Privacy notice

1. Who we are

FPAify (“FPAify”, “we”, “us”) is an AI-first financial planning and analysis service at fpaify.io. It is operated by [legal entity name], [registered address]. For anything in this notice, email [privacy contact email].

For your account, billing and use of the website we are the controller of your personal data under the UK GDPR and the Data Protection Act 2018. For personal data that appears inside the financial files you upload, we act as your processor (see section 4).

2. What we collect

When you create an account

• Your name, email address and job role, and the name of your company.
• A password, which is held by Google’s Firebase Authentication service. We never see it.

When you use the app

• Company data you upload or create: ledgers, trial balances, budgets, forecasts, mappings, notes, allocation rules, headcount plans and settings.
• Preferences, such as which company you last opened.
• AI usage records: for each AI call, the time, the type of task, the model, the number of tokens and the cost. These records hold no file contents or prompts.

When you pay

• Your subscription status, Stripe customer ID and payment history. Card details go straight to Stripe, and we never receive or store them.

Technical data

• Our host, Netlify, keeps standard server logs (such as IP address, browser and pages requested) to run and secure the service.
• For the public demo’s AI features we keep a one-way hash of your IP address, only to count calls against the hourly limit. We don’t store the IP address itself.

If you email us, we keep the correspondence so we can answer you.

3. How we use it, and why

We do not send marketing email without your consent, and we make no decisions about you by automated means that have legal or similarly significant effects.

4. Financial data you upload

The files you upload belong to you, or to the company you upload them for. Ledgers and other exports can contain personal data, such as supplier, customer or employee names in posting descriptions, or payroll lines. For that data your organisation is the controller and we process it only on your instructions, to provide FPAify:

• We store it, read it to map and reconcile your accounts, and show it back to you.
• We don’t use it for any other purpose. We don’t sell it, use it for advertising, or use it to train AI models.
• We use the sub-processors in section 6, under contracts with appropriate data-protection terms.
• We help you respond to requests from individuals, and we delete the data when you delete it or your account.

Only upload personal data you have a lawful basis to share. If your organisation needs a signed data processing agreement, contact us.

5. AI features

FPAify has a built-in rule engine that runs in your browser and sends nothing to an AI provider. Claude, the AI model made by Anthropic, is used only when you use a feature that needs it: Ask, Dictate (when Claude is connected), “Ask Claude to review” during an import, AI commentary, AI budgets and forecasts, or reading an unfamiliar ledger layout.

Each request sends only what that feature needs, for example:

• account names, codes and a few recent values from your file;
• the figures on the screen you asked about;
• your instructions or dictated text, plus your company’s import notes and past mapping choices.

Anthropic processes these requests as our sub-processor under its commercial terms. AI output can be wrong: FPAify shows its reasoning, and nothing changes in your data until you accept it.

Dictate uses your browser’s speech recognition to turn speech into text. Depending on your browser, the audio may be processed by its maker (for example Google for Chrome or Apple for Safari) under their privacy terms. FPAify itself only receives the text. You can always type instead.

6. Who we share it with

We use these service providers (sub-processors) to run FPAify:

Members of your organisation in FPAify can see its companies. Today that is the account that created it. We may also disclose data where the law requires it, to protect our rights or users’ safety, or to a buyer if FPAify is sold, in which case this notice continues to apply. We do not sell personal data.

7. International transfers

Some providers above process data outside the UK, mainly in the US. Where they do, we rely on safeguards recognised under UK law, such as the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU–US Data Privacy Framework where the provider is certified. You can ask us for details.

8. How long we keep it

• Account and company data: for as long as your account is open. Deleting a company removes its data. Deleting your account from the Account page removes your profile and preferences, and any company you are the only owner of, including its uploads, plans and import memory.
• Billing and AI usage records: for as long as tax and accounting law requires, normally six years. Stripe keeps its own payment records under its legal obligations.
• Demo rate-limit counters: they hold a hashed IP and only count calls for the current hour or day.
• Server logs and backups: these are kept by our providers for limited periods and then overwritten.

9. Cookies and browser storage

We don’t use advertising or analytics cookies, or any third-party tracking. FPAify uses your browser’s storage only for things the service needs:

• Keeping you signed in: Firebase Authentication stores a session token.
• Preferences: light or dark mode, which menu sections are folded, and whether you closed the demo banner.
• The public demo: companies you load or files you upload there are saved only in your browser. They are not sent to us, except the parts a Claude feature needs if you choose to use one.

Because this storage is strictly necessary, it doesn’t need consent. Clearing your browser’s site data removes it.

10. Security

Data is encrypted in transit (HTTPS) and at rest by our providers. Access rules let only signed-in members of the organisation that owns a company read its data, and the server checks sign-in on every request. API keys and service credentials stay on the server and are never sent to your browser. No system is perfectly secure: if a breach affects your personal data, we will tell you and the regulator where the law requires it.

11. Your rights

Under UK data protection law you can ask us to:

• give you a copy of your personal data (access);
• correct it (rectification);
• delete it (erasure);
• restrict how we use it, or object to uses based on legitimate interests;
• give it to you in a portable format (portability). You can also export company data yourself to Excel or CSV at any time.

Email [privacy contact email] and we will respond within one month. If your request is about data inside a company’s uploads, we may refer you to that company, which controls it.

You can also complain to the Information Commissioner’s Office at ico.org.uk, though we’d appreciate the chance to put things right first.

FPAify is a business service and is not meant for anyone under 18.

12. Changes and contact

If we change this notice we will update the date at the top, and we will tell account holders about significant changes by email or in the app before they take effect.

Contact: [legal entity name], [registered address], [privacy contact email].

See also our Terms of service.