Privacy Policy

1. Overview & Commitment

At FinYang AI, a software product owned and operated by AppCraft Studios (Pty) Ltd ("we", "us", or "our"), safeguarding your personal and financial data is paramount. We build our systems around principles of data minimization, zero persistent optical character recognition (OCR) retention, strict row-level isolation, and end-to-end encryption.

This Privacy Policy describes how we collect, use, store, and protect information when you visit finyang.net or use the FinYang AI web application (the "Service"). This policy adheres to international data protection regulations, including the Protection of Personal Information Act (POPIA) of South Africa and the General Data Protection Regulation (GDPR) of the European Union.

2. Information We Collect

We collect information necessary to deliver and maintain our SaaS analytics services:

• Account Information: Your name, email address, password hash, and company/workspace name provided during registration or authentication.
• Financial Documents & Statements: PDF, image, or scan files of bank statements you voluntarily upload for ledger conversion and financial insight generation.
• Extracted Transactional Data: Numerical figures, dates, transaction descriptions, balances, and payees automatically extracted from your statements to populate your private dashboard and ledgers.
• Payment & Billing Data: Payment details (e.g., credit card brand, last 4 digits, billing country, subscription status) collected directly and securely by our Merchant of Record and payment processors (such as Paddle or Paystack). We never store your full payment card number or CVV on our servers.
• Technical & Log Data: IP address, browser type, operating system version, access timestamps, and error diagnostics collected to safeguard platform integrity.

3. Zero Persistent OCR & Storage Architecture

FinYang AI employs strict data isolation standards:

• Zero Persistent OCR Storage: Document OCR technology is utilized solely for real-time, ephemeral character extraction. The raw OCR engine does not retain or index your documents. Once parsed, structured text is saved directly to your private database schema.
• Encrypted Private Storage: Uploaded source statement files are stored in private, isolated object storage buckets. Files are encrypted both in transit (TLS 1.3) and at rest (AES-256).
• Row-Level Security (RLS): Every database record is partitioned with tenant and workspace isolation policies. Users can only access records associated with their authenticated session.
• No Model Training on User Data: We do not train, fine-tune, or contribute your private bank statement data to public artificial intelligence models.

4. How We Use Your Information

We process your data strictly for legitimate operational purposes:

• To parse, verify, and reconcile bank statement ledgers and display cash-flow metrics.
• To generate AI-assisted financial summaries, spending categorization, and cash flow analysis within your private workspace.
• To manage user authentication, session security, and account settings.
• To process subscription payments, calculate quota allowances, and issue invoices.
• To respond to customer support inquiries submitted to support@appcraftstudios.com.
• To comply with statutory financial, accounting, and anti-fraud obligations.

5. Data Sharing & Third-Party Processors

We do not sell, rent, or trade your personal or financial information to data brokers, advertisers, or third parties. We disclose data solely to trusted infrastructure subprocessors bound by strict data processing and confidentiality agreements:

• Cloud Infrastructure: Secure cloud hosting, database, and storage providers (e.g., Google Cloud Platform, Supabase, Neon) operating in SOC 2 and ISO 27001 certified data centers.
• Payment Gateways & MoR: Paddle.com Inc. and Paystack Payments for subscription billing, payment routing, and international tax remittance.
• Legal Requirements: We may disclose information if required to do so by applicable law, court order, or governmental authority.

6. Data Retention & Deletion Rights

You retain full control over your financial records. You may delete individual bank statement files, parsed transaction rows, or entire workspaces directly from the web application file manager at any time.

Upon user deletion, raw uploaded documents and their extracted transaction records are permanently purged from active production storage. If you request account closure, all associated records are permanently erased, subject only to minimal statutory accounting record-keeping requirements.

7. Your Rights (POPIA, GDPR & International)

Depending on your location, you have statutory privacy rights, including:

• Right of Access: Request a copy of the personal information we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete records.
• Right to Erasure ("Right to Be Forgotten"): Request immediate permanent deletion of your account and files.
• Right to Restrict or Object: Restrict certain types of processing or object to processing under lawful grounds.
• Right to Data Portability: Export your verified ledger records in standard formats (CSV, Excel, JSON).

To exercise any of these rights, email our team at support@appcraftstudios.com. We respond to all verified requests within 30 days.

8. Cookies & Tracking

FinYang AI uses essential functional cookies strictly required for user authentication, session security, and state persistence. We do not deploy third-party advertising trackers or invasive behavioral tracking pixels.

9. Contact Our Data Protection Team

If you have questions, feedback, or privacy concerns regarding this policy or our data handling practices, please contact: