Finch Privacy Policy

Last updated: 26.10.2026

This Privacy Policy explains how Finch Ventures BV ("Finch", "we", "us", or "our") collects, uses, and protects your personal data when you use the Finch mobile application and website (together, the "Services").

Finch is a B2C personal finance application that helps individuals understand and manage their finances through secure account aggregation, analytics, and personalised insights.

We process personal data in accordance with:

• The Swiss Federal Act on Data Protection (FADP)
• The EU General Data Protection Regulation (GDPR)

1. Data Controller

Finch Ventures BV
Therese Schwartzestraat 11
2549XK, Den Haag, Nederland
Email: support@finch-agent.com

2. Scope – B2C Users Only

Finch is provided exclusively to private individuals for personal use. This Privacy Policy applies only to consumer (B2C) users and does not cover business or employer-provided services.

3. Personal Data We Collect

We collect only the data necessary to operate Finch securely and to provide meaningful financial insights.

3.1 Data You Provide Directly

• Full name
• Email address
• Account credentials (securely hashed and encrypted)
• Subscription status (freemium or paid tier)
• Communication with customer support
• User preferences and settings

3.2 Financial Data via Open Banking & Banking Interfaces

With your explicit consent, Finch may access financial data via regulated providers, including:

EU / EEA

• Open banking platforms operating under PSD2 (e.g. Account Information Service Providers – AISPs)

Switzerland

• SIX bLink platform for secure financial data connectivity
• Swisscom infrastructure for identity, consent management, and secure transmission where applicable

Data accessed may include:

• Account balances
• Transaction history
• Merchant names and transaction descriptions
• Categories and timestamps

3.3 Automatically Collected Data

• Device and app information (OS, version)
• App usage and feature interaction
• Crash reports and performance logs
• IP address (anonymised or truncated where possible)

4. Freemium vs. Paid Features – Data Usage Distinction

4.1 Freemium Tier

The free version of Finch provides basic account aggregation, high-level financial overviews, and limited insights and summaries.

Legal basis: Contract performance (Art. 6(1)(b) GDPR)

4.2 Paid / Premium Tier

Paid users receive advanced analytics, forecasting, deep transaction categorisation, AI-powered personalised financial insights, and historical trend analysis. Personal API keys are also available exclusively on paid plans.

5. Purposes of Processing

We process personal data for the following purposes:

• Providing and maintaining the Finch app
• Secure authentication and user verification
• Generating personalised financial insights
• Subscription management and billing
• Customer support
• Product improvement and analytics
• Legal and regulatory compliance

6. Automated Processing & AI

Finch uses automated processing and AI-based systems to:

• Categorise transactions
• Identify spending patterns
• Read scanned documents
• Power the in-app assistant and generate insights and recommendations

These processes do not produce legal or similarly significant effects, remain explainable at a high level, and can be limited or disabled by the user where applicable.

7. Cookies, Analytics & Tracking

Finch uses minimal and privacy-focused analytics.

Finch does not use data collected from the app for cross-app tracking or advertising purposes, as defined by Apple, unless the user explicitly consents. Such consent may be requested, for example, for personalised analytics intended to optimise app functionality and user impact.

Analytics data is:

• Aggregated or pseudonymised where possible
• Never sold
• Not shared for advertising or marketing purposes

Further details are provided in Appendix A – Cookies & Analytics.

8. Data Sharing & Third-Party Processors

We do not sell personal data.

We share data with trusted third-party service providers acting strictly as data processors under contractually bound Data Processing Agreements (DPAs) complying with GDPR and Swiss data protection law:

8.1 Banking & Infrastructure Processors

• EU Open Banking Providers: PSD2-compliant account aggregation platforms.
• SIX bLink (Switzerland): Financial data connectivity.
• Swisscom: Identity, consent management, and secure infrastructure.
• Google Cloud: Hosting provider (Switzerland-based data storage).
• Payment & Monitoring Services: Payment processing, subscription management, error-tracking, and system performance monitoring.

8.2 AI Service Processors

To categorise transactions, read scanned documents, and power the in-app assistant, we use third-party AI model providers:

• Google (Gemini) – Primary Provider: Data is transmitted via API to Google Cloud (processed in EU/EEA regions) to handle automated categorization, OCR document reading, and core assistant interactions under a Data Processing Agreement. Data transmitted via API is not used by Google to train foundation models.
• OpenAI (ChatGPT) – Fallback Provider: Used as a backup processor for transaction categorization and assistant interactions under a Data Processing Agreement with Standard Contractual Clauses (SCCs). Data sent via API is strictly isolated and not used to train OpenAI models.

All third-party service providers act solely on our documented instructions and do not use personal data for their own purposes.

9. Connecting AI Assistants and API Access

Finch lets you connect an AI assistant of your choice (for example Claude by Anthropic, ChatGPT by OpenAI, or Gemini by Google) to your Finch data through our Model Context Protocol (MCP) server, and create personal API keys to read your own data.

9.1 What Happens When You Connect an Assistant

You start the connection in your AI assistant and approve it in the Finch app (using Face ID or your fingerprint where available). The assistant then gets read-only access (data:read scope across 11 MCP tools) to the financial overview Finch already holds about you:

• Accounts and balances
• Transactions
• Investments
• Goals
• Manually tracked assets
• General market overview

Account numbers are masked to their last four digits. The assistant cannot move money, change your data or settings, or make Finch contact your bank.

9.2 Who Receives Your Data

When you ask your assistant a question, the data it needs to answer is sent to the provider of that assistant. That provider acts as an independent controller and processes the data under its own terms and privacy policy, possibly outside Switzerland and the EEA. Finch does not control how the provider uses or stores it. Only connect assistants you trust, and only ask for what you are comfortable sharing.

9.3 What Finch Stores

For each connection and API key we store:

• The assistant's name and registered domain
• The time the connection was created and last used
• Access credentials, which are stored strictly in hashed form

We keep an audit log of which tool was used, when, and by which connection ID. We do not log the questions you ask, the arguments sent, or the data returned.

9.4 Retention & Revocation

• Automatic Expiration: Assistant connections end automatically after 7 days without use. Personal API keys (available on paid plans) expire after the period you choose (30, 60, or 90 days).
• Revocation: You can revoke both assistant connections and API keys at any time in the app under Menu > API keys. Revocations take effect immediately on the assistant's next request.
• Audit Record Retention: Connection and access-log audit records are kept for 12 months for security monitoring and abuse prevention, after which they are permanently deleted. Deleting your Finch account deletes them immediately as well.

10. International Data Transfers

If data is transferred outside Switzerland or the EEA, we rely on:

• Adequacy decisions adopted by the Swiss Federal Council and European Commission, or
• Standard Contractual Clauses (SCCs) issued or approved by the European Commission and adapted for Swiss law.

11. Data Retention

• Active accounts: Retained for the duration of the contract.
• Inactive accounts: Deleted or anonymised after 12 months.
• MCP & API Access Logs: Connection audit records kept for 12 months for security and abuse prevention.
• Legal obligations: Retained as required by applicable commercial and tax law.

12. Your Rights (Including Consent Withdrawal & Deletion)

You have the right to:

• Access your data
• Correct inaccurate data
• Request deletion of your data
• Restrict or object to processing
• Data portability
• Withdraw consent at any time

Account Deletion & Withdrawal of Consent

You may withdraw your consent at any time by deleting your Finch account, which will result in the deletion of all personal data associated with your account.

Account deletion can be initiated directly in the app by navigating to:
Home Screen → Menu → Profile → Delete account, and following the on-screen steps.

Upon deletion, your data will be permanently and irrevocably removed from Finch-operated databases (including active API keys and MCP connection records) as soon as technically and legally possible.

Alternatively, users may request account deletion and consent withdrawal by sending an email to:
📧 support@finch-agent.com

13. Complaints

You may lodge a complaint with:

• Your local EU data protection authority, or
• The Swiss Federal Data Protection and Information Commissioner (FDPIC)

14. Children's Privacy

The Finch app is not permitted for use by individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that a minor has used the app, the account and associated data will be deleted.

15. Changes

We may update this Privacy Policy from time to time. Material changes will be communicated in-app or by email.

Appendix A – Cookies & Analytics Policy

A.1 Essential Cookies

Required for:

• Authentication
• Security
• Core app functionality

These cannot be disabled.

A.2 Analytics & Product Improvement

We use privacy-minimised analytics to understand:

• Feature usage
• Performance issues
• User flows (aggregated, pseudonymised)

Analytics are:

• Limited to what is necessary
• Not used for advertising
• Never sold or shared for marketing purposes

A.3 Personalised Insights & Consent

To provide premium personalised insights, Finch requires:

• Processing of detailed financial behaviour
• User acceptance of the Terms & Privacy Policy

If consent is not granted or is withdrawn:

• Premium services cannot be provided
• Freemium access remains available

Contact

For any questions or issues regarding this privacy policy or additional privacy matters, please contact our team at 📧 support@finch-agent.com