What we collect
Your account details (name, email, password hash via Better-Auth). Your onboarding responses (residency status, employment type, tax regime). Every ask you send and answer you get back. Letters and vault documents you upload (encrypted at rest — end-to-end encrypted if you opt in). Invoices you upload or paste for tracking (Invoice Ingest), and broker/investment transaction data if you use the broker-import feature under Settings → Investments. Household member details (name, birthdate, NIF) if you add a spouse or dependent so obligations can be tagged correctly. Saved searches, calendar events, dashboard preferences. Session cookies. If you opt in to analytics, PostHog events (identified by an opaque hash of your user id, never by email). If you mention identifiers like your NIF or NISS in a conversation or in an uploaded document, the assistant will store them on your profile so it can reason about your tax situation — you can view or delete them under Settings → Profile → Extras. Separately, our broker capital-gains calculator at /tools/broker-capital-gains never sends your transaction data anywhere — it parses the CSV you paste entirely in your browser.
What we don't collect
Third-party trackers. Advertising IDs. Cross-site cookies. Marketing pixels. Payment card numbers (Stripe handles those directly once you subscribe). The one opt-in exception is your Portal das Finanças login, if you choose to connect it — see "AT (Portal das Finanças) access" below.
How long we keep it
Everything is tied to your account. When you delete your account from settings, we remove every database row that identifies you and revoke any Google or Apple calendar connection — usually within minutes. Vault documents are AES-256-GCM encrypted with a per-document key wrapped by a master key we hold; when you delete an account, the wrapped key is destroyed at the same time as the database row, so the encrypted blob — even if a copy survives on a storage layer with a rolling recovery window — is cryptographically unrecoverable (GDPR right-to-erasure via crypto-shredding, per NIST SP 800-88 for AES-256-GCM). Your Portal das Finanças login (see below) uses the same per-record encryption and is deleted the moment you disconnect it, independent of account deletion. Deleted conversations are soft-deleted for 30 days so you can restore, then hard-purged by a nightly job. Reminder-send records (used to prevent double-emails) are kept for 90 days. Waitlist submissions (email + optional "what brought you here" note, submitted from the marketing landing) are kept for 12 months from submission, or until you sign up for an account — whichever comes first. Portugal Tax Playbook downloads (email address, for the linked drip series) follow the same 12-month-or-until-signup rule and every email carries a one-click unsubscribe. If you never sign up and want an email removed sooner, email hello@finkavo.com. If we ever need to keep something for legal reasons (fraud investigation, court order) we'll say so — that hasn't happened.
Google account access
Signing in with Google is optional. When you choose to connect Google Calendar from your profile settings, Finkavo requests one Google Calendar API scope (https://www.googleapis.com/auth/calendar.app.created). This is the app-created variant: it lets Finkavo create a single dedicated 'Finkavo — Tax deadlines' calendar under your account and read/write events on that calendar only. Finkavo cannot see, read, or modify any of your other Google calendars. Finkavo's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: Finkavo does not transfer your Google data to third parties except as needed to provide the reminder feature (the DPA vendors listed above), does not use your Google data for advertising, and does not allow humans to read your Google data unless we have your affirmative agreement, it is necessary for security, or the data is aggregated and anonymised. You can revoke Finkavo's access at any time from the profile settings page, or from https://myaccount.google.com/permissions.
Apple / iCloud Calendar access
Connecting Apple Calendar sync is optional and off by default. Instead of an OAuth redirect, you generate an app-specific password at appleid.apple.com/account/manage and paste it into Finkavo along with your Apple ID email. We use it once to create a dedicated "Finkavo" calendar in your iCloud account via CalDAV, then push deadline events to that calendar only — Finkavo never touches your other iCloud calendars, mail, photos, or files. The app-specific password is encrypted at rest (AES-256-GCM, per-record key, same model as Vault documents) — Finkavo staff cannot read it in plaintext. You can disconnect at any time from Settings → Calendar sync, which deletes the stored credential immediately, or revoke the app-specific password directly at appleid.apple.com.
GitHub sign-in
Signing in with GitHub is optional. If you choose it, Finkavo receives only the fields GitHub returns by default: your GitHub user id, your primary verified email address, and your display name. We do NOT read your repositories, organisations, private code, followers, or any other GitHub data — the OAuth app requests only the default 'read:user' + 'user:email' scopes. Finkavo does not post to GitHub on your behalf. You can revoke Finkavo's access at any time from https://github.com/settings/applications — that immediately breaks any active session that was minted via GitHub sign-in.
AT (Portal das Finanças) access
Connecting AT is optional and off by default. If you connect, you enter your NIF and Portal das Finanças password once. We encrypt them (AES-256-GCM, a per-record key wrapped by a server key, the same model as Vault documents) before storing them. With that login Finkavo also sets up a limited AT sub-user that holds only the permissions your profile needs, and uses it wherever AT allows. Finkavo uses this access to read what your profile needs — invoices, VAT, IRS status, receipts, properties and the list of AT notices — and never opens a notice for you. Nothing is submitted to AT unless you confirm that specific submission. Disconnecting deletes the stored login immediately; the sub-user stays at the Portal das Finanças until you remove it there (Gestão de Utilizadores).
Your rights
Under RGPD you can access, correct, export, or delete your data. Access + correction: /app/settings/profile. Export: same page, Danger Zone → Export my data (JSON). Delete: same page, Danger Zone → Delete my account. You don't need to ask anyone. You also have the right to lodge a complaint with the Portuguese Data Protection Authority (CNPD — https://www.cnpd.pt/) or the supervisory authority in your EU country of residence.
Data controller
Data controller: Abolfazl Shirkavand, operating as sole proprietor (empresário em nome individual), registered at Rua Francisco Marques Beato n.º 8, 5.º B, Moscavide, Portugal. Contact: hello@finkavo.com. No Data Protection Officer has been formally designated because Finkavo does not carry out large-scale monitoring of data subjects nor process special-category data as its core activity (RGPD Art. 37(1)) — hello@finkavo.com is the direct route for privacy questions and RGPD requests.
Contact
hello@finkavo.com. We'll respond within 3 business days. For RGPD-specific requests we'll respond within the 30-day statutory window.