Privacy Policy

The controller responsible for FinanceOS is:

• Account data: email, authentication metadata, optional profile name and picture, sign-in and security information, including MFA status.
• Business and financial data you enter: entities, residency and currency settings, income, expenses, tax settings, clients, invoices, payment instructions, savings goals, recurring records and reports.
• Files: receipts, proofs of payment, platform statements, invoice logos and other documents you choose to upload.
• Service and security data: feature settings, API key labels and activity, support messages, error and diagnostic data, device/browser information, approximate request location and timestamps.
• Cookie and advertising data: consent choices, first-touch campaign fields, landing path and referring site; Google or Meta identifiers and events only after consent.
• Subscription data from Lemon Squeezy: customer and subscription identifiers, plan, status, trial/renewal dates, portal link and first-payment date. We do not receive or store full card numbers.

• Contract — GDPR Article 6(1)(b): create and secure your account; provide dashboards, invoices, reports, exports, AI features, API access, storage, billing status and requested support.
• Legal obligation — Article 6(1)(c): meet tax, accounting, consumer, fraud-prevention and lawful-request obligations that apply to us.
• Legitimate interests — Article 6(1)(f): protect the service, prevent abuse, diagnose faults, improve reliability, keep minimal audit records and understand first-touch acquisition. We balance these interests against your rights.
• Consent — Article 6(1)(a): optional analytics and advertising measurement. You may withdraw consent through Cookie settings without affecting earlier lawful processing.

Where you provide information about clients or other people, you are responsible for having a lawful basis and giving any required notice.

FinanceOS sends service and transactional messages such as account confirmation, password reset, trial reminders, requested invoice emails, tax reminders and an optional overdue-invoice digest. Notification settings control optional reminders. We do not send marketing email without opt-in.

We use only providers needed for the service described in the code:

• Lovable: application hosting, managed database, authentication, private file storage and transactional email.
• Lemon Squeezy: Merchant of Record, checkout, subscription management, payment invoices/receipts, sales tax/VAT and refunds.
• Lovable AI: built-in AI support, advice and document reading. Depending on the selected model, Lovable's AI infrastructure may route processing to an underlying model provider.
• Anthropic, OpenAI and Google Gemini: only when you select or supply credentials for those AI services, or when the built-in document reader uses its disclosed Gemini model.
• Sentry: error monitoring. Default personal-data collection, performance tracing and session replay are disabled; known names, emails, financial amounts, request bodies and authentication tokens are scrubbed.
• Google Analytics/Ads and Meta Pixel: page and advertising measurement only when the corresponding service is configured and you consent. They do not receive account financial records.
• open.er-api.com: public exchange rates. No account or financial record is included in that request.

We may also disclose information when legally required, to protect rights or safety, or during a business reorganisation subject to appropriate safeguards. We do not sell personal information.

FinanceOS is operated from Israel and serves users worldwide. Providers may process data in Israel, the United States, the European Economic Area and other countries. Where EU/UK data is transferred without an adequacy decision, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, the UK addendum, provider transfer mechanisms, and supplementary security measures where appropriate.

• Account, business records and uploaded files: while the account is active, then removed from live systems promptly after account deletion and from backups within 30 days.
• Subscription and transaction records: as required for contractual, tax, accounting, dispute and fraud-prevention duties, generally up to 7 years after the relevant transaction.
• Support and security records: normally up to 24 months, longer if needed for an active dispute, abuse investigation or legal duty.
• First-touch attribution: 90 days in the browser; the signup attribution row is retained with the account until deletion.
• Cookie consent: until you clear browser storage, change the choice, or we require a renewed choice.

We may retain a minimal record longer where law requires it or to establish, exercise or defend legal claims.

Measures include encryption in transit and at rest, private user-scoped storage, row-level access controls tied to the signed-in account, server-side validation, restricted provider credentials, password protections, optional authenticator-app 2FA, signed short-lived file URLs, logging safeguards and personal-data scrubbing in error reports. No method is completely secure; protect your password, 2FA codes and personal API keys.

Depending on your location, you may request access, correction, deletion, restriction, portability or a copy of your data; object to legitimate-interest processing; and withdraw consent. You can update information, export account data and delete the account in Settings, or email osfinance06@gmail.com or support@financeos.money. We may verify identity before responding.

You may complain to the Israel Privacy Protection Authority, your EU data protection authority, the UK Information Commissioner's Office, or another competent local regulator. We encourage you to contact us first so we can try to resolve the issue.

We do not sell personal information for money. Consent-gated advertising measurement may constitute “sharing” or targeted advertising under some US state laws. Choose Reject, turn Marketing off, or reopen Cookie settings to opt out. We do not discriminate for exercising privacy rights. You may use an authorised agent where local law permits, subject to verification.

Essential browser storage supports sign-in, preferences and consent. Visitors in the EU/EEA, the UK and Switzerland are asked for consent before any analytics or advertising cookies load. Visitors elsewhere have analytics and advertising measurement on by default and can switch it off at any time in Cookie settings in the footer. First-touch campaign data is kept locally even without ad IDs so attribution can be attached at signup. See the Cookie Policy for the actual keys, purposes and controls.

FinanceOS is not directed to people under 18, and we do not knowingly collect their data. Contact us if you believe a child has provided personal information.

We investigate suspected personal-data breaches, take reasonable containment and remediation steps, and notify affected people and regulators when required by applicable law.

We will post updates here and give in-app or email notice before material changes where required. Privacy questions and rights requests go to osfinance06@gmail.com; general help goes to support@financeos.money.