Privacy Policy

Finaxel operates Finaxel. This policy explains what personal information we handle on the website and in the application, why, and who we share it with.

We decide how your account data is used (we are the “controller” or “business”). The data you enter about your customers, vendors and employees we process on your behalf, as a service provider (“processor”): see section 10.

What you give us:

• Account: name, email, password (stored only as a bcrypt hash), optional photo, two-step verification settings.
• Business: name, address, phone, email and tax profile (EIN, entity type, state employer IDs).
• Subscription: plan, dates and Stripe customer identifiers. Card details go to Stripe; Finaxel never sees or stores them.
• Messages you send to support.

What you enter about other people (“Customer Data”): customers and vendors (including vendors’ taxpayer identification numbers for Form 1099), employees (name, email, home address, work state, pay, W-4 elections and only the last 4 digits of the SSN), invoices, bills, transactions and journal entries.

From services you connect: from Plaid, your accounts’ name, type and last digits, balances and transactions; from Stripe, your payment account status and the payments, payouts and fees on your invoices; from PayPal, if you connect your account, your full name, your PayPal email address, your account identifier (payer ID), whether PayPal considers the account verified, and the payments you receive that way; from Google, if you sign in with Google, your name, email, profile photo and account identifier.

Generated when you use the Service: IP address, browser and operating system, sign-in times, security events, trusted devices, and server and audit logs. Cookies and browser storage are explained in the Cookie Policy. We use no analytics or advertising tools.

• To provide the Service: bookkeeping, invoices, payments, reconciliation, payroll calculations and tax worksheets.
• To process your subscription and your customers’ payments.
• To send service emails: verification codes, sign-in alerts, receipts, renewal reminders and, on your behalf, invoices and reminders to your customers.
• Security: preventing fraud and abuse, limiting sign-in attempts, two-step verification, inactivity sign-out and audit logs.
• Support, legal compliance and troubleshooting.

We make no automated decisions with legal effects on you. We do not use your financial data for advertising or to train artificial-intelligence models.

• Creem — Merchant of record for Finaxel Pro: it sells and charges your subscription (privacy policy).
• Stripe, Inc. — Online card payments for the invoices you send your customers (privacy policy).
• PayPal, Inc. — PayPal payments for your invoices and checkout links, only if you enable it (privacy policy).
• Plaid Inc. — Bank account connections, only if you connect a bank (privacy policy).
• Google LLC — Sign in with Google, only if you use it (privacy policy).
• Infrastructure providers: server and database hosting, email delivery and backup storage, which process data only to provide those services to us.
• Your team: people you invite see the modules you allow.
• Your customers: receive the invoices and payment links you send them.
• When the law requires it or to protect rights and safety, and in a reorganization or sale of the business, under this same policy.

We do not sell personal information or “share” it for cross-context behavioral advertising, as those terms are defined under California and other state privacy laws.

Plaid. Finaxel uses Plaid Inc. to gather your data from financial institutions. By connecting a bank, you grant Finaxel and Plaid the right, power and authority to act on your behalf to access and transmit your personal and financial information from your institution, and you agree that Plaid may transfer, store and process it in accordance with the Plaid End User Privacy Policy. We store the access token Plaid gives us encrypted; we never receive your bank password.

PayPal. If your organization collects with PayPal, you can link your account using “Log in with PayPal”. It is optional: it exists so that the address where you receive money is confirmed by PayPal rather than depending on you typing it correctly.

When you sign in, PayPal shows you a consent screen and gives us only what you approve there:

• Full name — to identify the linked account in your dashboard.
• Email address — this is where payments for your invoices and checkout links are sent. Without it we cannot direct the money to your account.
• PayPal account ID (payer ID) — so we recognise the same account even if you change your email.
• Account verification status — so we can warn you if PayPal does not consider your account verified before you send invoices.

We do not request your postal address or any other detail of your PayPal account, and we never see your PayPal password. We do not store the PayPal access token: we use it once, at the moment you link the account, to read those details, and then discard it.

We use this information solely to direct your payments to your account, to show you the state of the link, and to keep the accounting record of payments received. We do not sell it, do not share it with advertisers and do not use it to profile you.

You can unlink at any time from Connected Accounts: doing so deletes the PayPal email, payer ID and verification status from your organization. You can also revoke the permission from your own PayPal account, under Settings → Security → Permissions you have granted. Accounting records of payments already received are kept as described in section 7, because they form part of your books.

The money you collect goes directly from your customer to your PayPal account: Finaxel does not receive it, hold it or forward it. PayPal’s handling of your data is governed by the PayPal Privacy Statement.

We only use essential cookies and storage (session, security and your preferences). We honor the Global Privacy Control signal; since we do not sell or share data, it does not change how we process it. Details are in the Cookie Policy.

• For as long as your account is active.
• If you close your account or ask us to delete it, we delete or de-identify your data within 30 days, except what the law requires us to keep (for example, billing records, up to 7 years) and the security logs we need.
• Backups are overwritten on a cycle of about five weeks.
• You must keep your own accounting, tax and payroll records for the periods the law requires (the IRS requires at least 4 years for employment taxes): export them before closing your account.

• Encrypted connections over HTTPS.
• Passwords stored with bcrypt; bank tokens and email credentials encrypted with AES-256-GCM.
• Optional two-step verification, sign-in attempt limits, sign-in alerts for administrators and sign-out after 3 hours of inactivity.
• Isolation between organizations, per-module permissions and an audit log.
• Card data never passes through our servers (Stripe processes it).

No system is completely secure. If a breach affecting you occurs, we will notify you as the law requires.

Depending on where you live (for example California, Virginia, Colorado, Connecticut, Texas or Oregon), you may have the right to: know what data we hold and get a copy; correct it; delete it; receive it in a portable format; opt out of its sale, “sharing” or targeted advertising (we do none of the three); and limit the use of sensitive information (we only use it to provide the Service). We will not discriminate against you for exercising them.

• How: email support@finaxel.shop. We verify your identity through your account email. An authorized agent may act for you with signed permission.
• Timing: we respond within 45 days (extendable by another 45 with notice).
• Appeals: if we deny your request, reply with the subject “Appeal” and we will review it within 45 days; if we still disagree, you may contact your state attorney general.
• California (“Shine the Light”): we do not share personal information with third parties for their own direct marketing.

We process this data on your behalf and only to provide the Service to you. If one of those people wants to exercise their rights, they should contact you; we will help you respond. You are responsible for informing them and having a legal basis to enter their data.

Finaxel is a business service and is not directed at anyone under 18. We do not knowingly collect data from children under 13; if we learn we have, we delete it.

The Service is intended for United States businesses. Data may be processed in the United States and in other countries where our providers operate.

We will post any change on this page with its new date. If a change is material, we will notify you by email or in the app before it takes effect.

• Operator: Finaxel
• Email: support@finaxel.shop
• Website: https://finaxel.shop