Privacy Policy

1. Who we are and how to reach us

Finstory, Inc., 1445 Woodmont Ln NW #1641, Atlanta, GA 30318, USA. Privacy questions and requests: privacy@finstory.org.

For our website, sales and marketing, and the account details we need to run the service, finstory is the controller of your personal data. For the financial data and other content your company puts into the service ("customer data"), your company is the controller: finstory processes customer data on your company's behalf and on its instructions, under our agreement with your company.

finstory is based in the United States. Where the law requires it, we will appoint a representative in the European Union and the United Kingdom and publish their details here.

2. What we collect

When you use the service

• Account details: your name, work email address, company, your role in finstory, and sign-in details. You can sign in with Google, with Microsoft or with your email address; when you use Google or Microsoft, we receive your name and email address from them, never your password.
• Customer data: the financial data your company loads, from NetSuite, QuickBooks Online, spreadsheets or other systems, such as accounts, entities, actuals, budgets and forecasts, and the reports, stories, commentary and notes that you and your colleagues create. Customer data can include personal data, for example the names of employees, customers or suppliers in account or entity names.
• Connection credentials: the encrypted credentials that let finstory connect to your ERP or accounting system, used only to read the data you authorize.
• Usage data: log-in times, pages viewed and actions taken in the service, and similar data from the finstory connector and plugin for Claude, used to run and secure the service.

When you visit our website

• Contact details you submit, such as through a demo request or newsletter sign-up.
• Standard technical data, such as IP address, browser type and pages visited, collected through cookies and similar technology.

3. Why we use it

We use personal data to:

• provide, maintain and secure the service, on the instructions of your company for customer data;
• authenticate sign-in and manage roles and permissions;
• respond to support requests and run onboarding;
• send service and account communications, and, with consent, marketing communications such as the newsletter;
• meet our legal and contractual obligations.

4. Sub-processors and data transfers

finstory runs on Google Cloud in the United States. We use a small number of sub-processors to host the service, send email and provide customer support, each bound by a data processing agreement. Where personal data is transferred from the EU, the UK or Switzerland to the United States, we rely on the EU Standard Contractual Clauses and the UK's International Data Transfer Addendum.

5. finstory in Claude

The finstory connector and plugin let Claude read and write within your finstory workspace, limited to your role. Claude's provider, Anthropic, processes what finstory returns for your request under its own terms and privacy policy; finstory does not send more data to Claude than your request needs, and the connector does not give Claude standing access to your workspace outside an active conversation.

6. Data retention

We keep customer data for as long as your company subscribes to finstory. When a subscription ends, we keep the data for up to 30 days so it can be exported, then delete it. Backups that contain it are purged within 60 days of the end of the subscription. We keep account and billing records for as long as the law requires.

7. Cookies

Our website uses essential cookies to run securely, and, with your consent, analytics cookies to understand how the site is used. You can control cookies through your browser settings; turning off essential cookies may stop parts of the site from working.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict some processing, and to withdraw consent at any time. Where your company's data is involved, we will generally direct your request to your company as the controller. To exercise a right, email privacy@finstory.org. If you are in the EU or UK, you also have the right to lodge a complaint with your local data protection authority.

9. Security

We protect personal data with the controls described on our Security page, including encryption in transit and at rest, role-based access and a version history of every change. No system is completely secure, and we will notify affected customers and, where the law requires it, regulators, if a breach puts their data at risk.

10. Changes to this policy

We may update this Privacy Policy as our service or the law changes. We will post the new version here with an updated date, and tell customers directly about material changes.

11. Contact

Privacy questions and requests: privacy@finstory.org. Finstory, Inc., 1445 Woodmont Ln NW #1641, Atlanta, GA 30318, USA.