Privacy Policy

• Account, balance, transaction, investment, and liability data from financial institutions you link, via Plaid
• Your email address and a salted, hashed password
• First-party product analytics about how the app is used, such as page views, button clicks, form submissions, and API outcomes
• Household membership and role data (owner/admin/member/viewer) if you share access with others
• Basic operational logs (sign-ins, sensitive account actions) kept for security and audit purposes
• For households that opt into our Gmail statement-scanning private beta: read-only access to message headers and Gmail's own short preview snippet (never the email body) for statement, payment-due, and loyalty-balance emails from a fixed list of banks and travel programs, and only the handful of fields extracted from them (an account's last 4 digits, a card's product name, an amount, a points balance)
• Previously generated AI brief records, which remain in household storage until an owner deletes them in Settings. Finall no longer generates briefs or sends brief-generation requests to an AI provider.

• Your bank username or password — you authenticate directly with your institution through Plaid; we never see those credentials
• Full card numbers (PCI data stays with your bank)
• No third-party advertising trackers or third-party analytics scripts
• The body of any email — the Gmail connector above reads headers and Gmail's own preview snippet only

Your data is used only to operate finall AI for you: rendering your accounts, spending, and net worth; detecting duplicate or jointly-held accounts across connections; matching linked cards to our rewards catalog; powering the cash-flow planner; and improving product reliability and usability through first-party analytics with sensitive-value redaction. We do not use your financial data to train shared models, and we do not sell or rent your data to anyone.

We share data with Plaid, Inc. solely to retrieve information from your linked institutions, and with our cloud infrastructure providers (hosting, database, encryption key management) solely to run the service. Finall no longer sends brief-generation requests to an AI provider. We do not share your data with advertisers or data brokers, and we do not sell it.

Plaid access tokens are encrypted at rest with AES-256-GCM. All traffic is encrypted in transit (TLS). Passwords are hashed with scrypt — we never store them in plain text. Every household-scoped query is filtered by household, so data from one household is never visible to another. See Security & Trust for independently verifiable detail.

• Disconnect any linked institution at any time from the Connections page — this revokes our access to that account
• Request deletion of your account and associated data by emailing security@finallai.com
• If you share a household, members you invite can see the data you grant them access to — review household roles before inviting someone

finall AI is not directed to anyone under 18, and we do not knowingly collect data from children.

If this policy changes materially, we will update the date below and, where required, notify you directly.

Questions about this policy or your data: security@finallai.com