Privacy Policy

Data We Process

We may process account and profile data, organization settings, contact records, invoices, bills, bank statement files, uploaded supporting documents, chat messages, audio submissions, audit events, and operational security logs.

Why We Process Personal Data

We process personal data to register and authenticate users, administer workspaces, maintain accounting records, process uploaded files, generate reports, detect misuse, investigate incidents, provide customer support, and maintain audit trails for material business actions.

Where AI-assisted features are used, uploaded content and prompts may be processed to transcribe audio, extract text from documents, classify accounting documents, and draft accounting workflows within the product.

Service Providers and Cross-Border Transfers

We may use third-party service providers for cloud hosting, storage, email delivery, document extraction, and AI processing. These providers may process personal data outside Singapore. We expect vendors that receive personal data to protect it to a standard comparable to the requirements under Singapore's Personal Data Protection Act 2012.

Current service categories may include infrastructure and database hosting, email delivery, AI model routing, AI transcription, and OCR providers.

Retention

We retain personal data only for as long as it is needed for business, legal, security, accounting, tax, or dispute-handling purposes. Accounting records and supporting documents may be retained longer than temporary AI artefacts, temporary uploads, or operational logs.

Accuracy

We make reasonable efforts to keep personal data accurate and complete where it is likely to be used to make a decision that affects the individual or to be disclosed to another organization. If you tell us that your data is inaccurate or incomplete, we will correct it as soon as practicable and, where relevant, notify other organizations to which the affected data was disclosed.

Access, Correction, and Consent Requests

Individuals may request access to their personal data, request corrections, or ask questions about how their personal data is handled, subject to applicable law and any relevant business or legal exceptions. We aim to respond as soon as reasonably possible, and where a response will take longer than 30 days we will inform you of the time by which we expect to respond.

You may also withdraw consent for purposes that rely on consent, such as marketing communications, at any time. Withdrawing consent does not affect processing that is required to provide the service, to keep accounting records, or to meet legal obligations, and may limit the features available to you.

Signed-in users may submit a request through the Privacy Request form. If you cannot access your account, email the DPO contact below.

Security

We use application permissions, authentication controls, audit logging, and technical safeguards designed to reduce unauthorized access, use, disclosure, alteration, or loss of personal data.

Contact

For data protection questions, access or correction requests, or incident-related enquiries, please contact the Data Protection Officer at Privacy@finbozo.com.

If you are not satisfied with how we handle your personal data, you may also lodge a complaint with the Personal Data Protection Commission (PDPC) of Singapore.