Privacy Policy
Last updated: October 9, 2026
This Privacy Policy explains how FinSpot collects, uses, stores, and protects your personal data when you use our services, in accordance with the EU General Data Protection Regulation (GDPR) and applicable Polish law.
1Data Controller
The controller of your personal data is Override Technologies. For all privacy matters, including data protection requests, you can contact us at privacy@finspot.live.
2Information We Collect
We collect information you provide directly: account data (name, email), financial data you enter or import (transactions, budgets, credits, goals), and payment-related data processed by Stripe. We also collect technical and usage data (log data, device and browser information, IP address) automatically when you use the service.
3How We Use Your Information
We use your data to: provide and maintain the service, process and analyze the financial data you enter, generate reports and insights, process payments, communicate with you, ensure security and prevent fraud, comply with legal obligations, and improve the service.
4Legal Basis for Processing
We process personal data on the following legal bases (Art. 6 GDPR): performance of our contract with you (Art. 6(1)(b)) to provide the service; your consent (Art. 6(1)(a)) for optional cookies and optional features; compliance with legal obligations (Art. 6(1)(c)), such as accounting and tax rules; and our legitimate interests (Art. 6(1)(f)) in securing the service, preventing fraud, and improving our product. You may withdraw consent at any time without affecting prior processing.
5Data Storage and Security
We protect your data with encryption in transit (HTTPS/TLS), secure authentication with optional multi-factor authentication, and access controls that limit personal data to authorized personnel. We describe only the measures we actually operate and update this policy as our security program evolves.
6Data Sharing and Processors
We do not sell your personal data. We share data only with processors who help us operate the service under data processing agreements: Contabo GmbH (server hosting in Germany, EU), Backblaze (encrypted off-site database backups in its EU region, kept for 14 days and unreadable to Backblaze), Cloudflare (DNS, the Turnstile bot check on sign-in, sign-up and password reset, which processes your IP address and browser signals, and forwarding of emails sent to @finspot.live addresses), Stripe (payment processing), OpenAI (AI advisor - only the chat content you submit) and Resend (transactional email delivery). Analytics (Umami) and telemetry (SigNoz) are self-hosted on our own servers and do not involve third-party recipients. We may also disclose data where required by law or to protect our legal rights.
7Imported Data
If you choose to import statements or transactions (for example, via CSV files), we process only the data needed to provide the feature. Imported data is stored in your account, and you can edit or delete it at any time.
8Cookies and Tracking
We use two essential cookies that keep you signed in (__Host-access_token and __Host-refresh_token), set by our own server and unreadable by page scripts. Your cookie choices and preferences such as language, currency and theme are kept in your browser's local storage. With your consent, we load self-hosted, cookieless analytics (Umami) - usage data stays on our own infrastructure, and withdrawing consent stops it immediately. When you create an account, we save with it how you first reached FinSpot: the campaign parameters in the link (utm_source, utm_medium, utm_campaign, utm_term, utm_content), the first page you opened and the domain of the referring website, so we can see which channels bring new users (our legitimate interest). If you consent to analytics, your browser also keeps this record in local storage (finspot_first_touch) so it is remembered between visits; we remove it when you withdraw that consent. We do not use marketing cookies or third-party trackers. You can manage or withdraw consent at any time via the cookie banner, "Cookie Settings" in the footer, "Cookie preferences" in Settings, or your browser. See our Cookie Policy for details.
9International Data Transfers
All application data, including the database, analytics and telemetry, is stored on our servers hosted by Contabo GmbH in Germany (EU), and database backups are encrypted by us before being stored in an EU region by Backblaze. Some providers are US companies - Stripe, OpenAI, Resend, Cloudflare and Backblaze - so personal data they handle may be transferred to or accessed from the United States. For these transfers we rely on appropriate safeguards under Chapter V GDPR, such as the European Commission Standard Contractual Clauses or an adequacy decision (including the EU-U.S. Data Privacy Framework). A copy of the relevant safeguards is available on request.
10Data Retention
We retain your personal data for as long as your account is active. After account deletion, your personal data is fully deleted within 30 days, except where longer retention is required by law (for example, accounting and tax records, which under Polish law are kept for 5 years) or to establish or defend legal claims.
11Your Rights
Under the GDPR you have the right to: access your data; rectify inaccurate data; erase your data ("right to be forgotten"); restrict processing; data portability; object to processing based on legitimate interests; and withdraw consent at any time. You can export a complete copy of your data at any time from your account settings as a ZIP file (containing JSON and CSV exports of all your data). For very large accounts, the export is prepared asynchronously and you will receive a download link when ready. We do not make decisions producing legal effects based solely on automated processing. To exercise your rights, contact privacy@finspot.live; we respond within one month.
12Right to Lodge a Complaint
If you believe we process your data unlawfully, you have the right to lodge a complaint with a supervisory authority. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl. You may also contact the authority in your EU country of residence.
13International Waitlist
If you live in a country where paid plans are not sold yet, you can join the waitlist for FinSpot Premium without an account. We collect your e-mail address, country, language, where you signed up (for example the waitlist page or the plan picker), campaign tags from the link you followed if it had any, and the time of your consent with the privacy policy version you agreed to. We use them only to send you the confirmation e-mail and one e-mail when Premium becomes available in your country. The legal basis is your consent (Art. 6(1)(a) GDPR). Waitlist data is stored in a database separate from FinSpot accounts. Unconfirmed sign-ups are deleted after 30 days. Confirmed entries are kept until you leave the waitlist or until 6 months after Premium launches in your country, whichever comes first. You can withdraw your consent at any time with the leave link in every waitlist e-mail or by writing to privacy@finspot.live; this deletes your entry.
14Changes to this Privacy Policy
We may update this Privacy Policy periodically. We will notify you of significant changes via email or through the application, and update the "last updated" date above.
Related Documents
Contact Us
For privacy-related questions or to exercise your rights, contact us at privacy@finspot.live.
privacy@finspot.live