Privacy Policy

1. Who we are

Finantr Ltd ("Finantr", "we", "us", "our") is a company registered in England and Wales (Company No. 17154089), with a registered address at Portland House, Belmont Business Park, Durham DH1 1TW.

We operate the Finantr platform, a Making Tax Digital (MTD) service that connects your UK bank account and HMRC account to automate quarterly tax submissions. We are the data controller for the personal data described in this policy.

We are registered with the Information Commissioner's Office. Our ICO registration number is ZC124758.

For data protection queries, contact us at: privacy@finantr.com

2. What data we collect

We collect the following categories of personal data:

3. How we use your data

We use your personal data for the following purposes:

• Providing the service: reading your bank transactions, calculating your UK tax liability, and submitting quarterly MTD updates to HMRC on your behalf.
• Account management: creating and maintaining your account, authenticating you, and sending service notifications.
• Billing: processing subscription payments via Revolut and managing your plan.
• Legal compliance: meeting our obligations under UK tax law, the UK GDPR, and FCA-regulated Open Banking rules.
• Security & fraud prevention: detecting unauthorized access, fulfilling HMRC Fraud Prevention header requirements, and protecting your account.
• Service improvement: aggregated, anonymised analysis to improve reliability and accuracy.
• Waitlist: sending you a confirmation and telling you when Finantr launches. Waitlist emails are sent from our own mail server, so your address is not passed to a third-party email provider.

4. Legal basis for processing

We process your personal data under the following UK GDPR lawful bases:

• Contract (Art. 6(1)(b)): processing necessary to deliver the Finantr service you have subscribed to, including syncing transactions, calculating tax, and filing submissions.
• Legal obligation (Art. 6(1)(c)): HMRC Fraud Prevention header requirements and UK financial record-keeping laws.
• Legitimate interests (Art. 6(1)(f)): security monitoring, fraud detection, and service improvement, where these do not override your rights.
• Consent (Art. 6(1)(a)): marketing communications, where applicable. You can withdraw consent at any time.

5. Who we share your data with

We do not sell your personal data. We share it only with the following third parties as required to operate the service:

All third parties are subject to data processing agreements and are required to handle your data in accordance with UK GDPR.

6. How we use AI

We use AI in two places. Neither makes decisions that have a legal or similarly significant effect on you, and you can always change the result.

Sorting your transactions

When a transaction arrives, we suggest whether it is income, an allowable expense or something else. We try these steps in order and stop at the first one that gives a confident answer:

• Your earlier choices: how you classified the same payee before. This is stored in your account.
• Shared payee patterns: the payee text with long numbers and dates removed, and how Finantr users have classified it. A pattern holds no names, amounts or account details, and is not linked to you.
• Our own AI model: a model that runs on our server (Qwen 2.5, run with Ollama). It receives the first 200 characters of the transaction description, the amount, and whether money came in or went out. This data does not leave our server.
• Backup AI model: only if our own model is unavailable, the same three items are sent to Anthropic's Claude model. We do not send your name, email address, NI Number, bank account details or any other identifier.

For each suggestion we record the method used, the first 200 characters of the description and the result, so we can check accuracy. You can change any classification in the app, and we use your correction for future transactions from the same payee.

Website chat assistant

The chat assistant on finantr.com is answered by Anthropic's Claude model. What you type, and the earlier messages in the same conversation, are sent to Anthropic to produce a reply. We do not store these conversations. Please do not enter personal or financial details, such as your NI Number, into the chat.

Anthropic

Anthropic PBC acts as our data processor and is based in the United States. Under its commercial terms, Anthropic does not use data sent through its API to train its models, and keeps it only for a limited period. Transfers to the United States are covered by the safeguards in Anthropic's data processing terms.

7. How we protect your data

• HMRC tokens, Open Banking tokens, and your National Insurance Number are encrypted at rest using AES-256 encryption.
• All data in transit is protected with TLS 1.2+.
• Open Banking access is read-only: we can never initiate payments or access money in your account.
• Transaction records are append-only: they are never modified or deleted in the normal course of service.
• We maintain application-level access logs and monitor for unusual activity.

8. How long we keep your data

We keep your personal data for as long as your account is open. HMRC expects you to keep your business records for at least 5 years after the 31 January deadline for each tax year, so download your records (Transactions, Export) before you close your account; we do not keep them for you afterwards.

If you join the waitlist without creating an account, we keep your email address until you unsubscribe or ask us to remove it.

If you request deletion of your account (right to erasure), we will:

• Soft-delete your user record immediately (removing access).
• Permanently erase your account and everything linked to it 30 days after you ask: transactions, tax estimates, submissions, bank connections, income statements, invoices, landlord documents, your consent records and our audit log of your account.
• Keep only what the law requires of Finantr itself: our billing records (what you paid and when) for 6 years under the Companies Act 2006. Copies of updates already sent to HMRC are held by HMRC, not by us.

9. Your rights

Under the UK GDPR, you have the following rights:

• Access: request a copy of the personal data we hold about you.
• Rectification: ask us to correct inaccurate data.
• Erasure: request deletion of your account and associated data.
• Portability: receive your data in a structured, machine-readable format.
• Object: to processing based on legitimate interests.
• Restrict: ask us to pause processing in certain circumstances.
• Withdraw consent: where processing is based on your consent, you may withdraw it at any time without affecting prior processing.

To exercise any of these rights, email privacy@finantr.com. We will respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

10. Cookies

We use only the cookies necessary to operate the service:

• Session cookie: keeps you logged in during your browser session.
• CSRF token: protects against cross-site request forgery.

We do not use advertising cookies or third-party tracking cookies.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email and update the "Last updated" date above. Continued use of Finantr after the effective date of changes constitutes acceptance of the updated policy.

12. Contact

For any questions about this Privacy Policy or how we handle your data: