Privacy.
On the platform.

This English translation is provided for convenience only. The German version is legally binding; in the event of any discrepancy, the German version prevails. Datenschutzerklärung Plattform (German version)

1. Controller

The controller responsible for data processing on the platform is:

The provider and operator of the platform and the developer of the Finaure software is JSLM Products & Services GmbH (hereinafter “we”). Further details can be found in our legal notice.

2. Scope and roles

This policy applies to the use of the Finaure platform (the application after sign-in) by our customers and all users invited by them, such as family members, assistants or advisers, and to external parties who access individual content via a sharing link. Visits to our website are governed by the website privacy policy.

Two roles: We are the controller for your customer account, billing and the security of the platform. If you, as a customer, enter data relating to third parties (e.g. tenants, employees, contractual partners or family members), you are the controller for that data and we process it as your processor under the data processing agreement (Terms and conditions, Annex 3).

3. Where your data is stored

All permanently stored data, i.e. master data, asset data and transaction data, documents and sessions, is stored with Supabase on servers in the European Union (Germany), encrypted at rest and in transit. The application interface is delivered via Netlify; no user data is stored there.

Some recipients are based outside the EU or belong to US companies, for example Anthropic for AI processing (section 8), Cloudflare for bot protection and Google for the optional sign-in with Google (section 5). All recipients and the safeguards for transfers to third countries are set out in section 15.

4. Data processed

• Account and master data: name, email address, billing address, roles, settings, selected licence tier.
• Asset and financial data: entities and investments, assets, bank accounts with balances and transactions, securities accounts, contracts, receipts, planning data.
• Documents and images: files uploaded by you (PDF, JPG, PNG) and the content extracted from them.
• Third-party data that you enter (see section 2).
• Technical data and logs: sign-in events, audit events, error and function logs (section 17).
• No banking credentials: your online banking credentials never reach us at any time (section 9).

5. Registration and sign-in

When you register, we process your email address, your name, your billing address and the selected licence tier. Your email address is verified before your account is activated. We store passwords only as a cryptographic hash.

To protect against automated registrations, we use Cloudflare Turnstile (Cloudflare, Inc., USA). In this process, your IP address and technical browser signals are transmitted to Cloudflare in order to distinguish humans from bots.

You can choose to sign in with your Google account. The sign-in page then redirects you to Google; after you confirm, Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) transmits your email address, your name, where applicable your profile picture and a Google identifier to us. We never receive your Google password. Signing in with Google is optional; you can equally sign in with your email address and password. Google’s privacy policy applies to processing by Google.

Two-factor authentication (TOTP) works with any common authenticator app and runs entirely via our sign-in infrastructure at Supabase, without any further third-party provider. We store the eight recovery codes only as a hash. Sessions have an expiry date, can be ended by you and end automatically after a period of inactivity that you can set.

6. Use of the platform

We process the data you enter, upload or retrieve via the bank connection in order to provide you with the functions of the platform: wealth and structure overviews, analyses, plans, tasks, reports and exports for your adviser. Uploaded documents are stored separately for each tenant and are retrieved only after sign-in via short-lived signed links.

7. Roles, logs, support

Customers invite users and assign roles per entity (owner, admin, manager, assistant, member, adviser). Which data a user can see is enforced on the server side. Security-relevant actions are recorded in an audit log that only owners and admins can view.

Support: Our staff access a tenant only insofar as this is necessary to resolve an enquiry; such access is logged and displayed to the owner in the platform. We have no access to payments or bank connections. We handle service requests such as resetting two-factor authentication after verifying identity by confirmation email, without accessing any content.

8. AI features

For AI features, we use the Anthropic Claude API (Anthropic PBC, USA) as a processor, i.e. the commercial interface and not the consumer product. Under the contract with Anthropic in force at any given time, content is not stored after processing and is not used for training AI models (currently: Zero Data Retention). For each feature, we send only the data required:

In document analysis, the document itself is the subject of the processing: if it contains names, for example on an invoice, these are analysed within the document. Recognised vehicle registration numbers or vehicle identification numbers are stored with the asset and are not passed on to the chat assistant.

Transparency and control: Every AI interaction is labelled as such (Art. 50 of the EU AI Act). AI results are suggestions that you confirm or change. You can use SmartAssist only after giving your express consent, which you can withdraw at any time in the settings; for uploads, there is a manual route that does not use AI. Every SmartAssist response shows which data it is based on. Value indications for tangible assets are estimates derived from model knowledge without market data and do not constitute a valuation. We log only the fact that an analysis took place, not its content or result.

9. Bank connection (finAPI)

You connect bank accounts via finAPI GmbH, Munich, an account information and payment initiation service supervised by BaFin. Sign-in to your bank, including strong customer authentication, takes place directly between you, finAPI and your bank; your online banking credentials never reach us. We receive and store account information such as balances, transactions and securities holdings in the EU. Bank access connections are stored per user. You give and manage your consent to account access with finAPI and your bank. You approve payment runs in the platform in accordance with the approval procedure that has been set up; the payment is initiated via finAPI and authorised and executed using your bank’s procedure. Payments run exclusively via finAPI; Finaure itself never has access to your money. When the contract ends, the access connections created at finAPI are removed as part of the erasure.

10. Billing

Subscription billing is handled via the billing service Fynn (Fynn GmbH, Barthelstraße 4, 50823 Cologne, Germany). Payment data such as card or account details is processed exclusively there or by the respective payment service provider; we store only the subscription status and reference numbers. For certain existing contracts, we still use Stripe (Stripe Payments Europe, Ltd., Ireland); this integration is being phased out. The end of the trial period and the licence tier are communicated to us via secured, signature-verified notifications from the billing service.

11. Emails

We send system emails (e.g. invitations, deadlines, notices relating to the contract, report notifications) via Brevo (Sendinblue SAS, Paris). Our emails contain no asset figures and no attachments; we provide reports as a download link that expires after 14 days. In our logs, we store only a hash of the recipient address.

If you write to us by email, your message is received in our mailboxes at Hostinger (Hostinger International Ltd., Cyprus) and processed with Microsoft 365 (Microsoft Ireland Operations Ltd.).

12. Links for external parties

You can share individual tasks, data rooms or reports via links for external parties, for example with your adviser or your notary. The links are based on 256-bit random tokens, of which we store only a hash. They are valid for a single matter only, are time-limited (tasks 14 days, data rooms 30 days, reports 14 days), can be revoked at any time and are protected against automated access. Every access is logged with the time and a hashed IP address and browser identifier, and can be viewed by you. The choice of recipients is yours.

13. Misuse and bot detection

In order to detect automated access without our consent, we evaluate signals that contain no content data: interaction counters, decoy elements invisible to humans and a random session pseudonym per browser tab, which ends when the tab is closed. There is no cross-device tracking; no cookies are set for advertising or analytics purposes. Access to storage is strictly necessary for the security of the service (Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG)). In the event of suspicion, we inform the operator and, where appropriate, end the session.

14. Market data without personal reference

We retrieve prices, precious metal prices, exchange rates and public news feeds exclusively from our servers (including Twelve Data, Metals-API, Frankfurter API/ECB and public news sources). Only security symbols or feed requests are transmitted in this process; no data about you and not your IP address.

15. Recipients and transfers to third countries

We do not sell data. We pass data only to the following service providers, which we have contractually bound as processors (Art. 28 GDPR), or where we are legally obliged to do so. The complete list can be found in Terms and conditions, Annex 4.

Insofar as a provider is certified under the EU-US Data Privacy Framework, the transfer is based on the adequacy decision of the European Commission (Art. 45 GDPR), and otherwise on EU standard contractual clauses (Art. 46(2)(c) GDPR). You can obtain a copy of the safeguards on request.

16. Legal bases

Providing the account and contract data is necessary for the conclusion of the contract; without it, we cannot make the platform available to you. You decide on all other information yourself.

17. Storage period and erasure

After the contract ends, you have read-only access for 90 days and can retrieve a complete export package (all documents and the core data as CSV). We remind you at the start of this period and 30 and 7 days before it expires. We then permanently delete all data of your tenant, including the documents and the access connections at finAPI. On request, we delete it earlier. Document content, AI responses, banking credentials and passwords are not logged.

18. Your rights

Under the GDPR, you have the following rights:

• Access (Art. 15) and data portability (Art. 20), in the platform via the export package
• Rectification (Art. 16), directly in the platform
• Erasure (Art. 17) with logged final erasure
• Restriction of processing (Art. 18)
• Objection to processing based on Art. 6(1)(f) on grounds relating to your particular situation (Art. 21)
• Withdrawal of consent given, with effect for the future (Art. 7(3)), for example for SmartAssist in the settings

An email to info@finaure.eu is sufficient. If your request concerns data that a customer has entered as controller (section 2), we forward it to that customer.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the state of your habitual residence. The authority competent for us is the Hessian Commissioner for Data Protection and Freedom of Information (Hessischer Beauftragter für Datenschutz und Informationsfreiheit, HBDI), Gustav-Stresemann-Ring 1, 65189 Wiesbaden. Further supervisory authorities: Austria – Data Protection Authority (Datenschutzbehörde, DSB); Italy – Garante per la protezione dei dati personali; France – CNIL; Spain – AEPD; Croatia – AZOP.

19. Data security

Hosting in the EU on SOC 2 Type 2 certified infrastructure, encryption at rest (AES-256) and in transit (TLS 1.2 or higher), server-side enforced tenant separation (Row Level Security), role and visibility model, two-factor authentication, four-eyes principle for payments, security headers, session timeout and daily backups. The full description can be found in the technical and organisational measures (Terms and conditions, Annex 3, Part B).

20. Further information

No automated decisions: No decisions within the meaning of Art. 22 GDPR are made. If your gross assets increase, the notification suggesting a higher licence tier is merely an offer; the price changes only after your confirmation.

Changes: We amend this policy when processing changes, for example in the case of new features or service providers. The version published here is authoritative.

Last updated: October 2026