may share limited data with secure third parties (e.g., PayPlus, Supabase) solely for functionality and compliance.

5. Cookies

Finotaur uses cookies for analytics and session management. You can disable them in your browser settings.

6. Data Retention

We retain data as long as necessary for legitimate business purposes or legal obligations.

7. Security

We use encryption and secure protocols to protect your information. No system is 100% secure, but we take every reasonable measure.

8. Your Rights

You can request data deletion or correction at any time by contacting us at [email protected].

9. International Privacy Rights (GDPR & CCPA)

Rights under GDPR (EEA, UK, Switzerland)

If you reside in the European Economic Area (EEA), the United Kingdom, or Switzerland, the EU General Data Protection Regulation (GDPR) grants you the following rights regarding your personal data:

Right of access — request a copy of the data we hold about you
Right of rectification — correct inaccurate or incomplete data
Right of erasure ("right to be forgotten") — request deletion of your data
Right of portability — receive your data in a machine-readable format
Right to restrict processing — limit how we use your data
Right to object — object to processing for marketing or analytics
Right to withdraw consent — at any time, with no penalty (use the Cookie Settings link in the footer or contact support)

Rights under CCPA (California residents)

If you reside in California, the California Consumer Privacy Act (CCPA) grants you:

The right to know what personal information is collected, used, shared, or sold
The right to delete personal information held by us
The right to opt-out of the sale of personal information
The right to non-discrimination for exercising your rights

To exercise any of these rights, email [email protected]. We respond within 30 days (GDPR) or 45 days (CCPA).

10. Data We Share with Third-Party Processors

We share limited operational data with the following processors to deliver the service. Each processor is either bound by a signed Data Processing Agreement (DPA) or governed by Terms of Service that include data processing provisions consistent with GDPR Article 28 requirements:

Processor	Purpose	Data shared	Location
Google LLC	Web analytics (GA4) — only after consent	Anonymized usage events, IP address (anonymized)	United States
PostHog Inc.	Product analytics — only after consent	Distinct user ID, event metadata	United States
Supabase Inc.	Database hosting + authentication	All user account data	United States (ap-northeast-2 region)
Resend Inc.	Transactional + marketing email delivery	Email address, recipient name	United States
Cloudflare Inc.	CDN + web hosting	IP address, request metadata	Global
Whop Inc.	Subscription billing	Email, billing data	United States
Railway Corp.	Backend application hosting	Request metadata, logs	United States

11. Data Retention

Account data: retained until account deletion
Analytics events (GA4 + PostHog): 14 months
Email logs: 90 days
Support tickets: 2 years