Privacy Policy · finstory

This Privacy Policy explains how Finstory, Inc. (“finstory”, “we”, “us”) handles personal data when you use:

the finstory service at app.finstory.ai (the “service”);
our website, finstory.ai; and
the finstory connector for Claude at mcp.finstory.ai, and the finstory plugin for Claude.

It applies alongside the data protection laws that protect you, including the GDPR, the UK GDPR and the California Consumer Privacy Act (CCPA).

1. Who we are and how to reach us

Finstory, Inc., 1445 Woodmont Ln NW #1641, Atlanta, GA 30318, USA.

Privacy questions and requests: privacy@finstory.ai.

For our website, sales and marketing, and the account details we need to run the service, finstory is the controller of your personal data. For the financial data and other content your company puts into the service (“customer data”), your company is the controller: finstory processes customer data on your company’s behalf and on its instructions, under our agreement with your company.

finstory is based in the United States. Where the law requires it, we will appoint a representative in the European Union and the United Kingdom and publish their details here.

2. What we collect

When you use the service

Account details: your name, work email address, company, your role in finstory, and sign-in details. You can sign in with Google, with Microsoft or with your email address; when you use Google or Microsoft, we receive your name and email address from them, never your password.
Customer data: the financial data your company loads, from NetSuite, spreadsheets or other systems, such as accounts, entities, actuals, budgets and forecasts, and the reports, stories, commentary and notes that you and your colleagues create. Customer data can include personal data, for example the names of employees, customers or suppliers in account or entity names.
Connection credentials: the credentials that connect finstory to your ERP or planning system. We store them encrypted.
Usage and technical data: records of requests to the service (the time, the action, how long it took and the outcome), IP address, browser or app type, and security events.
Onboarding: if you sign our NDA in our onboarding portal, your name, your signature, the time and your IP address, and any files you upload there.

When you visit finstory.ai or contact us

Forms: when you fill in a form on the site (to book a demo or to request security documentation), your name, work email address, company, job title, ERP system, message and your choice about marketing emails.
Demo bookings: when you pick a time in our calendar, your name, email address and the time you chose.
Checkout: when you buy a subscription, Stripe collects your payment details. We receive the details of the purchase, such as your name, email address, company and plan, but not your full card number.
Analytics: aggregate visit statistics, without cookies (see section 10).
Email: what you write to us, for example at support@finstory.ai.

3. finstory in Claude

When you connect finstory to Claude:

Sign-in and approval. Claude sends you to app.finstory.ai. You sign in to finstory as usual, choose the workspace Claude may use and approve. We then give Claude an access token that lasts one hour and a refresh token that lasts up to 30 days. Each time Claude uses the refresh token, we replace it with a new one. We store refresh tokens only in hashed form. If finstory in Claude is not used for 30 days, access ends and you connect again.
Disconnecting. You can disconnect finstory in Claude’s connector settings at any time. Claude then no longer has access to your workspace. Tokens that are not used expire on their own: an access token after one hour, a refresh token after 30 days.
What finstory receives from Claude. Only what Claude sends to carry out your request: the action (for example “list reports” or “add a page to a story”) and its inputs (for example which report or period, or the text of a headline Claude drafted for you). finstory does not receive your conversation with Claude, your chat history, files you share with Claude or Claude’s memory.
What finstory sends to Claude. Results from the workspace you signed in to, limited to what your finstory role allows, such as figures, the content of reports and stories, and account and entity names.
Your Claude conversation. Those results become part of your conversation with Claude. Anthropic processes them under your agreement with Anthropic for your Claude plan; see Anthropic’s privacy policy. finstory does not control how Anthropic processes your conversations.
What Claude creates in finstory. Reports and stories that Claude creates or changes are saved in your workspace like any others, with version history, and are customer data.
Logs. For each request we record the action, the time, how long it took, the outcome, the workspace, the reports, stories and pages involved (by their identifiers, or for stories and some report elements by their names), and a pseudonymous user ID: a salted hash, not your name or email address. We do not log your figures, the text of your reports and stories, or your conversation with Claude. We use these logs to run and secure the service, fix problems and understand how it is used.

4. Why we use personal data, and on what legal basis

To provide and support the service, including finstory in Claude: to perform our contract with your company. Customer data is processed only on your company’s instructions.
To keep the service secure, prevent misuse and fix problems: our legitimate interest in a safe, working service.
To answer your questions and demo requests, and to send security documentation you ask for: to take the steps you ask for before a contract, and our legitimate interest in answering you.
To send product news and ideas by email: your consent, which you give with the checkbox on our forms and can withdraw at any time with the unsubscribe link.
To measure visits to our website: our legitimate interest in knowing how the site is used, with cookieless, aggregate statistics.
To meet legal obligations, for example tax and accounting records.

We never use customer data for marketing, demonstrations or anything outside your company’s account, and we do not use customer data to train AI models.

finstory uses an AI model hosted by Groq to write short descriptions of your account structure and reports, which help finstory and Claude find the right accounts and reports. For this we send names, codes and the hierarchy of your accounts, entities and other dimensions, and the titles and layout of your reports, not your figures.

5. Service providers and data transfers

We use these service providers (“sub-processors”) to run finstory:

Google (Google Cloud and Firebase), United States: hosting of the service in the United States, databases, file storage, sign-in and logs; Google Fonts on our onboarding portal.
MongoDB, Inc. (MongoDB Atlas), United States: database for reports and stories.
Groq, Inc., United States: the AI model that writes descriptions of account structures and reports, as described in section 4.
HubSpot, Inc., United States: our website forms and our records of customers and prospects.
Calendly LLC, United States: demo bookings.
Stripe, Inc., United States: checkout and payments.
Netlify, Inc., United States: hosting of finstory.ai.
Plausible Insights OÜ, European Union: cookieless website analytics.
Substack, Inc., United States: our AI In Finance newsletter, if you subscribe to it.
ipify: looks up your IP address when you sign our NDA in the onboarding portal.

Each provider only gets what it needs for its task. We update this list when it changes.

finstory runs in the United States. When personal data from the European Union, the United Kingdom or Switzerland is transferred there, we rely on the EU Standard Contractual Clauses, with the UK and Swiss additions where needed, or on another transfer mechanism the law allows.

6. Security and confidentiality

We encrypt data in transit and at rest, enforce multi-factor authentication, restrict internal access and monitor system activity. Our security controls are designed around the SOC 2 framework. Customer data is confidential under our agreement with your company, and under our Non-Disclosure Agreement (NDA) where one is signed. More on our security page.

7. How long we keep data

Customer data: for as long as your company subscribes. When the subscription ends, we keep it for up to 30 days so your company can export it, then delete it. Backups that contain it are purged within 60 days of the end of the subscription, unless the law requires us to keep it longer.
Account details: deleted together with your company’s customer data, except what we must keep for legal, tax or accounting reasons, such as invoices.
finstory in Claude: access tokens expire after one hour and refresh tokens after 30 days, or earlier when they are replaced.
Logs: for as long as we need them to secure the service and fix problems, then deleted.
Website forms and our customer records: for as long as we have a business relationship with you or your company, or until you ask us to delete them. You can unsubscribe from marketing emails at any time.

8. Your rights

Depending on where you live, you have the right to:

access, correct or delete your personal data;
receive your data in a portable format;
object to or restrict certain processing;
withdraw your consent at any time, without affecting processing before that;
file a complaint with your local data protection authority.

Send requests to privacy@finstory.ai. If your request is about customer data, we work with your company, as the controller, to answer it. We do not sell your personal information, and we do not share it for cross-context behavioural advertising.

9. Breach notification

If a data breach occurs that may affect your personal data, finstory will notify affected users and relevant authorities within 72 hours of becoming aware of the breach, in line with GDPR requirements.

10. Website analytics and cookies

We measure visits to finstory.ai with Plausible Analytics, hosted in the European Union. It sets no cookies and stores nothing on your device. It counts page views, where visitors came from, country, device and browser type, and clicks on key buttons, in aggregate only. It does not identify you: unique visitors are counted with an anonymous code that changes every day, and your IP address is never stored.

Our website sets no cookies for analytics or advertising. The booking calendar from Calendly, shown after you send the demo form, and Stripe’s checkout pages may set their own cookies, under their own policies.

11. Children

finstory is a service for businesses. It is not meant for children, and we do not knowingly collect personal data from children.

12. Changes to this policy

We may update this policy to reflect changes to the service or the law. We publish each new version here, with its version number and date, and tell customers about material changes in advance.

Questions, or need this policy in another format (PDF)? Email privacy@finstory.ai, or write to Finstory, Inc., 1445 Woodmont Ln NW #1641, Atlanta, GA 30318, USA.