What we handle
Eight categories of your data touch Finkavo: • Account — email + password hash (Better-Auth) or OAuth linked identity (Google, GitHub). • Profile — residency, employment, regime, arrival date, CAE / CIRS codes, household members, tax context you enter. • Documents — files you upload to the Vault (PDFs, images), letters forwarded to your inbox address, and invoices you track via Invoice Ingest. • Conversations — Ask questions + answers, cited sources, and reproductions. • Calendar — deadline events, only if you opt into Google or Apple/iCloud sync. • Portal das Finanças login — only if you connect AT; encrypted, used to read what your profile needs, and never to submit without your confirmation. • Broker/investment data — only if you use the broker-import feature (Settings → Investments); the separate broker capital-gains tool at /tools/broker-capital-gains never sends this to us at all. • Payments — Stripe customer ID + subscription state (we never see card numbers). • Analytics — masked distinct-id + product events (button clicks, page views). Emails and free-text never leave for analytics.
Subprocessors
Every third-party we route data through, ranked by how much of your data they touch. All EU-based vendors are inside the Union; the US-hosted vendors are covered by the EU-US Data Privacy Framework and, where applicable, Standard Contractual Clauses.
- Purpose
- App hosting + edge compute
- Data touched
- All requests transit the Worker
- Retention
- Access logs 24h
- Purpose
- Encrypted document storage (Vault + inbound letters)
- Data touched
- PDFs, images, encrypted at rest
- Retention
- Until you delete the doc or account
- Purpose
- Primary database
- Data touched
- Account, profile, conversations, ask history, subscriptions
- Retention
- Until account deletion
- Purpose
- bge-m3 embeddings + light completions
- Data touched
- Question text, chunk text at query time
- Retention
- Not retained after response
- Purpose
- Larger LLM completions for Ask and letter parsing
- Data touched
- Question text, retrieved excerpts, uploaded doc text (when opted in)
- Retention
- Not retained after response (no-training default)
- Purpose
- Transactional email (verify, reset, waitlist confirmation, reminders)
- Data touched
- Email address + message body
- Retention
- 30-day send logs at Resend
- Purpose
- Payments + subscription lifecycle
- Data touched
- Stripe customer id, plan state, billing email
- Retention
- Payment records retained per Stripe policy + PT accounting law
- Purpose
- Product analytics (page views, button clicks)
- Data touched
- Masked distinct-id, event name, page path. Email + free text never sent.
- Retention
- 12 months rolling
- Purpose
- Google OAuth sign-in + Google Calendar sync (opt-in)
- Data touched
- Email + profile id at sign-in; calendar events when sync is on
- Retention
- OAuth refresh tokens until you disconnect
- Purpose
- iCloud Calendar sync via CalDAV (opt-in)
- Data touched
- Apple ID email + app-specific password (encrypted); deadline calendar events
- Retention
- Encrypted credential until you disconnect
- Purpose
- GitHub OAuth sign-in (opt-in)
- Data touched
- GitHub user id, primary verified email, display name
- Retention
- Until you disconnect or delete your account
- Purpose
- Triggers our scheduled crons (corpus refresh, reminders)
- Data touched
- No user data — just a POST to /api/cron with a shared secret
- Retention
- No user data
- Purpose
- Web-search fallback when the corpus doesn't cover a topic
- Data touched
- The query text only
- Retention
- Not retained per Tavily API terms
AI processing disclosure
Ask, letter parsing, invoice-ingest extraction, and vault-document extraction call large-language-model providers. When you use these features: • The question or document text is sent to Cloudflare Workers AI (embeddings, edge) and to OpenAI (larger completions and vision extraction, US) for processing. • The plaintext of vault documents leaves R2 only when you have opted for server-side extraction. If you toggle 'End-to-end encrypt with my passphrase' on upload, that specific document is never decrypted server-side — AI extraction is disabled for it as a trade-off. • Invoices you upload via Invoice Ingest as a PDF or image go through the same OpenAI vision extraction as vault documents; invoices you paste as CSV are parsed without any AI call. • The broker capital-gains tool at /tools/broker-capital-gains is the one exception — it parses CSVs entirely in your browser and never calls any AI provider or sends data to Finkavo's servers at all. • Prompts, retrieved excerpts, and completions are stored in our database (CockroachDB) so we can show you the answer receipt, reproduce it, and improve retrieval quality over time. They are not shared with third parties beyond the model provider. • We do not train models on your data. OpenAI and Cloudflare Workers AI both offer no-training defaults for API traffic; we rely on those defaults.
Encryption + deletion
Data at rest: everything in R2 and CockroachDB is stored on encrypted volumes. Vault documents are additionally encrypted with a per-document data-key wrapped by a key-encryption-key (KEK). If you turn on end-to-end mode with a passphrase, only your device can unwrap the data-key — Finkavo cannot decrypt those documents. Data in transit: TLS 1.2+ on every connection. Deletion: 'Delete my account' in /app/settings removes every row we hold for you in CockroachDB and every object in R2 keyed to your userId. The delete is transactional — if any R2 object fails to remove, the DB rows stay so a retry can finish the job (fixed 2026-07-17). Waitlist rows are separate; if you signed up before joining they need a separate email to hello@finkavo.com.
Reporting a vulnerability
If you find something that looks like a security issue, email us at security@finkavo.com. Please include enough detail to reproduce it and a preferred contact channel; we acknowledge every report within 72 hours and coordinate disclosure timing with you before publishing a fix. We do not currently run a paid bounty programme, but every valid report gets public credit on this page (with your consent).
security@finkavo.com →Ownership + change log
This page is owned by the founder (opefyre@gmail.com) and reviewed every quarter or on any material change to how data is handled. Material changes are logged as commits on the finkavo repo and summarised at the top of this page. Substantive changes trigger an email to every active user.