Privacy notice

• We use your data to find savings, deals and perks for you, and to run the app. We don’t sell it or use it for advertising.
• Finlay’s chat is written by AI. The AI companies we use see only what they need to answer you, and can’t train their models on it.
• You can see, change and delete what Finlay holds, in the app or by emailing us.

Finlay is made by Lutece Labs Ltd (company number 17518209), 4th Floor, Silverstream House, 45 Fitzroy Street, London, W1T 6EB. We’re responsible for your data, and registered with the Information Commissioner’s Office under number ZC277740. Questions: hello@meetfinlay.com.

• Your account: your email address, how you sign in (email code, Apple or Google), and your phone’s internet address for each session, to keep your account secure. If you allow notifications, your phone’s notification address.
• About you, if you choose to tell us: the name you’d like to be called, date of birth, region and first half of your postcode, work and student status, goals, and groups that can get discounts (such as NHS, carer or receiving benefits).
• Disability, only if you tick it and agree in a separate box. It’s health information, so we use it only to find discounts for disabled people. Untick it to delete it. We keep a note of when you agreed and when you unticked it, until you delete your account.
• Your money: transactions and account details from statements you upload, from banks you connect once that’s available, and from investment accounts you connect. We also keep what you tell Finlay about your money and what Finlay works out from it, such as your regular payments and the offers you qualify for.
• Chats and files: your conversations with Finlay, photos and documents you send it, and what it remembers from them (you can see and turn this off under You → Privacy).
• Things you add or send us: notes on transactions, reminders, invites, feedback and problem reports.
• Finlay Plus, if you subscribe: a record of your plan. The App Store, Google Play or Stripe takes the payment, so we never see your card.
• How the app is used: anonymous usage statistics (you can switch them off), crash reports, statistics from our servers (linked to a scrambled version of your account ID), and screen recordings with everything on screen hidden, only if you tick them. This website collects anonymous page views and uses no cookies.

Connecting accounts. Bank connections will be read-only, through an open banking provider authorised by the Financial Conduct Authority. For investment accounts, you either give Finlay a read-only key, which we keep encrypted and which can’t trade, or sign in on the platform’s own page inside the app, which reads your accounts on your phone. We never see your passwords. We keep sort codes and account numbers encrypted, never show them and never send them on from our records.

Your transactions can include other people’s names, such as someone you pay rent to. We use them only to give you the service, and never keep other people’s bank details.

The law asks us to give a legal reason for each use. Ours are:

• To provide Finlay to you (our contract with you): your account, profile, money, chats, notifications, invites and Plus. We use your bank data only to show your spending, spot regular payments and transfers between your accounts, find offers you qualify for, and answer your questions.
• With your consent: disability (your explicit consent) and screen recordings. You can withdraw it any time in the app.
• Our legitimate interests in running Finlay well, which we’ve weighed against your privacy: stopping people claiming free allowances twice (we check for throwaway emails, and on iPhones Apple’s DeviceCheck marks a phone that has had one), crash reports, usage statistics, fixing problems you report, and learning what to build next. You can object to any of these.

AI writes Finlay’s chat replies, reads the files and statements you send and decides what to remember. It gets only what each task needs. We never send it your email address, or your name or account numbers from our records. A statement or file you send is read as it is, so the AI provider sees what’s printed on it, such as your name, address and account number. Our AI providers can’t train on your data, though they may keep it briefly to check for misuse.

The figures Finlay shows come from its own calculations, not AI. Showing which offers you look eligible for doesn’t decide anything about you: the provider makes its own decision if you apply, and we send them nothing about you.

We never sell your data. These kinds of service handle it for us, on our instructions:

• Hosting (UK): runs our servers, this website and our database.
• AI providers (USA): write chat replies, read files and statements you send, check messages and name the shops in your transactions.
• AI quality monitoring (EU): records of Finlay’s AI work, with personal details masked.
• File storage (Western Europe): photos and documents you send in chat.
• Email delivery (EU): our emails, including sign-in codes.
• Analytics and crash reporting (EU): usage statistics, screen recordings and crash reports.
• Website statistics (USA): anonymous page views on this website, with no cookies.
• App updates (USA): app updates, and passing notifications to Apple and Google.
• Logos (Worldwide): shop and bank logos, which your phone loads directly, so it sees your phone’s internet address and which logos you view.
• Our team’s work tracking (USA): our private to-do lists, which can hold the names of businesses people pay and anonymous summaries of what people ask Finlay for, never your name or anything that identifies you.

Email hello@meetfinlay.com to ask which companies they are.

We also look up the names of businesses people pay on Companies House’s public register (UK), to tell a letting agent from a person. It gets the name alone, never anything about you.

Google, Apple and Stripe are responsible for their own part (signing in, notifications, subscriptions and payments) under their own privacy notices. We may also share data if the law requires it, or with a company that takes over Finlay.

Where data goes outside the UK and EU, we use the safeguards UK law allows: the UK–US “data bridge” or contract terms approved by the Information Commissioner. Email us for a copy.

Until you delete it or your account, except: photos and documents sent in chat (30 days), things you told Finlay “Not now” to remember (30 days), screen recordings (30 days), AI quality records (90 days) and feedback (12 months). An account goes 28 days after you ask to delete it, bank data included, so you can change your mind by signing in again. Bank data also goes when you stop sharing that bank or don’t reconfirm it every 90 days, with what Finlay worked out from it.

A few things stay after you delete your account: a record of changes our team made to it (2 years), emails you sent our team (until you ask us to delete them), payment records Stripe must keep by law, your email on our tester invite list (until you ask us to remove it), a scrambled code made from your email address that can’t be turned back into it (12 months, so the same address can’t get a second free trial or count as a friend’s invite), and notes of what people ask Finlay for and shop names seen in transactions, which aren’t linked to anyone. Backups clear within a short time.

You can ask for a copy of your data, or ask us to correct, delete or move it, or to limit or stop using it. Email hello@meetfinlay.com and we’ll reply within a month. You can delete your account in the app under You → Account → Delete account (the support page has the steps).

If you’re unhappy with how we’ve handled your data, please tell us first. You can also complain to the Information Commissioner’s Office.

Finlay is for people aged 18 or over who live in the UK. We’ll update this page as Finlay grows, and tell you first if a change affects data you’ve already given us.