Privacy and your data
An EU-based service, GDPR by design. Plain language, no dark patterns.
Where your data lives
financ.ee is operated from the European Union and all personal data is stored on infrastructure inside the EU. We do not transfer your financial records outside the EEA for storage.
What we collect
Your email address and authentication factors, the documents and figures you choose to add, the context notes you write, and minimal technical logs needed to keep the service secure and available. We set no advertising or tracking cookies, and we do not sell or share data with data brokers.
Bring-your-own-key encryption
Your vault passphrase is turned into an encryption key inside your browser using PBKDF2-SHA256 with 310,000 iterations, then AES-GCM 256 is applied to every document before it leaves your device. The passphrase itself never travels to our servers; only a verification token derived from the key is stored so the app can tell a correct passphrase from a wrong one. Because we do not have the key, we cannot decrypt your original statements, we cannot recover them if you lose the passphrase, and we cannot hand them to a third party. Derived figures such as dates, amounts, counterparties, balances and categories are stored readable in your account so charts, search and the advisor can work; those rows are protected by per-row ownership rules and TLS in transit. Settings shows exactly what is encrypted and what is not.
AI processing and your prompts
When you ask a question, run document extraction, or request advice, the relevant text is decrypted in your browser and sent to the AI provider for that single request only. It is not used to train models, it is not retained by us after the answer is returned, and it is not linked to your identity outside your account. Each feature has a rolling daily cap and a short burst guard, and the live AI credit meter shows the cost before you send anything. If you prefer, you can bring your own AI provider key so the traffic runs through your own account and does not draw on the shared allowance.
Your rights
Under the GDPR you can access, correct, export and erase your data, and object to processing. Export and permanent deletion are self-service in Settings, and both take effect immediately. You may also complain to your national supervisory authority.
Retention
We keep your data for as long as your account exists. Deleting your account erases your accounts, transactions, documents, goals and context notes. Security logs are kept for a short period and then removed.
Not financial advice
financ.ee provides information and modelling based on what you give it. It is not regulated financial, tax or legal advice.
Questions about your data? Reach us from Settings and we will answer within 30 days, as the GDPR requires.