Privacy Policy

1. Overview & Commitment

At FinYang AI, a software product owned and operated by AppCraft Studios (Pty) Ltd ("we", "us", or "our"), safeguarding your personal and financial data is paramount. We build our systems around principles of data minimization, zero persistent optical character recognition (OCR) retention, strict row-level isolation, and end-to-end encryption.

This Privacy Policy describes how we collect, use, store, and protect information when you visit finyang.net or use the FinYang AI web application (the "Service"). This policy adheres to international data protection regulations, including the Protection of Personal Information Act (POPIA) of South Africa and the General Data Protection Regulation (GDPR) of the European Union.

2. Information We Collect

We collect information necessary to deliver and maintain our SaaS analytics services:

• Account Information: Your name, email address, password hash, and company/workspace name provided during registration or authentication.
• Financial Documents & Statements: PDF, image, or scan files of bank statements you voluntarily upload for ledger conversion and financial insight generation.
• Extracted Transactional Data: Numerical figures, dates, transaction descriptions, balances, and payees automatically extracted from your statements to populate your private dashboard and ledgers.
• Payment & Billing Data: Payment details (e.g., credit card brand, last 4 digits, billing country, subscription status) collected directly and securely by our Merchant of Record, Paddle. We never store your full payment card number or CVV on our servers.
• Technical & Log Data: IP address, browser type, operating system version, access timestamps, and error diagnostics collected to safeguard platform integrity.

3. Zero Persistent OCR & Storage Architecture

FinYang AI employs strict data isolation standards:

• Ephemeral OCR, but text we keep: Optical character recognition is used only to read a document; the OCR provider’s contractual terms, not our code, govern whether it retains anything on its side. Be clear about our side: the text extracted from your statement is stored in your own record, and stays there until you delete the document.
• Encrypted private storage: Uploaded statement files are held in a private object storage bucket that refuses every browser key. Traffic is encrypted in transit and the database and bucket encrypt what they hold; the specific ciphers and protocol versions are our providers’ published terms rather than something this system sets.
• Row level security: Row level security is enabled and enforced on every table. Most carry policies tying a row to the signed-in user and their organisation; the remainder carry none at all, which denies every browser key outright. The server holds the only database credential and scopes each query as well, so the two fences are independent.
• No Model Training on User Data: We do not train, fine-tune, or contribute your private bank statement data to public artificial intelligence models.

4. How We Use Your Information

We process your data strictly for legitimate operational purposes:

• To parse, verify, and reconcile bank statement ledgers and display cash-flow metrics.
• To generate AI-assisted financial summaries, spending categorization, and cash flow analysis within your private workspace.
• To manage user authentication, session security, and account settings.
• To process subscription payments, calculate quota allowances, and issue invoices.
• To respond to customer support inquiries submitted to support@appcraftstudios.com.
• To comply with statutory financial, accounting, and anti-fraud obligations.

5. Data Sharing & Third-Party Processors

We do not sell, rent, or trade your personal or financial information to data brokers, advertisers, or third parties. We disclose data solely to trusted infrastructure subprocessors bound by strict data processing and confidentiality agreements:

• Cloud Infrastructure: Secure cloud hosting, database, and storage providers (Google Cloud Platform, Supabase and Vercel). Those providers hold their own security certifications; FinYang holds none of its own.
• AI Processing: Google's Gemini API processes the content of uploaded statements and your questions to the assistant in order to produce extraction, analysis and answers. We use Google's paid service, under which Google does not use this content to improve its products; Google keeps it for a limited period to detect abuse.
• Web Search in the Assistant: when a question to the AI assistant needs public information that is not in your statements (for example, what a named business is, or a published regulation), a short search query is sent to Google Search and the answer is shown with Google's search suggestions and links to the sources. Queries containing account, card or identity numbers, email addresses or phone numbers are refused before they are sent, and the assistant is instructed never to search for private individuals. Google retains web-search prompts and results for up to 30 days to provide and debug the service. The query that was sent is shown in the chat while the search runs.
• Payment Gateways & MoR: Paddle.com, our Merchant of Record, for subscription billing, payment processing, and international tax remittance.
• Legal Requirements: We may disclose information if required to do so by applicable law, court order, or governmental authority.

6. Data Retention & Deletion Rights

You retain full control over your financial records. You may delete individual bank statement files, parsed transaction rows, or entire workspaces directly from the web application file manager at any time.

Upon user deletion, raw uploaded documents and their extracted transaction records are permanently purged from active production storage. If you request account closure, all associated records are permanently erased, subject only to minimal statutory accounting record-keeping requirements.

7. Your Rights (POPIA, GDPR & International)

Depending on your location, you have statutory privacy rights, including:

• Right of Access: Request a copy of the personal information we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete records.
• Right to Erasure ("Right to Be Forgotten"): Request immediate permanent deletion of your account and files.
• Right to Restrict or Object: Restrict certain types of processing or object to processing under lawful grounds.
• Right to Data Portability: Export your verified ledger records in standard formats (CSV, Excel, JSON).

To exercise any of these rights, email our team at support@appcraftstudios.com. We respond to all verified requests within 30 days.

8. Cookies & Tracking

FinYang AI uses essential functional cookies strictly required for user authentication, session security, and state persistence. We do not deploy third-party advertising trackers or invasive behavioral tracking pixels.

9. Contact Our Data Protection Team

If you have questions, feedback, or privacy concerns regarding this policy or our data handling practices, please contact: