finly
← Back

Privacy Policy

Last updated: September 25, 2026

Finly handles information about your money, and we take that seriously. This policy explains what personal information we collect, why, who we share it with, and the choices and rights you have, including under the California Consumer Privacy Act as amended by the CPRA (CCPA) and other U.S. state privacy laws.

1. Who we are

Finly is operated by Wealthia S.A.S., a company based in Quito, Ecuador (“Finly,” “we,” “us”). For anything about your data, email contacto@usefinly.app.

2. What we collect

  • Account details: name, email, password (stored only as a hash), country, city, currency, time zone, plan and how you heard about Finly. If you sign in with Apple or Google, we receive your email and an ID for that account.
  • Financial information you enter: expenses, income, accounts, wallets, goals, budgets, recurring bills, debts, money owed to you and notes. We never ask for your bank password, and Finly does not connect to your bank.
  • Files and messages you send: PDF bank statements (kept in your account), receipt photos (read, then discarded; only the transaction is kept), voice notes (turned into text, then discarded; only the text is kept), bank emails you forward (read to create the transaction; the email itself is not kept) and your chat history with the assistant.
  • WhatsApp: if you link your number, we keep the number, the ID Meta assigns to it and your messages with the bot.
  • Shared groups and households: expenses, splits and allowances you record with other people. Members of a group see what belongs to that group.
  • Student profile (optional): type of school, school name, program, year, allowance, source and amount of monthly income, and school email, used for student pricing.
  • Learning and progress: lessons completed, points, league, achievements and referral code.
  • Subscription details: plan, dates and billing status we receive from the app stores or dLocal. We don’t receive your card number.
  • Device and usage information: IP address, device type, operating system, app version, push notification token, screens and features used, and error reports.

We collect this from you, from your device, and from the services you choose to connect (Apple, Google, WhatsApp, the app stores). If you add information about other people, such as someone who owes you money, please add only what you need.

3. How we use it

  • To provide the Service: keep your account, record and show your finances, read the photos, PDFs, voice notes and emails you send, answer you in the chat and on WhatsApp, run shared groups, process your subscription and give support.
  • To keep Finly safe: prevent fraud and abuse, and fix bugs.
  • To improve Finly: understand which features get used.
  • To send you account messages and, if you allow them, notifications. Product emails always include a way to opt out.
  • To meet legal obligations, such as keeping billing records and responding to lawful requests.

Finly’s AI categorizes transactions and suggests actions. It does not make decisions that have legal or similarly significant effects on you, such as decisions about credit, housing, employment or insurance.

4. Who we share it with

We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined in the CCPA. We don’t use targeted advertising, and there are no ad pixels or ad networks in Finly. We share personal information only with:

Service providers that process it on our behalf and only for the purposes above:

  • Supabase (United States (Virginia)): database, sign-in and the files you upload, such as PDF bank statements.
  • Vercel (United States): hosting for the website and the app's servers.
  • Anthropic (United States): Claude models for the chat, the WhatsApp bot, and reading receipt photos, bank statements and the emails you forward. It does not use that content to train its models.
  • Groq (United States): turning your voice notes into text. We don't keep the audio, only the text.
  • Meta (WhatsApp) (United States): the WhatsApp channel, if you choose to link your number. Meta also handles those messages under its own terms.
  • Resend (United States): sending account emails and receiving the bank emails you forward to us.
  • RevenueCat (United States): verifying and managing subscriptions bought on the App Store and Google Play.
  • Apple (United States): App Store billing, Sign in with Apple and iPhone notifications.
  • Google (United States): Google Play billing, Sign in with Google and Android notifications (Firebase Cloud Messaging).
  • dLocal (Uruguay and the country where the payment is processed): card payments on the website (dLocal Go). We never store your card number.
  • PostHog (United States): product analytics: which screens and features get used, linked to your account (ID, email, name and plan). A few events include an amount, such as a debt you create. It does not record your screen or read your transactions.
  • Sentry (United States): technical error reports (app version, device, internal ID) so we can fix bugs.
  • Simple Icons (global network): serves some merchant logos shown in the app; your device requests the image, so it sees your IP address.

Other people you choose: members of a group or household you create or join.

Authorities and legal matters: when the law requires it, or to protect our rights, your safety or the safety of others.

Business transfers: a company that takes over Finly in a merger or acquisition, which would remain bound by this policy.

5. How long we keep it

  • While your account exists, we keep your data to provide the Service.
  • When you delete your account in the app, your account data is deleted right away. Uploaded files and backups are removed within 30 days.
  • Subscription billing records (email and payment details, not your transactions) are kept for up to 7 years for tax purposes.
  • Usage events in PostHog and error reports in Sentry follow those services’ retention periods. Email us if you want them deleted too.

6. Your privacy rights

We honor the following requests from any user in the United States, whether or not a state law requires it:

  • Right to know and access: the categories and specific pieces of personal information we have about you, where it came from, why we use it and who we disclose it to.
  • Right to delete your personal information, subject to legal exceptions such as billing records.
  • Right to correct inaccurate information.
  • Right to portability: get your data in a usable format. You can export your transactions as a CSV file from your profile.
  • Right to opt out of the sale or sharing of your personal information, targeted advertising and profiling. We don’t do any of these, so there is nothing to switch off, but you can still send the request.
  • Right to limit the use of sensitive personal information. The only sensitive information we collect is your account login (email and password), and we use it only to sign you in, so there is nothing to limit.
  • Right to non-discrimination: we won’t treat you differently for using any of these rights.

How to make a request. Email contacto@usefinly.appfrom the email on your account, or use the tools in the app (edit your profile, export, delete your account). We may need to verify your identity before we act. You can also use an authorized agent; we may ask for proof that the agent is allowed to act for you. We respond within 45 days, and if we need more time (up to another 45 days) we’ll tell you why.

Appeals.If you live in a state that gives you the right to appeal (for example Virginia, Colorado, Connecticut or Texas) and we decline your request, reply to our answer with “Privacy appeal” in the subject line. We’ll respond within the time your state’s law requires. If you disagree with the result, you can contact your state Attorney General.

Global Privacy Control.If your browser sends a Global Privacy Control signal, we treat it as a request to opt out of sale and sharing. Because we don’t sell or share personal information, nothing else changes. We don’t track you across other websites, and we respond to “Do Not Track” signals the same way.

7. California disclosures

In the last 12 months we collected these categories of personal information, for the purposes and from the sources described above:

  • Identifiers (name, email, phone number if you link WhatsApp, account IDs, IP address).
  • Personal records under Cal. Civ. Code § 1798.80(e) (the financial details you enter).
  • Commercial information (your subscription and purchase history).
  • Internet or other electronic network activity (usage events and error reports).
  • Audio information (voice notes, which we transcribe and discard).
  • Education information you choose to share for student pricing.
  • Inferences (automatic categories of your transactions and your Finly score).
  • Sensitive personal information (your account login: email and password).

We disclosed each category to the service providers listed in section 4 for a business purpose. We have not sold or shared personal information, and we have no actual knowledge of selling or sharing information of consumers under 16. We use sensitive personal information only to provide the Service, which the CCPA allows without offering a right to limit.

8. Children

Finly is not directed to children under 13, and we don’t knowingly collect personal information from children under 13, as required by the Children’s Online Privacy Protection Act (COPPA). If you are a parent or guardian and believe a child under 13 has given us information, email contacto@usefinly.appand we will delete it. Teens between 13 and 17 may use Finly only with a parent’s or guardian’s permission.

9. Security

We use encrypted connections (HTTPS/TLS), encryption at rest provided by our infrastructure providers, database rules so each person can only reach their own data, hashed passwords and restricted internal access. No system is perfectly secure, but if a breach affects your personal information, we will notify you as the law requires.

10. International transfers

Finly is operated from Ecuador. Your data is stored in the United States (Supabase, in Virginia) and some of our service providers process it in other countries. Wherever it is processed, we protect it as this policy describes.

11. Cookies and similar technologies

  • Essential: keep you signed in and protect your account. Sign-in doesn’t work without them.
  • Preferences: remember choices such as dark mode, hiding balances or the country of the home page.
  • Analytics (PostHog): cookies and local storage that show us how Finly is used, as described above.

We don’t use advertising cookies or social media pixels. You can block or delete cookies in your browser settings; if you block essential cookies, sign-in may stop working. To opt out of analytics, email contacto@usefinly.app.

12. Changes to this policy

We may update this policy when Finly or the law changes. The date at the top shows the latest version. If a change is material, we’ll email you.

13. Contact

Wealthia S.A.S. (Finly), Quito, Ecuador. Privacy requests: contacto@usefinly.app. See also our Terms of Service.