---
title: Privacy Policy
updated: '2026-10-21'
description: How FinForge collects, uses, stores, and protects personal data.
---

This Privacy Policy explains what personal data FinForge collects, why it is
collected, how long it is kept, and what rights you have. It applies to the
FinForge website (https://fin-forge.eu), the account and license API
(https://api.fin-forge.eu), and the FinForge desktop application and Excel
add-in ("FinForge", "we", "our", "us").

## 1. Data controller

The data controller is:

Florinium OÜ
Viljandi maakond, Viljandi linn, Riia mnt 40, 71009
Republic of Estonia
Registry code: 17623691

Contact for all privacy matters: tonn.alas@gmail.com

## 2. What data we collect

### 2.1 Account data

- Your email address, used as your account identifier and login.
- A password hash. We never store plain-text passwords.
- A pending email address when you request an email change, kept until the
  change is confirmed.

### 2.2 License and billing data

- Your license key, plan, status, and entitlement flags.
- Stripe customer and subscription identifiers, current period end, and trial
  end dates.
- Payment status events received from Stripe.

We do not collect or store card numbers or full payment details. Payments are
processed by Stripe, and card data goes directly to Stripe, never to our
servers. Stripe's processing is governed by Stripe's own privacy policy.

### 2.3 Device activation data

To enforce the machine limit of your plan, the desktop application sends:

- A keyed hash of a machine fingerprint. The raw fingerprint is never stored
  or transmitted; only the hash is kept.
- A machine name you can edit in the app.
- The time the device last contacted the activation service.

Releasing a machine is recorded so the account area can show removal history.

### 2.4 Support and communication data

- Emails you send to tonn.alas@gmail.com and our replies.
- Transactional emails we send through Microsoft Azure Communication
  Services: account creation, password setup and reset links, and email change
  confirmations. We do not send marketing emails.

### 2.5 Administrative audit data

Actions performed by our administrators through the admin dashboard are
logged with the administrator's email, the action, the target account or
license, and a short detail note. This log is used for security and abuse
investigation.

### 2.6 What we do NOT collect

- No website cookies. The website stores a session token in browser
  sessionStorage, which is removed when the tab closes.
- No third-party analytics or tracking scripts on the website.
- No financial or market data from the application. The app fetches market
  data directly from the data providers (for example Yahoo Finance, SEC
  EDGAR, OECD, and central banks) on your own machine. That data stays local
  and is never uploaded to our servers.

## 3. Purposes and legal bases

We process personal data only for the following purposes:

| Purpose | Data | Legal basis (GDPR) |
| --- | --- | --- |
| Providing the account, license, and activation service | Account, license, device data | Performance of contract (Art. 6(1)(b)) |
| Processing payments and subscriptions | License and billing data | Performance of contract |
| Sending transactional emails | Email address | Performance of contract |
| Security, fraud prevention, and abuse investigation | Audit log, activation data | Legitimate interest (Art. 6(1)(f)) |
| Keeping records required by law (for example accounting) | Billing data | Legal obligation (Art. 6(1)(c)) |

## 4. Who receives your data

We do not sell personal data and do not share it with anyone except:

- Stripe, for payment processing (customer portal, subscriptions, invoices).
- Microsoft Azure Communication Services, for sending transactional email.
- Hetzner, which hosts our API and database in the European Union.
- Cloudflare Pages, which hosts the website.

These providers act as data processors and are bound by contracts under
Article 28 GDPR. Where a provider transfers data outside the EEA, the
transfer is covered by the provider's standard contractual clauses or
adequacy arrangements.

## 5. How long we keep data

- Account, license, and device data: for as long as your account or license
  exists.
- Password setup and reset links: they expire after a short lifetime
  (approximately one hour) and are deleted on use.
- The administrative audit log is kept for security and record-keeping
  purposes.
- Data deleted with an account is removed together with the account,
  including its licenses, devices, and entitlements.

To delete your account and its data, write to tonn.alas@gmail.com from the
email registered on the account.

## 6. Security

- Passwords are stored as salted hashes.
- Machine fingerprints are stored only as keyed hashes.
- All traffic between the app, the website, and the API uses TLS.
- Session tokens are stored in sessionStorage only, never in cookies or
  persistent storage.

No method of transmission or storage is completely secure, and we cannot
guarantee absolute security.

## 7. Your rights

Under the GDPR, you have the right to:

- Access the personal data we hold about you.
- Rectify inaccurate or incomplete data.
- Erase your data (where no legal obligation requires us to keep it).
- Restrict processing in certain situations.
- Receive your data in a structured, commonly used format (data portability).
- Object to processing based on legitimate interests.
- Withdraw consent, where processing is based on consent.
- Lodge a complaint with a supervisory authority. In Estonia that is the
  Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee).

To exercise any of these rights, email tonn.alas@gmail.com. We respond within
one month.

## 8. Children

FinForge is not directed at children under 16, and we do not knowingly
collect personal data from them.

## 9. Changes to this policy

We may update this policy when our processing changes. The date at the top
shows the current version. Material changes will be announced on the website.

Last updated: 21 October 2026.