Privacy Policy

01Overview

This Privacy Policy explains how Finowl Inc. ("Finowl", "we" or "us") collects, uses, shares and protects personal information when you visit finowl.co, use the dashboard at app.finowl.co, call the Finowl API or contact us (together, the "Services").

The short version:

• We collect only what we need to run your account, bill you and keep the Services secure.
• Data you send through the API is processed transiently to return a result. We do not keep the contents of API requests or responses.
• Passwords sent to the password check are never logged, stored or returned.
• We do not sell personal information, we do not use it for advertising and our website does not use tracking or analytics cookies.

02Our role

Account data. For information about our customers and website visitors, such as your email address, account settings and billing records, Finowl is the controller. This policy describes how we handle that information.

API data. When our customers send personal information to the API, such as an email address, name or username belonging to their own users or contacts, Finowl acts as a processor or service provider on the customer's behalf. The customer decides why and how that information is processed, and their own privacy notice applies. Our obligations for API data are set out in our Data Processing Addendum. See Information submitted about you by our customers below.

03Information we collect

Information you provide

• Account information: your email address and, if you choose to set one, a password. We store passwords only as salted bcrypt hashes.
• Profile and settings: optional details you add in the dashboard, such as a display name, timezone, country preference and default endpoint.
• API key details: the labels you give your keys. We store only a hash of each key and a short, non-secret prefix that helps you tell keys apart.
• Communications: the content of emails and support requests you send us.

Information created when you use the Services

• Usage records: for each API request, the endpoint, time, which of your keys was used, the number of items, the outcome and status code, the duration and the credits consumed. These records do not include the inputs you sent or the results we returned.
• Authentication data: hashed sign-in links, which expire after 15 minutes, and hashed session tokens, which expire after 30 days.
• Purchase records: the credit packs you buy, amounts, dates, payment status and your credit balance.
• Technical data: IP addresses, browser and device information and request headers, processed by our servers and infrastructure providers to deliver pages and API responses and to protect the Services from abuse.

Information from third parties

• Payment partner: when you buy credits, our payment partner processes your payment details and tells us whether the payment succeeded. We never receive or store your full card number.

API data

Inputs you send to the API, such as email addresses, names, usernames and passwords, are processed only for as long as needed to produce a result and are not stored afterwards. For password checks, the password is hashed in memory and matched using only a partial hash, so the full password is never used in the lookup.

04How we use information

We use personal information to:

• create and manage your account, sign you in and authenticate API requests;
• provide the Services, including returning API results and showing usage, logs and balances in your dashboard;
• process purchases, track credits and keep financial records;
• send transactional emails, such as sign-in links, purchase confirmations and important notices about your account or these policies;
• enforce rate limits and our Acceptable Use Policy, and detect, prevent and investigate fraud, abuse and security incidents;
• respond to your questions and provide support;
• maintain and improve the Services using aggregated usage information, such as which endpoints are used most; and
• comply with legal obligations and enforce our agreements.

We do not use API data to train models, build profiles or for any purpose other than returning the result you asked for. We do not make decisions about you that produce legal or similarly significant effects based solely on automated processing.

05Legal bases for processing

If you are in the European Economic Area, the United Kingdom or Switzerland, we rely on the following legal bases:

06How we share information

We do not sell personal information and we do not share it for cross-context behavioral advertising. We share personal information only as follows:

• Service providers. Companies that help us operate the Services, including hosting and infrastructure providers, email delivery providers, our payment partner and data intelligence partners that perform parts of a lookup on our behalf. They may use personal information only to provide services to us, under contracts that require them to protect it.
• Legal requirements. When we believe disclosure is required by law, regulation, legal process or a valid government request, or is necessary to protect the rights, property or safety of Finowl, our customers or others.
• Business transfers. In connection with a merger, acquisition, financing, reorganization or sale of assets, subject to standard confidentiality protections. We will notify you if your information becomes subject to a different privacy policy.
• With your consent or at your direction.

07Cookies

Our marketing website does not set cookies and does not use analytics, advertising or tracking technologies. The dashboard uses only strictly necessary cookies to keep you signed in and to complete sign-in links securely. Details are in our Cookie Policy.

08How long we keep information

When you ask us to close your account, we delete or anonymize your account information within 30 days, except records we must keep for legal reasons. Deleted data may remain in backups until they rotate out.

09How we protect information

We use administrative, technical and organizational measures designed to protect personal information, including encryption in transit with HTTPS, hashing of passwords, sign-in links, session tokens and API keys, transient processing of API inputs, access controls and rate limiting. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will notify you and the relevant authorities as required by law.

10International transfers

Finowl is based in the United States, and we and our service providers may process personal information in the United States and other countries. Where we transfer personal information from the European Economic Area, the United Kingdom or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum.

11Your rights and choices

Depending on where you live, you may have the right to:

• access the personal information we hold about you and receive a copy in a portable format;
• correct inaccurate or incomplete information;
• delete your personal information;
• object to or restrict certain processing, including processing based on legitimate interests;
• withdraw consent where we rely on it; and
• not be discriminated against for exercising your rights.

You can update most account details in the dashboard. To exercise any other right, email support@finowl.co from the address on your account. We may need to verify your identity before acting on a request, and we will respond within the time required by law, generally within 30 days, or 45 days where US state law applies. You may use an authorized agent where the law allows, and if we decline a request you may appeal by replying to our decision.

If you are in the EEA, UK or Switzerland, you also have the right to lodge a complaint with your local data protection authority.

You will receive transactional emails while your account is open, because they are necessary to provide the Services. We do not send marketing emails without your consent, and every marketing email will include an unsubscribe link.

12Additional information for US residents

This section applies to residents of California and other US states with comprehensive privacy laws. In the past 12 months we have collected the following categories of personal information, for the business purposes described in How we use information:

• identifiers, such as email address, account identifiers and IP address;
• commercial information, such as credit pack purchases;
• internet or network activity, such as API usage records; and
• account credentials, such as hashed passwords and API keys.

We disclose these categories to service providers for business purposes only. We do not sell or share personal information as those terms are defined under California law, we have no actual knowledge of selling or sharing information of consumers under 16, and we do not use or disclose sensitive personal information for purposes that would give you a right to limit it.

13Information submitted about you by our customers

Our customers may send us information about their own users or contacts, such as an email address to check for breaches or a name to estimate gender. In that case, the customer is responsible for that processing and Finowl processes the information only on their instructions, transiently, to return a result.

If you believe a customer has submitted your information to Finowl, please contact that customer directly to exercise your rights. If you contact us, we will forward your request to the relevant customer where we can identify them, and assist them in responding.

14Children

The Services are intended for businesses and are not directed to children. We do not knowingly collect personal information from anyone under 18 to create accounts. If you believe a child has created an account, contact us and we will delete it.

15Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through the dashboard before they take effect. The "Last updated" date at the top of this page shows when it was last revised.

16Contact us

For privacy questions or requests, contact Finowl Inc. at support@finowl.co.