Privacy Policy

Data Controller

The controller of your personal data is FINAPRISM, a French simplified joint-stock company (SAS), registered with the Paris Trade and Companies Register under number SIREN 106820145 (registered-office SIRET 10682014500014), with its registered office at 229 rue Saint-Honoré, 75001 Paris, France.

For any question regarding data protection: contact@finaprism.com.

1. Data Collection

In the course of using the FinaPrism application, we collect the following categories of data:

• Identification data: email address, first and last name (provided when creating an account).

• Financial data: account balances, transaction history, amounts, dates, transaction descriptions. This data is collected by manual entry or by importing documents (PDF or CSV statements, photos, screenshots, text or JSON files, pasted text) and receipts that you send us; the content of these imported documents may include your name, account numbers, and all the transactions they contain.

• Account identifier ending: after importing a statement, we keep only the LAST 4 to 6 characters of the account number printed on the document, in encrypted form. Never the full IBAN, never the account holder's name. It is used solely to recognise the account on your later imports, so you do not have to point it out every time. It is kept for as long as the account exists in the app, appears in your data export, and you can erase it at any time from the account screen.

• Technical data: device model, operating system version, unique device identifiers, diagnostic and performance data.

• Usage data: features used, interactions with the application, user preferences, date the app was last opened, email choices.

We do not collect sensitive banking data such as bank login credentials or passwords.

The Service is reserved for persons aged 18 or over; we do not knowingly collect data relating to minors.

2. Data Usage

The data collected is used for the following purposes:

• Service provision: displaying balances, transaction history, budget management, generating charts and reports.

• Automatic categorization and import: we use automated processing provided by Google to categorize your transactions, detect merchants, and automatically extract transactions from the documents you import (PDF or CSV statements, photos, screenshots, text or JSON files, pasted text) and from the receipts you submit for analysis. For categorization alone, only transaction descriptions are transmitted. For a document import, the entire content of the document you provide is transmitted to Google to extract the data; that content may include identifying data (your name, account numbers, the full list of transactions in the statement). This processing is necessary to perform the service you choose to use (the import/categorization feature) and involves no automated decision producing legal or similarly significant effects within the meaning of Article 22 GDPR (you can manually correct any category at any time). ⚠️ Attaching a receipt to a transaction transmits it to no one — it is simply stored. A receipt is sent to Google only if you explicitly ask for it to be analysed, or if you capture it with no transaction attached, in which case the extraction IS the feature you are triggering.

• Shopping-list price estimate: when you use the Shopping tool, the app estimates what your basket will cost. It relies first on YOUR own analysed receipts, in a calculation performed entirely on your device, with no data leaving it. For items it does not know, it queries a catalogue of average prices per country that holds no personal data. ⚠️ The estimate never transmits your lists themselves: the app sends only normalised keywords (for example "milk"), and the text you actually typed is sent to Google in one case only — when a wording never seen before has to be reduced to a generic product name: in principle once only, but again for as long as it could be neither accepted nor rejected (for example if the service did not respond). A wording that does not denote a grocery product is rejected: it is then kept only as an irreversible digest, with no link to your account and with no readable text remaining. Items relating to health, pharmacy or intimate hygiene are rejected when Google recognises them as such, at the moment their wording is sent to it: they then receive no average price, do not become catalogue products, and their wording is treated as a rejected wording: kept only as an irreversible digest, with no link to your account. An accepted wording is never sent again, for any user; a rejected wording, on the other hand, may be sent again once it has been deleted, after one year.

• Service improvement: performance analysis, bug fixing, development of new features.

• Customer support: handling your technical support requests.

• Emails: emails required for the service, weekly and monthly recaps, inactivity reminders and tips of the week (section 6).

• Legal obligations: data retention required by law and responding to requests from competent authorities.

The legal bases for processing are: contract performance (service provision, including the automatic categorization and import you enable, and emails required for the service), legitimate interest (service improvement, recaps, inactivity reminders, the sign-up invitation email sent for a household and, in the case described in section 6, tips), consent (tips, in the other cases), and legal obligation.

3. Storage and Security

FinaPrism implements professional-grade security measures to protect your data:

• Encryption in transit: all communications between the application and our servers are encrypted via TLS, version 1.3 by default and 1.2 at minimum.

• Data-at-rest encryption, on our servers: stored data is encrypted with Halite/libsodium, a modern encryption library, using symmetric-key authenticated encryption (XChaCha20 for encryption, BLAKE2b for authentication, in an encrypt-then-MAC scheme).

• Data-at-rest encryption, on your device: financial data, receipts and their thumbnails are encrypted with AES-256-GCM before being written to disk, on top of iOS file protection; the key lives in the Keychain.

• Secure local storage: sensitive data on the device is stored in the iOS Keychain, Apple's secure secrets manager.

• Encrypted backups: all backups are encrypted before storage.

• Authentication: passwords stored in hashed form, optional sign-in with your Apple or Google account, time-limited sessions revoked when the password is reset.

• Secure infrastructure: our servers are hosted on Microsoft Azure in the France Central region (European Union), an ISO 27001 certified provider, with firewalls, intrusion detection, and continuous monitoring.

• Cookies: the finaprism.com website uses no analytics cookies or advertising trackers; only strictly necessary cookies required for it to function may be set, for which no consent is required (Article 82 of the French Data Protection Act).

4. Third-Party Services

To provide certain features, FinaPrism uses carefully selected processors:

• Google (Google Ireland Limited / Google LLC) — automated processing: transaction categorization, merchant detection, extraction of transactions from the documents you import (PDF or CSV statements, photos, screenshots, text or JSON files, pasted text) and from the receipts you submit for analysis, and normalization of your shopping-list items. Depending on the feature, what is transmitted is either only the descriptions of transactions or of items, or the entire content of the document or receipt (document import, receipt analysis), which may contain identifying data. Analysing a receipt also transmits the names of your custom categories; adding a bank that is not in our bank catalogue transmits the name you typed, so that its logo can be found. As Google may process this data outside the European Union (including in the United States), such transfers are covered by appropriate safeguards under Chapter V of the GDPR (European Commission Standard Contractual Clauses and/or EU-US Data Privacy Framework certification); a copy of these safeguards can be obtained on request at contact@finaprism.com.

• Google — average grocery prices: the same processor is used to reduce a shopping-list item wording the catalogue has never seen before to a generic product name, and then to establish average prices per country from public web sources. Only the first operation carries text you typed, in principle once per wording (it may be sent again for as long as it could be neither accepted nor rejected, or once a rejected wording has been deleted, one year on); the second transmits generic product names only and no personal data.

• Microsoft Azure (hosting and email delivery): hosting of the API and database in the France Central region (European Union), an ISO 27001 certified provider; delivery of the emails described in section 6 through Azure Communication Services, whose data is stored in Europe.

• OVH SAS (website hosting, France).

• Apple (payments, storage and notifications): for subscription management via the App Store, secure storage via the iOS Keychain and the delivery of push notifications (APNs), which may contain the first name of the household member who invites you or shares an account with you.

All our processors are bound by GDPR-compliant data processing agreements. We do not authorize any processor to use your data for their own purposes.

5. Sharing between users (household)

The Elite subscription lets you form a "household" of up to six people, each holding a FinaPrism account, in order to share some of your accounts, budgets, savings goals and shopping lists. This sharing is a disclosure of your personal data to another user, decided and triggered by you alone.

• What is shared: nothing by default. Every account, budget, savings goal and shopping list stays private until its owner decides otherwise, one at a time. For each of them, the owner names the members who may see it: the other household members see nothing of it, even though they belong to the same household. Joining a household does not, by itself, share any data.

• What the other member sees of a shared account: its name, its bank, its balance and its entire transaction history, including labels, amounts, dates, categories and notes. They can also create, edit and delete transactions in it. They cannot delete the account itself.

• Who did what: in a shared account, the app shows who entered a transaction and who last edited it, when that is not the account owner. This is what answers “who paid for this?” and lets us name the person when two edits cross. Only a technical identifier is stored: the first name is resolved from the household's current membership, so someone who has left is no longer named.

• What the other member sees of a shared securities account: in addition to the above, the entire portfolio — every holding, its identifier, quantity, cost basis, current value and gain or loss, together with the history of purchases, sales and dividends. They can also add, edit and delete holdings and trades there. The portfolio has no separate sharing setting: it follows that of the securities account holding it.

• What the other member sees of a shared budget: its name, its amount and its spend. A shared budget only counts transactions from the accounts its owner shares: spending on accounts they keep private never feeds into it. That spend is a TOTAL, never a detail — no transaction and no account is revealed — so it may include an account that is not open to that particular member.

• What the other member sees of a shared savings goal: its name, its target amount, its progress and the history of contributions. They can add contributions; only the owner can delete the goal.

• What the other member sees of a shared shopping list: its name and its contents — the items, their quantities, their estimated prices, and the item photos attached to it. They can add, tick, edit and delete items; only the owner can delete the list.

• Loans, categories, tags and receipts: a loan is visible to the members who have access to the account it is linked to, with its details (including principal, interest rate, instalments, lender, contract number, insurance, note); if it was shared under the legacy setting, it is also visible to the whole household until its owner turns that setting off. Members who can see a loan can also edit it; only its owner can delete it. A custom category or a tag that its owner shares is visible to every member of the household. Receipts attached to transactions in a shared account (file and extracted data) are visible to the members who have access to that account.

• Invitation: the invited person is identified by their email address. If that address belongs to a FinaPrism account, the invitation discloses to the invited person the first name and email address of the person inviting them, so they can identify them before accepting. No financial data is transmitted before acceptance. If the address belongs to no account, no invitation is recorded, since an invitation requires an account: the address only receives an email inviting its holder to sign up, with a link to the App Store, which carries only the first name of the person inviting, never their address, and asks the recipient to ignore the message if they do not know that person; after signing up, the person inviting has to send the invitation again. A given address receives at most one such email per day from each person inviting. FinaPrism does not record that address: only a fingerprint of it, from which it cannot be read, is kept for one day, to prevent repeated sending; the address appears only in the technical email delivery logs (Azure Communication Services), kept for 30 days, and, if sending fails, in our sending queue, for 30 days at most.

• What members see of one another: each member's first name, last name and email address are visible to the other household members, so they can identify one another with certainty when choosing who to share an account with. The household also shows, for each member: their subscription plan (free, Premium or Elite — which is how you can tell who provides the subscription the household benefits from), the date they joined the household, and the storage volume their files occupy and the volume they have added (byte counts only, never the content or the list of files). No other profile data (phone number, date of birth) is disclosed. This disclosure is reciprocal and ends when a member leaves the household.

• Legal basis: performance of the contract (GDPR article 6(1)(b)), household sharing being a feature of the subscription you purchased, activated on your initiative alone.

• Ending the sharing: you can withdraw an account from sharing, remove a member or leave the household at any time. Sharing stops immediately and our servers instruct the other member's device to delete its local copy of the data concerned.

⚠️ Important limitation: we cannot guarantee that the person you shared an account with has not kept a copy elsewhere (screenshot, export, personal note). Withdrawing the sharing prevents any further access; it does not erase what has already been seen. Only share an account with someone you genuinely trust with access to its history.

Transactions a member enters in a shared account belong to that account's owner and remain there if they leave the household. If that member deletes their FinaPrism account, the link to their person is erased and the transactions are kept, without their name, with the account owner — so that exercising their right to erasure does not destroy someone else's financial data.

6. Emails we send you

FinaPrism writes to the email address associated with your account, using your first name and the app's language. These emails are sent by our processor Microsoft (Azure Communication Services, see section 4). None of them shows an amount in its subject line.

• Emails required for the service: the code verifying your address at sign-up, password resets, security notices (password change; email address change, confirmed by a code sent to the new address and reported to the old one), notices of changes to the Terms of Use and advance notices of file deletion (section 8). Legal basis: performance of the contract (GDPR article 6(1)(b)). As they are essential to the operation and security of your account, they cannot be turned off. In addition, an email inviting its recipient to sign up is sent, at a member's request, to an address without a FinaPrism account that the member invites into their household (section 5); legal basis: the legitimate interest of that member and of FinaPrism in enabling household sharing (GDPR article 6(1)(f)).

• Weekly and monthly recaps: every Monday, a summary of the past week; on the 1st of each month, a summary of the past month. They are included in every plan, the free plan included, and turned on by default; they are only sent, however, once you have opened a version of the app that lets you manage them, except the one you had chosen yourself with an earlier version, for as long as you have the Elite plan. They are drawn from your transactions for the period (amounts, categories, merchants) and, for the monthly recap, from your accounts, budgets and savings goals, strictly within what you can see in the app, including the accounts a member of your household shares with you. These figures appear in the body of the email; they are calculated at the time of sending and are not stored, except in an email whose sending failed (30 days at most, see below). No recap is sent for a period without any transaction. Legal basis: our legitimate interest in regularly presenting you with a summary of your activity in the app (GDPR article 6(1)(f)).

• Inactivity reminders: one email when you have not opened the app for 2 days, a second after 7 days, then nothing more until you come back to it. Turned on by default, they contain no commercial offer. They rely on the date you last opened the app, as the app reports it to us, and on whether accounts or transactions already appear in your app, never on an amount. The first reminder of a new absence is never sent less than 7 days after the previous reminder. As long as your version of the app does not report that date, no reminder is sent to you. Legal basis: our legitimate interest in helping you keep your tracking up to date (GDPR article 6(1)(f)).

• Tip of the week: every Thursday, an email presenting a FinaPrism tip or new feature, including the features of the paid Premium and Elite plans; it is therefore direct marketing. In addition to the data mentioned above, we use your progress through the series of tips. Tips are not chosen on the basis of your financial data: they follow a fixed order, the same for everyone.

Legal basis for tips: if you created your account from a screen that informs you of them and offers a “Don't send me tips by email” box, unticked by default — the sign-up screen — and you did not tick it, sending relies on the existing-customer exception provided for in article L34-5 of the French Postal and Electronic Communications Code: it only covers similar services provided by FinaPrism, and you are offered the opportunity to object when your address is collected and in every email; under the GDPR, it then relies on our legitimate interest in making our services known to our users (article 6(1)(f)). In all other cases, in particular if you accepted tips from within the app, sending relies on your consent (GDPR article 6(1)(a)), which you may withdraw at any time, without affecting the lawfulness of earlier emails. If your account was created without this notice, or from the sign-in screen with Apple or Google, no tips are sent to you until you accept them in the app.

How to stop: every recap, reminder and tip contains an unsubscribe link: the page it opens asks you to confirm, then unsubscribes you from that type of email only; you can also turn each of them on or off in the app's settings, and ticking the “Don't send me tips by email” box when you sign in unsubscribes you from tips. Unsubscribing is free of charge and requires no justification.

Retention: send records (type of email, period concerned, tip sent, status and reason for any failure, dates), which contain no financial data, are kept for 6 months. An email that could not be sent is kept for at most 30 days in our sending queue, then deleted. Your email choices, the date of your last answer about tips, your progress through the series of tips and the date you last opened the app are kept with your account and deleted with it. The date and origin of your tips sign-up (no objection at sign-up, or agreement given to the in-app question or in settings) are kept for as long as tips remain turned on and erased with your account.

7. Your GDPR Rights

In accordance with the General Data Protection Regulation (GDPR), you have the following rights over your personal data:

• Right of access (Article 15): obtain confirmation that your data is being processed and receive a copy.

• Right of rectification (Article 16): have inaccurate or incomplete data corrected.

• Right to erasure (Article 17): request deletion of your data in certain cases ("right to be forgotten").

• Right to restriction of processing (Article 18): temporarily restrict the use of your data.

• Right to data portability (Article 20): receive your data in a structured format and transmit it to another data controller.

• Right to object (Article 21): object, on grounds relating to your particular situation, to processing based on our legitimate interest and, at any time and without giving reasons, to direct marketing, including tips by email (section 6).

• Right to withdraw consent (Article 7): withdraw your consent at any time for consent-based processing.

• Post-mortem directives (Article 85 of the French Data Protection Act): define directives on the fate of your data after your death.

To exercise your rights, contact us at contact@finaprism.com. We will respond within one month. You also have the right to lodge a complaint with the CNIL (French Data Protection Authority) or the supervisory authority in your country.

8. Data Retention

We retain your personal data only for as long as necessary for the purposes for which it was collected:

• Account data: retained for the duration of your active account, then deleted within 30 days following account deletion.

• Transaction data: retained for the duration of account use. Upon account deletion, data is permanently erased within 30 days.

• Technical and diagnostic data: retained for a maximum period of 12 months.

• Emails: send records kept for 6 months; the other periods are set out in section 6.

• Attached files (receipts, item photos): retained for as long as your account exists. Six months after a subscription ends, if your storage still exceeds the free plan's limit, only the SURPLUS files are deleted until you are back under that limit — item photos first, then receipts, newest to oldest. You are notified by email at least one month beforehand, and resuming a subscription restores your allowance without any file being deleted. Your transactions, accounts, budgets and lists are never affected. Upon deletion of your account, your files are deleted; their encrypted technical copies, kept for disaster recovery, are purged automatically within four months at most.

• Imported documents (PDF or CSV statements, photos, screenshots, text or JSON files, pasted text): deleted as soon as their analysis is finished. The result of the analysis then waits at most 72 hours for your review, after which it is deleted. The encrypted technical copies of these documents, kept for disaster recovery, are purged automatically within four months at most.

• Grocery product catalogue: this catalogue is shared by all users and holds no link to your account. It contains generic product names, average prices per country and, attached to those products, the normalised keywords of accepted wordings. Wordings rejected because they do not denote a grocery product, or because they relate to health, pharmacy or intimate hygiene, appear in it only as an irreversible digest and are deleted after one year.

In certain cases, we may be required to retain some data to comply with legal obligations (particularly accounting and tax). Such data is then archived and isolated from the rest of the database.

Upon deletion of your account, all your personal data is permanently erased from our systems, except for data that must be retained for legal reasons and the encrypted technical copies mentioned above, which are purged within the time limits stated.

9. Contact

For any questions regarding the protection of your personal data or to exercise your rights, you may contact us:

• By email: contact@finaprism.com

If you believe your rights have not been respected, you may lodge a complaint with the CNIL — 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr — or the data protection authority in your country of residence.