Last updated: April 6, 2026
The data controller for the Service is:
Vadym Riazantsev (trading as Finalytics)Finalytics ("we", "us", "our") operates the Finalytics mobile application (the "Service"). Finalytics is not a licensed Account Information Service Provider (AISP). Bank account connectivity is provided through Enable Banking Oy, a licensed AISP, and through direct API integrations with supported banks (see Section 4).
This Privacy Policy explains how we collect, use, and protect your personal information when you use the Service, including when you connect your bank accounts through our open banking integration.
Account information: When you register, we collect your name, email address, and authentication data (e.g., hashed passwords). If you sign in via Google or Apple, we receive your name and email from those providers. You may also upload a profile photo.
Financial data you enter: The transactions, accounts, categories, tags, and budgets you create within the app. This data is entered by you and stored to provide the Service.
Bank account data (via open banking): If you choose to connect a bank account, we access your payment account information through one of the following channels, depending on your bank:
In both cases, data is obtained based on your explicit consent. The data we retrieve includes:
We access this data only after you explicitly authorize it through your bank's Strong Customer Authentication (SCA) process. During SCA you are redirected to your bank's own authentication page where you confirm access using your bank's security methods (e.g., two-factor authentication, biometric confirmation, or one-time password). We do not participate in or have access to this authentication process. We never receive, see, or store your bank login credentials at any point.
Device information: Device type, operating system version, and a temporary device or session identifier used for session management and security (e.g., detecting unauthorized access).
Biometric data: If you enable Face ID or Touch ID, biometric authentication is handled entirely by your device's operating system. We never receive, store, or transmit your biometric data.
We process personal data under the following legal bases (GDPR Art. 6(1)):
We do not perform automated decision-making or profiling that produces legal or similarly significant effects (Art. 22 GDPR).
When you connect a European bank account, data flows through Enable Banking Oy (business ID 2988499-7, Otakaari 5, 02150 Espoo, Finland). Enable Banking is authorized and regulated under PSD2 to provide Account Information Services (AISP). Enable Banking retrieves data from your bank based on your consent and transmits it to the Service.
Enable Banking processes your data in accordance with its own privacy notice: enablebanking.com/privacy.
For banks that offer their own public API (e.g., Monobank), we connect directly using a personal API token that you generate and provide. In this case, no third-party intermediary is involved — data flows directly between your bank and the Service. Your token is encrypted at rest (AES-256) and used solely for retrieving your financial data.
Bank account data is used exclusively for providing personal finance management features within the Service. We do not use it for credit scoring, profiling, marketing, or any purpose other than displaying your financial information back to you.
You may revoke bank data access at any time by:
Your data is stored on secure servers within the European Union (DigitalOcean, EU region). We use industry-standard encryption for data in transit (TLS/HTTPS) and at rest. Bank connection tokens are encrypted using AES-256 before storage. Access tokens are stored in your device's secure storage (Keychain on iOS). We regularly review our security practices to protect your data.
We do not sell, rent, or share your personal financial data with third parties. We may share data only in the following cases:
Your financial data is stored on servers located within the European Union. Some sub-processors are based outside the EU: DigitalOcean and Sentry (USA) process data under Standard Contractual Clauses (SCCs); Cloudinary (Israel) operates under an EU adequacy decision. All transfers comply with GDPR Chapter V.
The mobile application does not use cookies. We do not currently use any third-party analytics services. If we introduce analytics in the future, this policy will be updated accordingly and only aggregated, non-personal data will be collected.
Under the GDPR and applicable data protection laws, you have the right to:
To exercise these rights, contact us at support@finalytics.app. We will respond within 30 days.
The Service is not intended for children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will delete it.
We may update this Privacy Policy from time to time. We will notify you of material changes through the application or via email. The "Last updated" date at the top of this page indicates when this policy was last revised.
For questions, concerns, or requests related to your personal data and this Privacy Policy, contact the data controller:
Vadym Riazantsev (trading as Finalytics)