Privacy Notice
Your privacy on Financiario
What personal data we process, why, who receives it, how long we keep it, and the rights you have. The Cookie Policy covers the cookies the portal uses.
Who we are
Financiario LLC, a California limited liability company, operates the Financiario portal. In this notice, “we” and “us” mean Financiario LLC. This notice covers the portal only. Our websites financiario.com, oanalabes.com and courses.oanalabes.com are covered by the Privacy Policy published on those sites.
We handle every privacy question and request by email, at support@financiario.com. We do not offer a postal address for privacy requests.
Representatives in the EU and UK
Financiario LLC has not appointed a representative in the EU or the UK under Article 27 of the GDPR and the UK GDPR. Our processing of personal data of people in the EU and the UK is occasional, does not include special categories of data or data about criminal convictions and offences on a large scale, and is unlikely to result in a risk to people's rights and freedoms (Article 27(2)(a)). If you are in the EU or the UK, contact us directly at support@financiario.com.
Our role
We play two different roles, depending on the data.
- Account and usage data (your sign-in identity, support requests and consent records): we decide how and why this data is used, so we are the controller, and for California residents a “business” under the California Consumer Privacy Act (CCPA).
- Financial data your company provides (financial model workbooks and QuickBooks data): we process it on behalf of your company. Your company is the controller, and we act as its processor (a “service provider” under California law). Questions about that data should go to your company. If you contact us, we pass your request to your company.
What we collect
- Account: your name, work email and the basic Microsoft profile details Microsoft returns when you sign in, and the companies you have access to. Sign-in only reads your basic profile. We do not keep Microsoft sign-in tokens.
- Invitations: the email address and role of each person your company invites to the portal, and when the invitation was accepted. Invitations stay on record after the first sign-in, because they define who may access which company.
- Client financial data: your company's financial model workbooks, read from and, where your company enables it, written back to SharePoint through Microsoft Graph, and QuickBooks Online data if your company connects QuickBooks (the QuickBooks tokens are stored encrypted).
- Edit history: which model inputs, scenario values and GL Map mappings you change, and when; who connected QuickBooks and who started each QuickBooks sync; and who generated each piece of AI commentary. Your company sees this as the history of its model.
- AI features: the questions you type into the Copilot, the conversation history, and the financial data needed to answer them and to write commentary.
- Support requests: what you send through “Report a Problem”, including any files you attach, plus your email and company name so we can reply. These are emailed to Financiario's support team and are not stored in the portal.
- Team notifications: when you run a QuickBooks sync, save GL Map changes or send Scenario Drivers preferences, an email with your work email and the details of the action (for preferences, the values you entered) goes to Financiario's team. These emails are not stored in the portal.
- Consent records: a random consent ID, your cookie choices, the policy version, your region and country, whether your browser sent a Global Privacy Control signal, your browser's user-agent string, the time, and your account if you were signed in. Instead of your IP address we store a keyed hash of a shortened network address (IPv4 /24, IPv6 /48).
- Technical: session and security cookies, described in the Cookie Policy. We use no analytics, advertising or tracking.
Why we use it
We use personal data to provide the portal your company engaged us for, keep the service secure, keep the edit history of your company's model, answer support requests, keep proof of your cookie choices, and, only if you allow them, set optional cookies.
Legal bases (EU and UK GDPR)
- Legitimate interests (Article 6(1)(f)): our agreement is with your company, not with you. We rely on our legitimate interests, and your company's, in providing the portal your company engaged us for, keeping it secure, and supporting its users. You can object at any time (see “Your rights”).
- Legal obligation: to keep proof of the consent you gave or refused.
- Consent: for optional cookies only. You can withdraw it at any time in Cookie Settings.
In Canada, we rely on your consent, given when your company enables your account and through Cookie Settings, and we collect only what the purposes above need.
You are not required by law to give us your account data, but we need it to give you access to the portal: without it you cannot sign in. Optional cookies are never required, and you can use the portal without them.
AI features
The portal uses Claude AI models from Anthropic to answer questions in the Copilot and to write AI commentary on your figures. To do this, we send Anthropic your question, the conversation history, and the financial data needed for the task. AI answers can be wrong, so check important figures against your source model. We make no decision about you based only on automated processing.
Under Anthropic’s commercial terms (opens in a new tab), Anthropic may not use the questions and data we send it, or the answers it returns, to train its models. How long Anthropic keeps that data is set by its commercial terms and its own retention policies.
Who receives it
We disclose data to the service providers below, under data processing agreements. We may also disclose it when the law, a court or a government authority requires it, to protect our rights, property or safety or those of others, or as part of a merger, acquisition or sale of substantially all of our assets. We do not sell, rent or trade your personal information.
| Recipient | What | Where |
|---|---|---|
| Microsoft | Cloud hosting, Entra ID sign-in, the workbooks we read from and, where your company enables it, write back to SharePoint, and notification and support emails. | United States |
| Anthropic | Claude AI models: Copilot answers and AI commentary. | United States |
| Intuit | QuickBooks Online, only if your company connects it. | United States |
We do not sell or share your personal information, and we do not use it for advertising.
International transfers
Data is hosted and processed in the United States. When your company is in the EU/EEA, the UK or Switzerland and sends us personal data to process on its behalf, the transfer is covered by the European Commission's Standard Contractual Clauses in our data processing agreement, with the UK Addendum and the Swiss amendments. Our providers apply their own safeguards, such as Standard Contractual Clauses or, where it applies, certification under the EU-U.S. Data Privacy Framework. When data moves from Canada, including Quebec, we protect it by contract to the same standard as in Canada. Email support@financiario.com for a copy of these safeguards.
How long we keep it
| Data | Period |
|---|---|
| Sessions | 14 days. Expired sessions are deleted automatically. |
| Consent records | 3 years |
| Account data and Microsoft profile | As long as your account exists |
| Deactivated accounts | Until your company's agreement with us ends, or earlier on request |
| Invitations | Until your company or we remove the invitation, or your company's agreement with us ends |
| Copilot conversations | Until you delete the conversation, or your account is deleted |
| Edit history, GL Map edits, AI commentary authorship and QuickBooks sync history | As long as your company's model is in the portal. If your account is deleted, these records no longer point to you. |
| QuickBooks connection | The tokens are erased when your company disconnects QuickBooks. The connection record (company name, who connected it and when) is kept as long as your company's model is in the portal. |
| Support requests | Kept in our support mailbox until your company's agreement with us ends, or earlier on request |
| Notification and Scenario Drivers preference emails | Kept in our team mailboxes until your company's agreement with us ends, or earlier on request |
| Client financial data | As set by your company's agreement and instructions |
Security
We use administrative, technical and physical safeguards to protect personal information against unauthorized access, disclosure, alteration and destruction: sign-in through Microsoft Entra ID, encrypted connections, encrypted QuickBooks credentials and access limited to the companies each user is enabled for. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a breach affects your personal information, we will notify you and the authorities as the applicable law requires.
Children
The portal is for business users and is not directed at anyone under 18. We do not knowingly collect personal information from children under 18. If you believe we have, email support@financiario.com and we will delete it.
Your rights
EU, EEA, UK and Switzerland
You have the right to access your data, correct it, erase it, restrict how we use it, receive it in a portable format, and object to how we use it, including when we rely on legitimate interests. You can withdraw consent for optional cookies at any time in Cookie Settings.
United States
California residents have the right to know about and access their personal information, delete it and correct it. You also have the right to opt out of its sale or sharing (we do not sell or share it) and to limit the use of sensitive personal information (we use it only to provide the service). Residents of other US states with privacy laws, such as Colorado, Connecticut, Virginia, Texas and Oregon, have similar rights to access, correct, delete and port their data and to opt out. We will not treat you differently for using any of these rights.
Categories we collected in the last 12 months: identifiers (name, work email, the basic Microsoft profile returned at sign-in, consent ID, keyed hash of a shortened network address, and the email addresses of people your company invites); internet or network activity (browser user agent, and cookie choices); and professional information (your work email, your company, the edit history of its model, including GL Map edits, QuickBooks connections and syncs you start and AI commentary you generate, the questions and conversations you have with the Copilot, the Scenario Drivers preferences you send, and the content of support requests you send us). We keep no account login credentials: Microsoft sign-in tokens are not stored. Sources: you, your company, Microsoft sign-in and, if connected, QuickBooks. We disclosed these only to the service providers listed under “Who receives it”. We have not sold or shared personal information in the last 12 months, and we have no actual knowledge of selling or sharing personal information of consumers under 16.
Verification: we match your request to the work email on your account and may ask you to confirm it from that address.
Authorized agents: an agent can make a request for you with your signed permission. We may ask you to confirm your identity directly with us.
Canada
Under PIPEDA you have the right to access the personal information we hold about you, to have it corrected, and to withdraw your consent, subject to legal or contractual limits. In Quebec, Law 25 also gives you the right to receive your data in a structured, commonly used technological format, and to ask us to stop disseminating it or to de-index it. Tracking technologies are off until you turn them on. We do not make decisions about you based exclusively on automated processing. Your information is stored and processed in the United States, outside Quebec and Canada.
Global Privacy Control
We honor the Global Privacy Control signal: when your browser sends it, marketing stays off and cannot be switched on. We record the signal with your next saved choice. See the Cookie Policy for details.
Do Not Track: there is no agreed standard for “Do Not Track”, so we do not respond to it. We do honor Global Privacy Control.
How to make a request
Email support@financiario.com. We may need to confirm your identity first, and we reply within the time the law that applies to you allows (30 days under PIPEDA and Quebec law, one month under the GDPR, 45 days under California law). If the request is about data we process for your company, we pass it to your company. If we decline your request, you can appeal by replying to our answer or by emailing support@financiario.com with “Appeal” in the subject; Virginia and other US states with similar laws give you that right.
Person in charge of the protection of personal information
As Quebec law requires, this is the person in charge of protecting personal information at Financiario LLC:
Privacy Officer, Financiario LLC
support@financiario.com (subject:
“Privacy officer”)
Privacy governance
A summary of the policies and practices that govern how we handle personal information:
- Roles: the Privacy Officer is responsible for this notice, for our privacy practices and for compliance with privacy law. Everyone at Financiario who runs or supports the portal follows these practices.
- Requests and complaints: the Privacy Officer receives and answers requests to access, correct or delete personal information, and privacy complaints, as described in this notice.
- Incidents: the Privacy Officer handles confidentiality incidents: we assess the risk of harm, record every incident, and notify the people affected and the authorities when the law requires it.
- Retention and deletion: we keep personal information only for the periods under “How long we keep it”. Expired sessions and consent records past their retention period are deleted automatically; other data is deleted when its period ends or on request.
- Privacy by default: Analytics stays off for everyone until you switch it on. In the EU, EEA, UK, Switzerland and Canada, and wherever we cannot determine your location, every optional category starts off. Global Privacy Control keeps marketing off.
Complaints
Email support@financiario.com with “Privacy complaint” in the subject. We acknowledge your complaint within 30 days and tell you the outcome.
You can also complain to a supervisory authority:
- UK: the Information Commissioner's Office (ICO), being renamed the Information Commission (ico.org.uk (opens in a new tab)).
- EU/EEA: the data protection authority in your country.
- Switzerland: the Federal Data Protection and Information Commissioner (edoeb.admin.ch (opens in a new tab)).
- Canada: the Office of the Privacy Commissioner of Canada (priv.gc.ca (opens in a new tab)).
- Quebec: the Commission d'accès à l'information (cai.gouv.qc.ca (opens in a new tab)).
Changes to this notice
The “Last updated” line at the top shows the date of the last change and the cookie consent version. We post material changes on this page and update that line.
Contact
Questions about this notice: support@financiario.com.