Privacy policy

This policy explains how Finato (“we”, “us”) handles personal and business information when you visit our website, contact us, or use our web and mobile apps and bookkeeping service (the “Service”). It applies to prospective customers, customers and the people who use Finato on a customer’s behalf.

Information you give us. When you contact us or sign up: your name, business name, email, phone number, number of locations and entities, the systems you use, and anything you write in a message. When you use the Service: your account details, the documents you upload (such as back-office reports, invoices and receipts), and answers to our questions about transactions.

Financial account information. When you connect a bank or card account, we receive account and transaction data — account name and type, balances, transactions, and the last digits of the account number — through Plaid, our account-data provider (see “Connected accounts” below). We do not receive your online banking username or password.

Information from your systems and partners. Sales, fuel, lottery and inventory data from your point-of-sale and back-office systems, and invoices or statements from your vendors, where you share them with us or ask us to collect them. If you authorise it, we import your accounting records from your Xero organisation to bring your history into Finato.

Technical information. When you use our website or apps: device type, browser, pages visited and actions taken, and sign-in times. For security we store a keyed hash of your IP address rather than the address itself, together with your browser’s user agent. We use one strictly necessary session cookie (HttpOnly, Secure, SameSite=Lax) and no advertising cookies or trackers.

• To provide the Service: keep your books, reconcile accounts, prepare reports and answer your questions.
• To respond to your enquiries and send you pricing, walkthrough details and service updates.
• To run, secure and improve our website, apps and systems, and to prevent fraud and abuse.
• To bill you and keep the records we are legally required to keep.
• To comply with the law and enforce our terms.

We do not sell your information, and we do not use your financial data to train or improve artificial-intelligence models. In particular, data obtained from Xero’s APIs is never used to train or improve AI models. We only send marketing emails to people who have asked to hear from us, and every one has an unsubscribe link.

Bank and card connections are provided by Plaid Inc. (“Plaid”). By connecting an account, you authorise Plaid to access and transmit your account data to Finato for the purposes described in this policy. Plaid collects and processes that data under the Plaid End User Privacy Policy, which you are shown at the time you connect.

We use connected-account data only to keep your books and provide the Service. Access is read-only; we cannot move money. You can disconnect an account at any time from your Finato account or by contacting us, which stops new data arriving.

We share information only as needed to provide the Service, and never sell it. Recipients may include:

• Service providers that work for us under contract: cloud hosting and storage, the account-data provider for bank connections, email delivery, payment processing for our fees, and support tools. They may use your information only to provide their services to us.
• Your tax preparer, CPA, lender or other adviser — only when you ask us to share with them.
• Authorities when the law requires it, or to protect our rights, our customers or the public.
• A successor if Finato is involved in a merger, acquisition or sale of assets, in which case we will tell you before your information becomes subject to a different policy.

We keep your books and supporting documents for as long as your account is active and for the period required by tax and record-keeping rules afterwards (generally up to seven years). Enquiry details that don’t lead to an account are kept for up to 24 months. Technical logs are kept for a short period for security purposes.

When your account closes, your data stays available for export for 90 days and is then deleted or anonymised, except where we must keep it to meet a legal obligation.

Your information is encrypted in transit and at rest. Each customer’s data is kept separate from every other customer’s, access inside Finato is limited to the people who need it to do your books, and every change to your records is logged. Repeated failed sign-in attempts are throttled and recorded. Our staff are trained on confidentiality, and our service providers are bound by contract to protect your information.

No system is perfectly secure. If a security incident affects your information, we will tell you and the relevant authorities as the law requires.

• You can see, correct or export your business’s books and documents in the app at any time.
• You can ask us to correct or delete personal information, subject to the records we must keep.
• You can disconnect bank and card accounts at any time.
• You can unsubscribe from marketing emails with the link in any message.

Depending on where you live, you may have additional rights under state privacy laws, including the right to know what personal information we hold, to request deletion, and not to be discriminated against for exercising those rights. To make a request, email us at the address below. We will verify your identity before acting on it and respond within the time the law allows.

Our Service is for businesses and is not directed at children under 16. We do not knowingly collect information from children. If you believe a child has given us information, contact us and we will delete it.

We may update this policy from time to time. We will post the new version here with a new “last updated” date and, for material changes, tell you by email or in the app before they take effect.

Questions or requests about your information? Email us at support@finato.ai. Our terms of service describe the contract between us.