Privacy policy

This Privacy Policy explains how Finic Technologies Inc., doing business as Finic ("Finic," "we," "us"), collects, uses and shares personal information when you visit finic.ai or docs.finic.ai, use the Finic portal at portal.finic.ai, or otherwise interact with us, for example at events or in sales conversations (together, the "Sites").

It does not cover the data our customers submit to the Grayson API or the playground for evaluation ("Customer Data"). We process Customer Data on our customers' behalf under our Master Services Agreement and Data Processing Addendum, which include our zero data retention commitment. If your information is in Customer Data, for example because you are a customer of a bank that uses Grayson, please contact that organization about your rights.

Information we collect

Account information. When you create a Finic account, we collect your name, work email address and password. We store your password only as a salted hash. If you sign in with Google, we receive your name, email address and Google account identifier from Google.

Organization information. The name of your organization, its members and their roles, and invitations, including the email addresses of people invited.

Sign-in and security information. One-time sign-in codes (stored as hashes and deleted after use or expiry), session records, and IP addresses and email addresses used to limit repeated sign-in attempts, which we keep for up to two days.

Billing information. When an admin buys credit, Stripe, our payment processor, collects payment details, billing address and any tax ID on its own checkout page. We give Stripe your organization's name and the admin's email address as the billing contact. We store Stripe's customer identifier, a record of each purchase with a link to its receipt, your organization's credit balance and the cost of each request. We never receive or store card details.

Usage information. Metadata about API and playground requests, such as time, API key, model, status, number of questions, input tokens, cost and latency, as described in the Data Processing Addendum; records of actions in the portal, such as creating or revoking API keys and inviting members; and records of your acceptance of our policies.

Communications. What you send us when you contact support or sales, sign up for updates, or register for events, such as your name, email address, job title, company and the content of your message.

Device and log information. When you visit the Sites, our servers and hosting providers receive technical information such as your IP address, browser type, operating system, referring page and the pages you request.

Cookies and browser storage. The portal uses a cookie to keep you signed in and a short-lived cookie to complete Google sign-in. It also stores preferences, and answers from playground runs, in your browser; those answers stay in the current tab and are not sent to us for storage. Buying credit, and managing receipts, billing details and tax IDs, take place on pages operated by Stripe, under Stripe's own privacy policy. We do not use advertising cookies, and we do not use cookies to track you across other websites.

How we use information

We use personal information to:

• provide, maintain and secure the Sites and our services, including Grayson, including authenticating you and preventing abuse;
• process payments and keep billing records;
• send you service messages, such as sign-in codes, invitations, security notices and changes to our policies;
• respond to your questions and provide support;
• understand and improve how the Sites and services are used, using aggregated usage information;
• send you product news and invitations to events, where the law allows, which you can opt out of at any time; and
• comply with the law, enforce our agreements and protect the rights and safety of Finic, our customers and others.

We do not use personal information to train models, and we do not sell personal information or share it for cross-context behavioral advertising.

How we share information

We share personal information only as follows:

• Your organization. Members of your portal organization can see each other's names, email addresses and roles, and admins can see who created API keys and who was invited.
• Service providers that process it on our behalf under contracts that restrict their use of it: Amazon Web Services (hosting), Stripe (payments, receipts and tax), Resend (email delivery), Google (sign-in, if you choose it), Vercel (hosting for the documentation site), and the providers of our business email and productivity tools.
• Legal and safety. When we believe disclosure is required by law or legal process, or needed to protect the rights, property or safety of Finic, our customers or others, or to investigate fraud or security issues.
• Business transfers. In connection with a merger, acquisition, financing or sale of assets, subject to confidentiality obligations.
• With your consent or at your direction.

Retention

We keep personal information for as long as needed for the purposes above:

• Account and organization information: while your account is open, and deleted within thirty (30) days after you or your organization ask us to close it at support@finic.ai, except what we keep as billing records.
• Usage metadata: while your organization's account is open and for seven (7) years after it closes, as part of our billing records.
• Billing records: for as long as tax and accounting laws require, generally seven (7) years.
• Security and audit records (sign-ins, policy acceptances and actions in the portal, such as creating API keys): for as long as needed to secure our services and show what was agreed. When your account is deleted, the records we keep no longer include your name or email address, except that an organization's own records may show invitations it sent to your address.
• Communications: for as long as needed to respond to you and keep a record of our relationship, generally no longer than three (3) years after our last contact.
• Server logs: up to thirty (30) days.

Your rights

Depending on where you live, you may have the right to know what personal information we hold about you, to access it, correct it, delete it or receive a copy of it, to object to or restrict certain processing, and to withdraw consent. California residents also have the right to know the categories of personal information we collect, use and disclose, described in this policy, and not to be discriminated against for exercising their rights.

To exercise these rights, email support@finic.ai. We will verify your request by confirming you control the email address on your account or used in your communications with us. You may use an authorized agent, whom we may ask to show proof of authorization. We will respond within the time the law requires. You can also delete saved playground requests in the portal at any time, and unsubscribe from marketing emails using the link in them.

If you are in the European Economic Area or the United Kingdom, we process your personal information to perform our contract with you or your organization, for our legitimate interests in running and securing our services and communicating with business contacts, to comply with legal obligations, and with your consent where required. You may lodge a complaint with your local data protection authority.

Security

We protect personal information with measures including encryption in transit and at rest, hashed credentials, one-time codes for password sign-in, access controls and monitoring. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

International transfers

We are based in the United States and process personal information there. If you access the Sites from outside the United States, your information will be transferred to, and processed in, the United States, where data protection laws may differ from those in your country. Where the law requires, we use appropriate safeguards for such transfers.

Children

The Sites and services are for businesses and are not directed to anyone under 18. We do not knowingly collect personal information from children. If you believe a child has given us personal information, contact us and we will delete it.

Changes

We will post any changes to this policy here and update the effective date. If a change is material, we will notify you by email or in the portal before it takes effect.

Contact

Finic Technologies Inc., 209 Kearny St., San Francisco, CA 94108. Email: support@finic.ai.