01Current subprocessors
We share personal data only with the vetted subprocessors below, each under a written data-processing agreement. We do not sell, rent or trade your data, and subprocessors may not use it for their own purposes.
- Google Cloud / Firebase (EU region eur3 — Belgium & the Netherlands) — hosting and database; backups — EU multi-region (Google Cloud Storage) and Stockholm, Sweden (Amazon Web Services, client-side encrypted archive); authentication — global (Google). Firebase Authentication (Google) is a global service and is not pinned to a region; your account document and app data are stored in Firestore in the EU (eur3). Google LLC processes it under the EU–US Data Privacy Framework and standard contractual clauses. Firebase Authentication also sends the account emails you ask for (email-address confirmation, password reset) to your email address.
- Amazon Web Services (EU region eu-north-1 — Stockholm, Sweden) — off-site disaster-recovery storage of database and authentication backups; the backup archive is encrypted on our side before upload, so AWS only ever stores ciphertext.
- OpenAI (United States) — AI categorisation of transactions: the bank’s purpose and counterparty descriptions, amount and currency, the category assigned by finAPI (for a transaction imported from a statement file, the bank’s transaction type from that file instead), an internal transaction id, and up to 50 of your earlier description→category pairs.
- SendGrid (Twilio) (United States) — transactional email: your email address and the contents of the message (for an access request made before sign-up became open: your note, your account id and, if you picked one on our homepage, the bank’s name and city), the email address of a person you invite to a business unit (with your display name or email address, the unit's name, the role and the invitation link), plus internal notifications to our team, which can carry what you send us in the app together with your name, email address, sign-up date and how you joined (e.g. a financing-interest answer and its data snapshot). For billing notices: the plan, the trial end date and the payment or plan status.
- Google reCAPTCHA Enterprise (United States) — bot/abuse protection on sign-in and account creation, via Firebase App Check; loaded only when the sign-in or sign-up form is shown, or when a signed-in session returns; device/browser signals + IP.
- Cloudflare (Turnstile) (global / United States) — bot protection on the contact form, the homepage bank search, the add-bank request form and account sign-up; device/browser signals + IP.
- Stripe (Stripe Technology Europe, Limited — Dublin, Ireland; parts of the service in the United States) — payments and subscriptions for paid plans: your e-mail address, user id, the plan and billing period and where in the app the purchase started; Stripe returns the status of your subscription and payments. Card details and billing address are entered on Stripe's page and never reach Finometr. Purchases are “Sold through Link”: for the sale, a Stripe company acts as an independent controller under Link's terms; see Link's privacy notice.
02Independent providers (not sub-processors)
finAPI GmbH (Germany, EU) provides the Open Banking connection under its own PSD2 licence (BaFin-licensed account information service). When you connect a bank, you give finAPI your consent directly in its form, and finAPI processes your bank data as an independent controller under its own privacy notice, not on our instructions. See the Privacy Policy, section “Open Banking”, for what finAPI holds and for how long.
AI assistants you connect (for example Claude by Anthropic or ChatGPT by OpenAI) are not our subprocessors either: they receive what Finometr's tools return at your instruction, under your agreement with their provider. See the Privacy Policy, “Connecting an AI assistant”.
03Changes and notifications
We notify customers before adding a new subprocessor that processes personal data. For transfers outside the EU (currently OpenAI, SendGrid, Google reCAPTCHA Enterprise, Cloudflare, Stripe, and Firebase Authentication, a global Google service, in the United States) we rely on the EU Standard Contractual Clauses and, where the provider is certified, the EU–US Data Privacy Framework — see our Privacy Policy for details.