Privacy Policy
Last updated: July 2026
Data Controller
The controller of your personal data is FINAPRISM, a French simplified joint-stock company (SAS), registered with the Paris Trade and Companies Register under number SIREN 106820145 (registered-office SIRET 10682014500014), with its registered office at 229 rue Saint-Honoré, 75001 Paris, France.
For any question regarding data protection: contact@finaprism.com.
1. Data Collection
In the course of using the FinaPrism application, we collect the following categories of data:
• Identification data: email address, first and last name (provided when creating an account).
• Financial data: account balances, transaction history, amounts, dates, transaction descriptions. This data is collected by manual entry or by importing statements (CSV/PDF files) and receipts that you send us; the content of these imported documents may include your name, account numbers, and all the transactions they contain.
• Technical data: device model, operating system version, unique device identifiers, diagnostic and performance data.
• Usage data: features used, interactions with the application, user preferences.
We do not collect sensitive banking data such as bank login credentials or passwords.
The Service is not intended for persons under the age of 15; we do not knowingly collect data relating to minors.
2. Data Usage
The data collected is used for the following purposes:
• Service provision: displaying balances, transaction history, budget management, generating charts and reports.
• Automatic categorization and import: we use automated processing provided by Google to categorize your transactions, detect merchants, and automatically extract transactions from the statements (CSV/PDF) and receipts you import. For categorization alone, only transaction descriptions are transmitted. For a document import, the entire content of the file you provide is transmitted to Google to extract the data; that content may include identifying data (your name, account numbers, the full list of transactions in the statement). This processing is necessary to perform the service you choose to use (the import/categorization feature) and involves no automated decision producing legal or similarly significant effects within the meaning of Article 22 GDPR (you can manually correct any category at any time).
• Service improvement: performance analysis, bug fixing, development of new features.
• Customer support: handling your technical support requests.
• Legal obligations: data retention required by law and responding to requests from competent authorities.
The legal bases for processing are: contract performance (service provision, including the automatic categorization and import you enable), legitimate interest (service improvement), and legal obligation.
3. Storage and Security
FinaPrism implements professional-grade security measures to protect your data:
• Encryption in transit: all communications between the application and our servers are encrypted via TLS 1.3.
• Data-at-rest encryption: stored data is encrypted with Halite/libsodium, a modern encryption library using public-key cryptography (X25519) and authenticated encryption (XSalsa20-Poly1305).
• Secure local storage: sensitive data on the device is stored in the iOS Keychain, Apple's secure secrets manager.
• Encrypted backups: all backups are encrypted before storage.
• Strong authentication: use of modern authentication methods and secure session token management.
• Secure infrastructure: our servers are hosted on Microsoft Azure in the France Central region (European Union), an ISO 27001 certified provider, with firewalls, intrusion detection, and continuous monitoring.
• Cookies: the finaprism.com website uses no analytics cookies or advertising trackers; only strictly necessary cookies required for it to function may be set, for which no consent is required (Article 82 of the French Data Protection Act).
4. Third-Party Services
To provide certain features, FinaPrism uses carefully selected subcontractors:
• Google (Google Ireland Limited / Google LLC) — automated processing: transaction categorization, merchant detection, and extraction of transactions from the statements (CSV/PDF) and receipts you import. Depending on the feature, either only transaction descriptions (categorization) or the entire content of the document you import (statement/receipt import), which may contain identifying data, is transmitted. As Google may process this data outside the European Union (including in the United States), such transfers are covered by appropriate safeguards under Chapter V of the GDPR (European Commission Standard Contractual Clauses and/or EU-US Data Privacy Framework certification); a copy of these safeguards can be obtained on request at contact@finaprism.com.
• Microsoft Azure (hosting): hosting of the API and database in the France Central region (European Union), an ISO 27001 certified provider.
• OVH SAS (website hosting, France).
• Apple (payments and storage): for subscription management via the App Store and secure storage via the iOS Keychain.
All our subcontractors are bound by GDPR-compliant data processing agreements. We do not authorize any subcontractor to use your data for their own purposes.
5. Your GDPR Rights
In accordance with the General Data Protection Regulation (GDPR), you have the following rights over your personal data:
• Right of access (Article 15): obtain confirmation that your data is being processed and receive a copy.
• Right of rectification (Article 16): have inaccurate or incomplete data corrected.
• Right to erasure (Article 17): request deletion of your data in certain cases ("right to be forgotten").
• Right to restriction of processing (Article 18): temporarily restrict the use of your data.
• Right to data portability (Article 20): receive your data in a structured format and transmit it to another data controller.
• Right to object (Article 21): object to the processing of your data for legitimate reasons.
• Right to withdraw consent (Article 7): withdraw your consent at any time for consent-based processing.
• Post-mortem directives (Article 85 of the French Data Protection Act): define directives on the fate of your data after your death.
To exercise your rights, contact us at contact@finaprism.com. We will respond within one month. You also have the right to lodge a complaint with the CNIL (French Data Protection Authority) or the supervisory authority in your country.
6. Data Retention
We retain your personal data only for as long as necessary for the purposes for which it was collected:
• Account data: retained for the duration of your active account, then deleted within 30 days following account deletion.
• Transaction data: retained for the duration of account use. Upon account deletion, data is permanently erased within 30 days.
• Technical and diagnostic data: retained for a maximum period of 12 months.
In certain cases, we may be required to retain some data to comply with legal obligations (particularly accounting and tax). Such data is then archived and isolated from the rest of the database.
Upon deletion of your account, all your personal data is permanently erased from our systems, except for data that must be retained for legal reasons.
7. Contact
For any questions regarding the protection of your personal data or to exercise your rights, you may contact us:
• By email: contact@finaprism.com
If you believe your rights have not been respected, you may lodge a complaint with the CNIL — 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr — or the data protection authority in your country of residence.