Legal
Privacy Policy
Last updated: October 17, 2026
This translation is provided for convenience. If it differs from the Portuguese version, the Portuguese version prevails.
This Policy explains how Pedro Luiz Chagas, CNPJ 24.811.306/0001-96, whose address is Rua Equador, 121 – Nações, Divinópolis/MG, CEP 35500-564 (“FinlyUp”, “we”), handles personal data on the finlyup.com.br website and in the FinlyUp app, under Brazil’s General Data Protection Law (Law No. 13,709/2018, “LGPD”). It complements the Terms of Use, which define the terms used here, such as “workspace” and “Customer Data”.
1. Who handles your data
FinlyUp is the controller of the data of your account, your workspace, billing, security and support, and of the data of website visitors: we decide how and why that data is used.
When Customer Data includes personal data of third parties — the customer’s clients, suppliers or staff who are individuals —, the customer is the controller and FinlyUp acts as a processor: we handle that data only to provide the service, under the Terms of Use and the customer’s instructions. Requests about that data should go to the customer; if we receive one, we will forward it to them.
2. Data we handle
Depending on how you use FinlyUp, we handle:
- Sign-up: name, e-mail, password and language. The password is stored only as a cryptographic digest (hash), never as text.
- Account security: your open sessions, with the IP address and browser of each; two-step verification, whose secret and recovery codes are encrypted; and the devices marked as trusted.
- Workspace and companies: the workspace name, the members and each one’s role, invitations (with the invitee’s e-mail) and each company’s data, such as name, legal name, CNPJ, country, currency, time zone and industry.
- Customer Data: the reports imported and the data entered, such as entries, bills, sales, purchases, inventory and prices. They may include personal data of third parties, such as the name, CPF or CNPJ, e-mail, phone and city of customers and suppliers, salespeople’s names and the descriptions and notes of entries. During an import, we keep a copy of the file’s rows; the file itself is not kept.
- Artificial intelligence: the questions asked to the assistant and its answers, the generated texts (such as the executive summary and the insights), the ratings you give to answers and each workspace’s AI usage.
- Billing: the customer and subscription identifiers at Stripe, the status and dates of each subscription and a code derived from the CNPJ, from which the CNPJ cannot be recovered, used only to limit the free trial to once per CNPJ. Card data stays with Stripe; we only show the brand and the last 4 digits, read from Stripe.
- Activity log: sign-ins and sign-outs, password changes, changes to two-step verification, data changes and exports, with date, time, IP address and browser. The record of a change keeps the values before and after it.
- Access records: the date, time and IP address of each sign-in and of the use of each session, which the Brazilian Internet Civil Framework requires us to keep.
- Technical data: the IP address and time of sign-in attempts and other actions, used to limit abuse; the country and time zone derived from the IP address, used to choose the language, price and time zone shown, without being stored; and the cookies described below.
- Support: the messages you send to our e-mail addresses, with whatever data they carry.
The website has no forms and no analytics or advertising tools: we only handle the technical data of the visit and the language and price cookies.
3. Why we use it and on what legal basis
We use the data for the purposes below, each with the LGPD legal basis shown:
- Providing the service: creating and keeping the account and the workspace, authenticating access, calculating and showing the analyses, generating exports and answering through the assistant. Basis: performance of a contract (art. 7, V).
- Invitations: sending the invitation to the person named by a workspace member. Basis: steps prior to a contract and the workspace’s legitimate interest (art. 7, V and IX).
- Service e-mails: e-mail confirmation, password reset and change, invitations and notices about the free trial and data deletion. We do not send marketing e-mails. Basis: performance of a contract (art. 7, V).
- Billing: taking out and charging subscriptions, controlling the free trial and issuing tax documents. Basis: performance of a contract and compliance with a legal obligation (art. 7, V and II).
- Security and abuse prevention: limiting attempts, protecting accounts, logging activity, investigating incidents and checking whether a password appears in known breaches. Basis: legitimate interest (art. 7, IX).
- Access records: keeping the date, time and IP address of accesses for the period required by the Brazilian Internet Civil Framework (Law No. 12,965/2014, art. 15). Basis: compliance with a legal obligation (art. 7, II).
- AI quality: tracking usage and answer ratings to control costs and improve the assistant. Basis: legitimate interest (art. 7, IX).
- Support and rights: replying to messages and to data subjects’ requests and defending ourselves in proceedings. Basis: performance of a contract, compliance with a legal obligation and the regular exercise of rights (art. 7, V, II and VI).
We handle Customer Data as a processor, only to provide the service. We do not sell personal data, we do not use it for advertising and we do not use Customer Data to train artificial intelligence models.
4. Artificial intelligence
The assistant, the executive summary, the explanations, report recognition in imports and PDF reading use artificial intelligence models from Anthropic (Claude), accessed through the Vercel AI Gateway, which may route the request to another provider of the same model. In every request, we require the provider not to use the data to train models.
What goes to the model depends on the feature:
- Assistant: your question, as you wrote it, the earlier messages of the conversation, the company name and the period, and the numbers FinlyUp calculates to answer. In the results sent, the names of customers and suppliers who are individuals are replaced by a placeholder.
- Executive summary and explanations: aggregated numbers and facts calculated by FinlyUp, with individuals replaced by a placeholder.
- Imports: the headers and up to 15 sample rows of the file, to recognize the columns, and entry descriptions, to suggest the classification. We try to remove e-mails and document numbers before sending, but this removal is not perfect, and names may go along.
- PDF reading: the whole file.
So avoid writing personal data in your questions to the assistant. Providers may keep requests for a limited period, under their own terms, for example to prevent abuse. Conversations stay saved in FinlyUp until you delete them or until the company they belong to is deleted. The owner and the admins can turn off AI for the workspace at any time.
6. International transfers
The database is in Brazil, but some of the providers above handle data in the United States or in other countries. These transfers follow the cases of art. 33 of the LGPD and the rules of the Brazilian Data Protection Authority (ANPD), with the contractual safeguards provided in each provider’s terms.
7. How long we keep it
We keep data for as long as the purposes above require and for the periods set by law:
- Account: while it exists. Currently, account deletion is done on request, by e-mail to privacidade@finlyup.com.br.
- Sessions: up to 30 days; a session unused for 7 days expires sooner.
- Customer Data: while the company exists. Deleting a company erases its data at once, except the activity log and the billing history, which follow the periods below. After a subscription ends, the company stays available read-only for 30 days, and its data is deleted 90 days after the end, with an e-mail notice 7 days before.
- Copy of imported rows: up to 30 days after the import is completed, rolled back or fails; an unfinished import stays until it is discarded.
- Conversations with the assistant: until the user deletes them or along with the company they belong to.
- Activity log: 2 years, even after the company is deleted.
- Access records: 6 months, as the Brazilian Internet Civil Framework requires (art. 15), even after the account is deleted. They are kept confidential, with restricted access, and are handed over only under a court order.
- Attempt limits: the IP address used to control sign-in attempts is kept up to 24 hours.
- Invitations: while the workspace exists.
- Billing: the subscription history, while the workspace exists; the code derived from the CNPJ that controls the free trial, indefinitely and only for that purpose; and tax and payment documents, for the period set by law.
- Hosting technical logs: up to 30 days.
Deleted data may remain for a few hours in the database’s recovery history, until it is overwritten.
8. Your rights
Under the LGPD (art. 18), you may request:
- confirmation that we handle your data and access to it;
- correction of incomplete, inaccurate or outdated data;
- anonymization, blocking or deletion of unnecessary or excessive data, or of data handled in breach of the law;
- portability of the data to another provider, under the ANPD’s rules;
- deletion of the data handled with your consent, when that is the legal basis;
- information about who we share your data with;
- information about the possibility of not giving consent and its consequences, and the withdrawal of a consent given;
- objection to handling based on another legal basis, when the law is not complied with.
In the app, you can edit your name, language, password and two-step verification, see and end your sessions, export the data on screen to Excel or CSV, depending on your role, and, as owner or admin, delete a company. Other requests — such as changing your e-mail, getting a complete copy of your data or deleting your account — are made by e-mail to privacidade@finlyup.com.br.
To protect you, we may confirm your identity before acting on a request. We reply within 15 days, the LGPD period for a complete answer. If the data belongs to a customer’s workspace, we will forward the request to that customer, who is the controller. You may also petition the ANPD.
9. Security
We adopt technical and administrative measures to protect the data, including:
- encrypted connections (HTTPS) and encryption at rest by the infrastructure providers;
- isolation of each workspace’s data in the database itself, which the app accesses with minimal permissions;
- passwords stored as hashes and a check against leaked passwords, in which the Have I Been Pwned service receives only the first 5 characters of a digest of the password, never the password;
- e-mail verification, two-step verification, which the workspace can require of all members, and attempt limits;
- an activity log and access records that the app cannot change.
No system is completely secure. If a security incident may cause relevant risk or harm, we will notify the ANPD and the affected people, under the LGPD (art. 48) and the ANPD’s rules.
11. Children and teenagers
FinlyUp is meant for businesses and for people aged 18 or over. We do not knowingly collect data from children or teenagers; if we learn of such an account, we will delete it.
12. Users outside Brazil
If you are in the European Economic Area or the United Kingdom, you also have the rights of the General Data Protection Regulation (GDPR): access, rectification, erasure, restriction, portability, objection and a complaint to your country’s data protection authority. The legal bases are the same as in this Policy: performance of a contract, legitimate interest and compliance with a legal obligation. The data stays in Brazil and with the providers described above, and requests go to the same e-mail.
13. Data protection officer
The officer in charge of personal data processing (encarregado) is Pedro Luiz Chagas, who can be reached at privacidade@finlyup.com.br.
14. Changes to this Policy
We may update this Policy. The date of the current version is at the top of this page, and we will announce relevant changes by e-mail or in FinlyUp before they take effect.
15. Contact
Pedro Luiz Chagas · CNPJ 24.811.306/0001-96 · Rua Equador, 121 – Nações, Divinópolis/MG, CEP 35500-564
Personal data requests: privacidade@finlyup.com.br
Other matters: suporte@finlyup.com.br