Privacy Policy

Finsights is a financial insights and reporting platform operated by Fincredible Accountancy B.V. (“Finsights”, “we”, “us”), registered in the Netherlands (VAT NL867404231B01). We are the data controller for the personal data described in this policy. You can reach us at info@fincredible.nl.

We collect and store only what is needed to provide the service:

• Account & identity data — your name and email address, obtained when you sign in with Google or Microsoft.
• Financial & accounting data — data synced read-only from your Exact Online administration(s): general ledger accounts, transactions, cost centres, budgets, relations (customers/suppliers) and administration/division metadata.
• Connection credentials — OAuth access and refresh tokens for your Exact Online connection, stored encrypted.
• Technical data — server and application logs (e.g. timestamps, request metadata) used for security and troubleshooting.

• Via Exact Online — when you authorise the connection through Exact’s OAuth 2.0 flow, we retrieve your accounting data via Exact’s API. The connection is read-only: we never write data back to Exact Online.
• Via single sign-on — identity data is provided by your Google or Microsoft account when you sign in.
• Automatically — technical logs are generated as you use the platform.

• To provide financial dashboards, reporting and analysis for your organisation.
• To authenticate you and control access to your organisation’s data.
• To secure, maintain and troubleshoot the service.

Our legal bases (under the GDPR/AVG) are your consent, the performance of our contract with your organisation, and our legitimate interest in operating and securing the service. We do not sell your data or use it for advertising.

Data is hosted in the European Union on Google Cloud Platform (region europe-west4). We use a small number of sub-processors:

• Google Cloud Platform — hosting and database storage of the synced data.
• Resend — transactional email. Configured but not currently used: the platform sends no email today. No Exact Online financial data is shared.

Connection tokens are encrypted at rest (AES-256) and all data is transmitted over TLS. The database is reachable only from a private network, access is controlled with least-privilege identity and access management, and changes to the service go through code review and testing before release.

• Synced financial data and connection tokens are retained while your organisation has an active Finsights account and Exact Online connection.
• When you disconnect Exact Online, or when your organisation’s account is closed, the associated synced data and tokens are deleted within 30 days.
• Backups containing deleted data are rotated out within a further 30 days.
• Technical logs are retained for a limited period for security and diagnostics.

You are in control of the connection and your data at any time:

• Disconnect in Finsights — disconnecting your Exact Online integration in the app revokes the stored tokens and stops further syncing.
• Revoke in Exact Online — you can withdraw the app’s access at any time from the Exact Online App Center, under the app permissions for your administration.
• Request deletion or a copy — email us at info@fincredible.nl to request deletion of your data or an export of it.

Under the GDPR/AVG you also have the right to access, rectify, erase, restrict, port and object to the processing of your personal data, and to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

We use only essential cookies needed to keep you signed in and to operate the platform. We do not use advertising or third-party tracking cookies.

We may update this policy from time to time. Material changes will be reflected by the “Last updated” date above.

Questions about this policy or your data? Contact us at info@fincredible.nl.