Privacy Policy

FINNEWS.AI LIMITED (“Finn”, “we”, “us”, “our”) is a company registered in England and Wales. We operate the Finn market intelligence serviceaccessible via thefinnews.com and the Finn mobile app.

For the purposes of UK GDPR and the Data Protection Act 2018, Finn Intelligence Ltd is the data controller for the personal data we collect about you.

Contact: info@thefinnews.com

We collect and process the following categories of personal data:

• Identity data: Your name and email address, provided when you create an account (via Google OAuth or email/password registration).
• Subscription preferences: The asset classes, regions, sectors, and categories you select during onboarding.
• Payment data: We use Stripe for payment processing. We do not store card details on our systems.
• Usage data: Technical data including your IP address, browser type, pages visited, and timestamps — collected automatically via cookies and server logs.
• Data agreement records: Timestamp and confirmation of your acceptance of our data processing agreement.

We process your personal data on the following legal bases under UK GDPR Article 6:

• Contract performance (Art. 6(1)(b)): Processing your name, email, and preferences to deliver the market intelligence service you subscribed to.
• Legitimate interests (Art. 6(1)(f)): Fraud prevention, security monitoring, and improving our service.
• Legal obligation (Art. 6(1)(c)): Retaining financial records for tax and accounting purposes (7 years under UK law).
• Consent (Art. 6(1)(a)): Non-essential cookies and direct marketing communications, where required.

• To create and manage your account and subscription.
• To deliver personalised market intelligence alerts in the Finn app according to your selected preferences.
• To process payments and manage your subscription billing via Stripe.
• To send transactional emails (account confirmation, subscription receipts, important service notices).
• To detect and prevent fraud, abuse, and unauthorised access.
• To comply with legal obligations and respond to lawful requests from authorities.

We do not sell your personal data to third parties.

We share data with the following service providers:

• MongoDB, Inc. — Database hosting (MongoDB Atlas).
• Google LLC (Firebase) — Authentication services.
• Stripe, Inc. — Payment processing. Subject to Stripe’s own privacy policy and PCI DSS compliance.
• Servers.com — Web application hosting (VPS located in the EU).
• Google LLC — Optional Google OAuth authentication.

All processors are subject to Data Processing Agreements and appropriate safeguards under UK GDPR Chapter V.

• Active account data is retained for the duration of your subscription plus 12 months.
• Financial transaction records are retained for 7 years in compliance with UK tax law.
• Data agreement records are retained for 7 years as evidence of consent.
• When you request account deletion, your personal data is removed within 30 days, except where retention is required by law.

You have the following rights:

• Right of access — obtain a copy of your personal data.
• Right to rectification — correct inaccurate data.
• Right to erasure — (“right to be forgotten”) request deletion of your data.
• Right to restrict processing — limit how we use your data.
• Right to data portability — receive your data in a machine-readable format.
• Right to object — object to processing based on legitimate interests.

To exercise any of these rights, email info@thefinnews.com. We will respond within 30 days. You also have the right to lodge a complaint with the ICO at ico.org.uk.

We classify cookies into Essential (strictly necessary for authentication, session integrity, and privacy preferences), Analytics (aggregated performance tracking), and Marketing (campaign attribution).

Non-essential analytics and marketing cookies are strictly blocked until you give explicit opt-in consent. You can manage or withdraw your cookie consent choices at any time using our Preference Center or through the Cookie Settings link in our site footer. For a complete audit of all cookies used, please review our Cookie Policy.

We implement industry-standard security measures including TLS encryption in transit, AES-256 encryption at rest, and role-based access controls. Stripe handles all payment card data under PCI DSS Level 1 compliance.

We may update this policy periodically. We will notify you of material changes by email and by posting the updated policy on this page with a revised “Last updated” date.