Privacy Policy

1. Who we are

This Privacy Policy explains how Finance Operating System ("Finance Operating System," "we," "us," or "our") collects, uses, discloses, and protects personal information when you visit our websites or use the Finance Operating System service. Finance Operating System operates from the State of Florida, United States.

This policy is meant to be read with our Terms of Service, Cookie Policy, and, for customer personal data we process on your instructions, the Data Processing Addendum.

2. Scope and roles

When you create an account or browse our marketing site, we act as the business / controller for that information. When you (or your organization) store books, invoices, contacts, payroll inputs, or similar records in the product, we act as a service provider / processor of that Customer Data on your instructions.

3. Information we collect

Account and billing

Name, email address, authentication data, organization name and roles, plan, and payment metadata processed by our payment provider. We do not store full payment-card numbers on our servers.

Customer Data you submit

Financial records, contacts, files, receipts, bank-transaction metadata (via read-only bank connections where you enable them), payroll inputs, and similar content you or your users put in the Service. Bank login credentials are collected by our bank-connection provider, not by Finance Operating System.

Usage and device data

Log data, IP address, browser type, pages viewed, approximate location derived from IP, cookie identifiers, and diagnostic events needed to operate and secure the Service. See the Cookie Policy.

Communications

Messages you send to support, sales, or legal, and emails we send about the Service.

4. How we use information

• Provide, maintain, secure, and improve the Service.
• Create and administer accounts, roles, and billing.
• Generate reports, exports, and AI-assisted drafts you request.
• Detect, prevent, and investigate fraud, abuse, and security incidents.
• Comply with law, enforce our terms, and protect rights.
• Communicate service, security, and (where permitted) product updates.

We do not sell personal information, and we do not share it for cross-context behavioral advertising.

5. AI processing

If you use Copilot or similar features, the prompt and the ledger context required to answer it are sent to our AI model provider to generate a response. Providers process that content to perform the inference. You should not include information in prompts that you are not authorized to process. Review AI output before relying on it.

6. How we share information

We share personal information with:

• Sub-processors that host, send email, process payments, connect banks, perform OCR, deliver AI inference, or provide security (bot protection and CDN). The current list is at Sub-processors.
• Your organization's authorized users and administrators.
• Professional advisors and authorities when required by law, legal process, or to protect Finance Operating System, our users, or the public.
• A buyer or successor in a merger, acquisition, or asset sale, subject to this policy or equivalent protections.

7. Retention

We keep account and billing records for as long as the account is active and as needed for tax, accounting, and dispute purposes. Customer Data can be exported while the account is active. After you delete an organization or we close the account, we hard-delete Customer Data from production systems within 30 days, except backups that rotate on a defined schedule and records we must keep by law (for example, invoices we issued to you).

8. Security

We use administrative, technical, and physical safeguards appropriate to the nature of the data, including encryption in transit, access controls, tenant isolation, and audit logging. No method of transmission or storage is 100% secure. Report suspected vulnerabilities to the contact on our security page.

9. Your choices and rights

You may access, update, or delete much of your information in the product. Organization owners can export or delete workspaces from Settings. You may opt out of non-essential emails and manage non-essential cookies as described in the Cookie Policy.

Depending on where you live (including certain U.S. states), you may have rights to know, access, correct, delete, or obtain a portable copy of personal information, and to appeal a denied request. Submit requests to privacy@financeoperatingsystem.com. We will verify the request and will not discriminate against you for exercising privacy rights. Authorized agents may submit requests where state law allows, subject to verification.

EEA, UK, and Swiss individuals: see the DPA for processor terms. You may have rights of access, rectification, erasure, restriction, portability, and objection, and a right to lodge a complaint with a supervisory authority.

10. Children

The Service is not directed to children under 18, and we do not knowingly collect personal information from children.

11. International transfers

Finance Operating System is established in the United States (Florida). If you access the Service from another country, your information will be processed in the United States and in the countries where our sub-processors operate. For EEA/UK/Swiss customer personal data, the DPA incorporates Standard Contractual Clauses where required.

12. Florida and U.S. law

This Privacy Policy is designed for a U.S. company operating from Florida. Disputes relating to this policy are governed by the laws of the State of Florida, United States, as set out in the Terms of Service, except where a mandatory privacy statute in your place of residence provides otherwise.

13. Changes

We may update this policy. The effective date at the top will change. Material changes will be posted here and, where appropriate, notified by email or in-product notice.

14. Contact

Finance Operating System
State of Florida, United States
Privacy: privacy@financeoperatingsystem.com
Legal: legal@financeoperatingsystem.com
Support: support@financeoperatingsystem.com