Privacy Policy

1. Data We Collect

• Personal information: name, email address, country
• Professional information: startup details, investment preferences
• Documents: pitch decks, business plans (stored securely via MinIO)
• Usage data: login times, pages visited, features used
• Communication data: messages exchanged on the platform

2. How We Use Your Data

• To provide and improve our matchmaking services
• To send account notifications and transactional emails
• To match founders with relevant investors using our AI algorithm
• To process subscription payments securely (Stripe / SlickPay)
• To prevent fraud and ensure platform security

3. Data Sharing

• We share your profile with other users as part of the matching process
• Documents are only shared with matched and accepted connections
• We do not sell your personal data to third parties
• Payment data is processed by certified PCI-DSS providers
• Service providers (Brevo for email) process data strictly under contract

4. Your Rights (GDPR / PDPL Oman / Loi 25-11 Algérie)

• Right to access your personal data at any time
• Right to correct inaccurate information
• Right to delete your account and associated data (erasure request via /profile)
• Right to export your data in a portable format
• Right to withdraw consent for marketing communications
• Algerian users: rights under Loi 25-11 relative à la protection des données personnelles
• Omani users: rights under PDPL (Personal Data Protection Law) of Oman

5. Data Security

• All data is encrypted in transit using TLS/SSL
• Passwords are hashed with bcrypt (12 rounds) — never stored in plain text
• JWT access tokens (1h) and refresh tokens (7d) — HttpOnly cookies
• Row-level security and per-user access controls on all sensitive data
• Regular security audits and vulnerability assessments
• Consent audit log maintained for all data processing activities

6. Data Retention

• Active accounts: data retained for the duration of the account
• Deleted accounts: personal data anonymised within 30 days
• Audit logs: retained for 12 months for security purposes
• Backups: encrypted, retained for 7 days

7. Contact & DPO

For privacy inquiries or erasure requests: privacy@fininov.com