Privacy Policy

1. Who we are and what this policy covers

FinStream is a finance operating platform for procurement, accounts payable, treasury, accounting, tax and financial planning. It is operated by 111255 PTE. LTD., 160 Robinson Road, #14-04 Singapore Business Federation Center, Singapore 068914 ("FinStream", "we", "us").

This policy covers the FinStream web application at finstream.app, the supplier portal, our transactional emails, and the AI-assistant connector that lets a customer connect an assistant such as Claude to their own FinStream account. It does not cover a third-party service you separately connect to FinStream — that service is governed by its own policy.

2. Our role: when we are a controller and when we are a processor

We act as a processor (a service provider) for the finance records a customer organisation enters into FinStream — its vendors, purchase requests, purchase orders, invoices, payment runs and accounting entries. The customer organisation decides what that data is and why it is there; we process it under our agreement with them.

We act as a controller for the data we need in order to run FinStream itself: account identity, organisation membership and role, sign-in and security events, support correspondence, connector authorisations, and product telemetry. Where the two overlap, the stricter treatment applies.

3. Information we collect

We collect only what the platform needs to function. We do not buy personal data from data brokers, we do not run advertising, and we do not sell or share personal data for cross-context behavioural advertising.

• Account identity — Your email address, your display name, the organisations and companies you belong to, your role (admin, approver, editor or viewer) and the approval capabilities granted to you.
• Authentication data — Password hashes and session tokens held by our authentication provider, and sign-in, sign-out and password-reset events. We never see or store your password in readable form.
• Customer finance records — The records your organisation enters or imports: vendors and their contacts, cost centres and budgets, purchase requests and orders, invoices and credit notes, tax determinations, journal entries and accounting periods.
• Uploaded documents — Invoice PDFs and images, purchase-order attachments, bank statements and supporting evidence you or your suppliers upload, together with the text extracted from them.
• Supplier data — Where a supplier uses the supplier portal, the profile and banking details that supplier maintains about itself, and the approval decisions a buyer takes on them.
• Connector authorisations — For each AI assistant you connect: which assistant it is, the identity scopes it was granted, and when the grant was made. You can see and revoke every grant in Settings, Integrations, Agents.
• Connector call telemetry — One row per assistant tool call: the tool name, the outcome, your user id, the resolved organisation and company, and a SHA-256 hash of the call arguments. We store the hash, never the arguments themselves.
• Service logs — IP address, user agent, timestamps, request paths and error traces produced by our hosting and database providers in the ordinary course of serving requests.
• Communications — Emails you send to our support or security mailboxes, and the delivery status of the transactional emails we send you.

Vendor and supplier records may include a business tax registration number and company registration number, because invoices and tax determinations depend on them.

4. How we use information

• To provide the platform: authenticate you, show you the records your role permits, route approvals, match invoices to purchase orders, build payment runs and post accounting entries.
• To extract data from documents you upload, using third-party artificial-intelligence services engaged on our behalf, so that an invoice does not have to be typed twice.
• To suggest general-ledger coding and detect tax treatments, which a human then accepts or changes. A suggestion is never an approval.
• To send transactional email: invitations, approval requests, remittance advices, supplier notifications and security notices. We do not send marketing email to platform users.
• To keep the platform secure and available: rate limiting, abuse detection, audit trails, error monitoring and backups.
• To support you when you ask us to, and to investigate a reported problem.
• To meet our legal, tax and accounting obligations, and to enforce our terms.

5. The AI-assistant connector: what it can and cannot see

A FinStream administrator can allow AI-assistant access for their organisation, and each user can then connect their own assistant. The connection is made with OAuth 2.1: you sign in to FinStream yourself and approve the connection on a FinStream consent screen. No administrator can connect an assistant on your behalf, and no assistant is connected by default — organisation access is off until an administrator turns it on.

• A connected assistant sees exactly what your own FinStream account sees, and nothing more. Every tool call re-runs the same server-side permission checks the web application uses, for your user, in your organisation.
• A connected assistant can read finance records and create or edit drafts. It cannot approve anything, release a payment, move money, post or close an accounting period, or delete a record. Those actions are human actions inside FinStream and are structurally unavailable on the connector surface.
• FinStream never reads your assistant's conversation history, its memory, its files, or anything else on the assistant's side. The connector is inbound only: the assistant calls FinStream; FinStream never reaches back into the assistant for your data.
• Turning organisation access off blocks every further tool call immediately. Existing grants stay in place, inert, until you revoke them.

When you use a third-party assistant with FinStream, your conversation with that assistant is governed by that assistant vendor's own privacy policy, not by this one. What FinStream returns to the assistant becomes part of that conversation.

6. How we share information

In the course of providing the service we engage third-party service providers that process information on our behalf and on our documented instructions, including without limitation providers of database, application hosting, content delivery, authentication, transactional email, document-extraction and other artificial-intelligence processing services, and, where your organisation elects to connect them, accounting and payment-gateway providers. Such providers are permitted to process information only to the extent necessary to deliver their service to us, and each is bound by contractual obligations of confidentiality and data protection no less protective than those set out in this policy. The identity of the providers we use may change from time to time as our operational needs require.

We do not sell personal data, and we share nothing with advertisers or data brokers.

7. Where information is stored and transferred

FinStream is operated from Singapore. Customer data is held in our database provider's data centre in Mumbai, India.

Where a transfer leaves a jurisdiction with transfer restrictions, we rely on the mechanism available to that transfer — most often the European Commission's standard contractual clauses or the equivalent UK addendum, incorporated in our agreements with the providers concerned.

8. How long we keep information

• Customer finance records and uploaded documents — For as long as your organisation's account is active, and afterwards for as long as your organisation instructs us or the law requires. Finance records commonly carry a statutory retention period in the customer's own jurisdiction, and we do not delete them ahead of the customer's instruction.
• Business audit trail — Retained for the life of the account. Who approved, submitted, issued, released or voided a document is what makes the record trustworthy, so it is append-only and is not pruned.
• Connector call telemetry — 365 days, then purged automatically by a scheduled database job. There is no manual override and the application holds no delete permission on the table.
• Connector authorisations — Until you revoke them, or until your account is deleted.
• Account identity and membership — For as long as you are a member of an organisation. Removing a member ends their access immediately; their name remains visible in the audit trail of actions they took.
• Service logs — Retained for a short operational period by our hosting and database providers, in line with their published defaults.
• Support and security correspondence — Retained while it is needed to resolve your issue and to keep a record of the resolution.

Backups are held on a rolling schedule by our database provider and expire automatically; a deletion is reflected in backups as they roll off.

9. Your choices: access, correction, export, deletion and revocation

• You can see and change your own profile in the application, and an administrator of your organisation can change your role and capabilities.
• You can revoke a connected assistant at any time in Settings, Integrations, Agents. Revoking ends that assistant's access at once.
• You can ask us for a copy of your organisation's data, or for its deletion, by writing to [email protected] from the address on your account. We verify the request with an administrator of the organisation, because the data belongs to the organisation rather than to any one member, and we act on it within 30 days.
• Depending on where you live you may also have the right to correct or delete personal data, to restrict or object to processing, to portability, to withdraw a consent you gave, and to complain to your data-protection authority. We do not charge for exercising these rights and we do not treat you differently for it.

Some data cannot be deleted on request without destroying the integrity of a finance record — an approval you gave on an invoice, for instance, is part of that invoice's audit trail. Where we must refuse or limit a deletion for that reason, we tell you why.

10. Security

• All traffic is served over HTTPS; data is encrypted in transit and at rest by our database and storage provider.
• Tenant isolation is enforced in the database itself by row-level security, in addition to the server-side permission checks every request passes.
• Access tokens are asymmetrically signed (ES256) and verified against the published key set on every request, including every assistant tool call.
• Assistant tool calls pass a per-user rate limit and are recorded in the telemetry described above.
• Third-party credentials, such as an accounting connection's tokens, are encrypted before storage.
• Internal access to production data is limited to the people who need it to operate the service.

No system is perfectly secure. If you believe you have found a vulnerability, please report it to [email protected]; our disclosure practice and the response you can expect are set out at https://www.finstream.app/security.

11. Changes to this policy

We update this policy when the platform or our providers change. The effective date at the top of the page always reflects the current version. If a change materially reduces your rights or expands how we use personal data, we will notify organisation administrators by email before it takes effect.

12. How to contact us

• Product, account and privacy requests — [email protected]
• Security vulnerabilities — [email protected] — see https://www.finstream.app/security
• Postal address — 111255 PTE. LTD., 160 Robinson Road, #14-04 Singapore Business Federation Center, Singapore 068914