Privacy Policy — FinBaze

Status: Published
Version: 2026-10-09
Last updated: 9 October 2026
Contact: info@finbaze.com

This Privacy Policy explains how FinBaze processes personal data when you visit our websites, contact us, or use the FinBaze bookkeeping platform, mobile applications, integrations, AI features, WhatsApp channel, API or Model Context Protocol functionality.

It should be read together with our Terms of Service, AI and Acceptable Use Addendum and, where FinBaze processes personal data on behalf of a customer, our Data Processing Agreement.

---

1. Who we are

This policy covers:

Together, these entities are referred to as FinBaze, we, us or our.

Questions and privacy requests may be sent to info@finbaze.com. We will route a request to the appropriate entity where necessary.

2. Our data-protection roles

The applicable role depends on the customer and processing activity:

• FinBaze B.V. is typically the controller for accounts, billing, marketing-site activity, sales enquiries and support relating to customers in the European Union and the Netherlands.
• FinBaze Limited is typically the controller for accounts, billing and related servicing of customers in the United Kingdom.
• For bookkeeping content stored in a company workspace, the customer or relevant bookkeeping firm is normally the controller and FinBaze acts as processor on its instructions.
• A bookkeeping firm and its client remain responsible for determining their respective roles and providing any notices required for their relationship.
• FinBaze may use additional or replacement group entities as its business develops. We will update this policy where that materially changes who is responsible for processing.

FinBaze may separately act as controller where it must process information for security, fraud prevention, its own legal obligations or the administration of its customer relationship.

3. Whose data we process

We may process personal data relating to:

• account holders, authorised users and people invited to the platform;
• customers, suppliers, employees and other contacts recorded in customer bookkeeping;
• staff and clients of bookkeeping firms;
• people using enterprise or developer environments;
• website visitors, prospective customers and support contacts;
• people sending documents by email or communicating through WhatsApp;
• persons represented in invoices, bank transactions, tax filings, documents or connected services; and
• FinBaze personnel and authorised contractors.

FinBaze is intended only for businesses and professionals. It does not support use by children or the storage of children's personal data.

4. Personal data we process

Depending on how FinBaze is used, we may process:

Account and identity information

Names, business contact details, profile images, language preferences, login and authentication information, social sign-in identifiers, verification status, registered devices and security information.

Business and workspace information

Company names, addresses, registration and tax numbers, workspace memberships, user roles, bookkeeper or enterprise relationships, invoicing settings and configured email-delivery information.

Bookkeeping and financial content

Customer and supplier details, invoices, quotes, credit notes, reminders, accounting entries, reports, bank-account and payment information, imported transactions, tax records and submissions, document images, PDFs, extracted text and related correspondence.

Integrations and communications

Information received from or sent to banks, payment providers, online shops, government services, company registers, email providers, WhatsApp, calendar tools and other integrations enabled by a customer. Where a customer connects a mailbox, including Gmail, FinBaze monitors it only for invoice-related keywords in the subject, message or attachment name, and only where the message has a document attachment. Any other email is discarded and its content is not stored. FinBaze keeps only the mailbox provider's message identifier for a discarded email, so that the same message is not read again. Data kept from Gmail is Google Workspace API user data, limited to matching messages and the attachments needed to import those documents. Google Workspace API user data is strictly excluded from being used to train or improve FinBaze's in-house generalized AI/ML models. The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

AI and automation data

Prompts, documents, messages, relevant bookkeeping context, generated answers, extracted information, feedback and records needed to operate, secure and improve AI-assisted features.

Technical and security data

IP addresses, browser and device information, timestamps, access records, administrative audit records, infrastructure logs, diagnostic information and evidence of suspected abuse or security incidents. Infrastructure and access logs are retained through Aurtic's logging service as needed for operation, security and investigation.

Website, platform and app analytics

On the FinBaze marketing website and the bookkeeping platform (web), Google Analytics and Microsoft Clarity may process pages viewed, referral source, approximate location derived from IP address, browser and device type, time on page, clicks, mouse movement, scroll behaviour, session recordings and similar usage information. The FinBaze mobile applications also use Microsoft Clarity, which may process screens viewed, taps, gestures, device information, approximate location derived from IP address, heatmaps and session recordings. On the bookkeeping platform (web) and in the mobile applications, on-screen text and form fields are masked in Clarity recordings so that bookkeeping content is not captured.

We do not request special-category personal data. Customer documents may nevertheless contain such information. Customers must only provide it where necessary, lawful and permitted by the AI and Acceptable Use Addendum.

5. Why we process data and our legal bases

Where FinBaze acts as processor, the customer's documented instructions and the Data Processing Agreement govern the processing.

6. How we disclose data

We do not sell personal data. We disclose it only where needed to provide and secure the service, comply with law, protect legal rights, complete a corporate transaction, or follow a customer's instructions.

Our service providers, sub-processors and other recipients include:

Some recipients, such as government bodies or customer-selected integration providers, may act as independent controllers rather than processors.

We may update this list when providers change. Material changes affecting processor relationships are handled in accordance with the Data Processing Agreement.

7. International transfers

FinBaze's primary hosting is in France, within the European Union. Some providers may process data outside the European Economic Area or the United Kingdom.

Where required, we use recognised safeguards such as adequacy regulations or decisions, the European Commission's Standard Contractual Clauses, the UK International Data Transfer Agreement or UK Addendum, and appropriate supplementary measures.

Customer-enabled integrations and external AI hosts may make transfers under the customer's own agreement with those providers.

8. AI, automation and model improvement

FinBaze may process Customer Data to provide, secure, evaluate, improve and train FinBaze's own models and product features. We apply access controls and seek to minimise or de-identify data where reasonably appropriate. Google Workspace API user data is strictly excluded from being used to train or improve FinBaze's in-house generalized AI/ML models.

The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

Under FinBaze's arrangements with Anthropic, OpenAI, Google and Amazon, those providers do not use Customer Data submitted by FinBaze to train their general-purpose models.

AI outputs may be inaccurate, incomplete or outdated. Customers must verify outputs before relying on them, particularly for accounting, tax, legal, filing or payment decisions.

If you connect FinBaze through Model Context Protocol or similar functionality to an AI host selected by you, that host receives the information you authorise under your separate agreement with it. You are responsible for assessing and configuring that host.

9. WhatsApp and messaging

WhatsApp functionality uses Bird / MessageBird and the WhatsApp ecosystem. Messages and attachments may be processed to deliver requested functionality, including document intake and AI-assisted responses.

FinBaze configures Bird without message-content retention. Other participants in the communications chain, including WhatsApp or a recipient's device, may process information under their own terms.

Do not use WhatsApp to send information that is unnecessary, unlawful or unsuitable for that channel.

10. Security, hosting and backups

FinBaze uses technical and organisational measures appropriate to the risks, including:

• hosting in France within the European Union;
• encryption in transit and at rest;
• role-based access controls;
• access and administrative logging;
• restricted personnel access;
• backup, recovery and monitoring measures; and
• contractual controls for service providers.

Backups are retained for up to three years. Backup copies are access-restricted and used for continuity and recovery. Information restored from a backup remains subject to the applicable deletion request and retention rules.

No security measure can eliminate every risk. Suspected incidents should be reported promptly to info@finbaze.com.

11. Retention and deletion

We retain personal data only for as long as needed for the purposes described above or to meet legal, accounting, tax, dispute-resolution and security requirements.

Deleted records are usually first soft-deleted (marked deleted and removed from ordinary use) rather than erased immediately.

• Operational records that are soft-deleted and are not required for bookkeeping, tax or similar statutory archives — for example removed catalogue items, unused Drive files, or similar workspace settings — may be permanently purged from active systems after about one month.
• Bookkeeping, tax, payroll wage records and related filings remain subject to longer retention. Where FinBaze acts as processor, the customer determines the statutory period and instructs FinBaze. Dutch accounting obligations, for example, commonly require records to be retained for seven years. Soft-deleted bookkeeping and tax records are not age-purged on the one-month schedule.
• Employee national-identification data (such as a Dutch BSN) that has been cleared in the product is withdrawn from active use by soft-delete. Encrypted residual copies may remain until a separate hard-purge after a configured hold period aligned with applicable law and customer instructions.
• When an account or workspace ends, relevant data may first be soft-deleted or made inaccessible. Unless law or the customer's instructions require longer retention, it will be permanently purged from active systems no later than one year afterwards.

Residual copies may remain in access-restricted backups for the backup lifecycle of up to three years and are not used for ordinary business purposes.

12. Your rights

Subject to applicable law, you may have rights to:

• access your personal data;
• correct inaccurate data;
• request deletion;
• restrict processing;
• receive portable data;
• object to processing based on legitimate interests;
• withdraw consent at any time where processing relies on consent; and
• complain to a supervisory authority.

Requests are handled manually through info@finbaze.com. Full account deletion and comprehensive privacy exports are not currently entirely self-service. We may request information needed to verify identity and authority.

Where FinBaze acts as processor, we may refer the request to the customer or bookkeeping firm responsible for the relevant workspace.

You may complain to:

• the Autoriteit Persoonsgegevens: autoriteitpersoonsgegevens.nl; or
• the Information Commissioner's Office: ico.org.uk.

You may also contact another supervisory authority competent for your residence or workplace.

13. Cookies

FinBaze uses functional cookies and similar storage needed for security, language selection, navigation and remembering workspace preferences.

The FinBaze marketing website and bookkeeping platform (web) also use Google Analytics 4 and Microsoft Clarity to measure how visitors and users use those surfaces and to improve them. The FinBaze mobile applications use Microsoft Clarity for the same purpose.

Google Analytics 4 may set cookies (including _ga and _ga_*) and process technical data such as IP address (which Google Analytics 4 truncates), browser and device information, pages viewed, time on page and referral source. Google Ireland Limited and Google LLC provide this service. Information may be processed outside the European Economic Area or the United Kingdom, including in the United States, using the safeguards described in section 7. Google's own privacy information is at policies.google.com/privacy. You can opt out of Google Analytics by installing Google's browser add-on. Mobile applications do not use Google Analytics.

Microsoft Clarity may set first-party cookies on the websites (including _clck and _clsk) and Microsoft third-party cookies (including CLID, ANONCHK, MR, MUID and SM). In the mobile applications, the Clarity SDK may store a device- or install-level identifier instead of browser cookies. Clarity may process technical data such as IP address, approximate location, browser, device and app information, pages or screens viewed, clicks or taps, mouse movement or gestures, scroll behaviour, heatmaps and session recordings. On the bookkeeping platform (web) and in the mobile applications, on-screen text and form fields are masked so that bookkeeping content is not captured in recordings. Microsoft Ireland Operations Limited and Microsoft Corporation provide this service. Information may be processed outside the European Economic Area or the United Kingdom, including in the United States, using the safeguards described in section 7. Microsoft's privacy information is at privacy.microsoft.com/privacystatement.

You can block or delete cookies through your browser settings. Blocking cookies may stop some preferences or functionality from working. You may also object to this processing as described in section 12.

Third-party interfaces you choose to use, such as Google's calendar functionality, may set cookies under their own policies.

14. Children

FinBaze is a business service and does not support children's accounts or children's personal data. Customers must not submit such data.

If you believe children's personal data has been provided to FinBaze, contact info@finbaze.com so that appropriate action can be taken.

15. Changes to this policy

We may update this policy to reflect legal, organisational or product changes. The current version and last-updated date will be published on this page. We will provide additional notice of material changes where appropriate or legally required.

16. Contact

FinBaze B.V.
Lutherse Kerkstraat 3
9611 JK Sappemeer
The Netherlands

FinBaze Limited
61 Bridge Street
Kington, HR5 3DJ
United Kingdom

Email: info@finbaze.com