Who is responsible for your data
The controlling legal entity has not been named yet, which is why this document is marked as a draft above. Until it is, no controller is identified and this policy is incomplete.
Where you use Finomium as part of another organisation's account, that organisation is the controller of the data inside it and we act on their instructions. This policy then describes what we do as the processor.
What we collect
The list below is taken from the database schema rather than written generically, so it describes columns that actually exist.
Account and identity
- Email address, first and last name, and phone or mobile number where you supply one.
- A password, stored only as a bcrypt hash. We cannot read it, and we cannot recover it for you - a reset replaces it.
- Multi-factor secrets, recovery codes and passkey (WebAuthn) credentials, where you enable them. TOTP secrets are encrypted at rest with a key held outside the database.
- If you sign in through Google, an enterprise SAML provider or LDAP, the identifier that provider gives us and the tokens needed to keep the session working. These are encrypted at rest.
- Your membership of tenants and the roles you hold in them.
Technical and security records
- IP address and browser user-agent, recorded against sign-in sessions. This is what lets you see and revoke your own active sessions, and it is what account lockout and rate limiting act on.
- Failed sign-in counts and lockout records, kept so that repeated attempts against your account can be slowed down.
- If you follow a short link we generated, the visit is recorded with an IP address.
Content you put into the platform
- Files you upload, and the metadata needed to serve them back.
- Calendar events and availability, email campaigns and recipient lists, workflow tasks and their history, and the rules you define.
Billing
- Subscription and plan records, and an identifier linking your account to the payment processor. We do not store card numbers - those go directly to the processor and never reach our servers.
Data that leaves your browser before you sign up
Two things on these public pages send data to Google before you have an account or have agreed to anything, and both are disclosed here because they are easy to overlook:
- Fonts. The typefaces are served from Google Fonts, so loading any page sends your IP address to Google. Self-hosting them removes this, and is the fix if that matters to you or your users.
- reCAPTCHA. The sign-up form is protected by Google reCAPTCHA, which receives your IP address and interaction signals in order to judge whether you are a bot. Google's terms and privacy policy apply to that processing.
Who else processes your data
| Who | What for | What they receive |
|---|---|---|
| Vercel | Hosting the website | Request logs, including IP address |
| Fonts, reCAPTCHA, and Google sign-in if you use it | IP address, interaction signals, and your Google account identifier if you sign in with it | |
| Stripe | Card payments | Payment details, entered directly with them |
| PayPal | PayPal payments | Payment details, entered directly with them |
| Braintree | Card, Apple Pay and Google Pay payments | Payment details, entered directly with them |
Outbound email is sent from our own mail servers rather than a third-party delivery service, so the contents of a message we send you are not shared with another provider in order to deliver it.
We do not sell personal data, and there is no advertising or analytics tracking on this site at all - no Google Analytics, no advertising pixels, nothing that follows you elsewhere.
How long we keep it
Account data is kept for as long as the account exists. Some records have their own, shorter life built into the software: one-time codes, password-reset tokens, sign-in tickets and multi-factor challenges all carry an expiry and stop being usable when it passes.
Formal retention periods for the remaining categories - security logs in particular - have not been set yet. They should be, and this section should say what they are rather than saying that.
Your rights
Depending on where you live, you may have the right to see the data we hold about you, correct it, have it deleted, take it elsewhere in a portable form, or object to some of the ways it is used. If you are in the UK or EU, these rights come from the GDPR; California, Brazil and several other jurisdictions grant comparable ones.
To exercise any of them, email support@finomium.co. You also have the right to complain to your local data protection authority.
If you use Finomium through your employer or another organisation, send the request to them first - they control that data and we act on their instructions.
Security
How the platform is built to protect this data - password hashing, encryption of secrets at rest, the session model that keeps tokens out of browser JavaScript, and how to report a vulnerability - is described on the security page.
Changes
When this policy changes, the date at the top changes with it. If a change materially affects how we handle your data, we will tell account holders directly rather than relying on you to re-read the page.