Finsi

GDPR overview

Finsi states explicitly that it processes personal data in accordance with the EU General Data Protection Regulation where applicable, and claims GDPR compliance with an appointed Data Protection Officer. That DPO is reachable at dpo@finsi.ai, though no Article 27 EU representative is named. Listed rights cover access, rectification, erasure, portability, objection and restriction, with a 30-day response commitment. International transfers rely on standard contractual clauses, adequacy decisions and binding corporate rules; CCPA, PIPEDA and the Facebook and Google API user data policies are cited alongside. Data Processing Agreements are offered on request, the sub-processor list is public with 14 days' notice before any addition and a right to object, and confirmed breaches are notified within 72 hours. Version dating is inconsistent: the privacy policy reads Last Updated April 15, 2026 yet declares itself effective 28 July 2025.

Who owns the data?

Finsi's documents treat the connected business data - orders, customer email addresses, ad spend, retention metrics - as the customer's own, with Finsi acting as processor. OAuth tokens and API keys are held encrypted at rest through AWS KMS and, the publisher states, never passed to third parties outside the platform they came from; card numbers are never stored, payment running through Stripe. Finsi says it does not sell, rent or share advertising data, with limited exceptions: service providers, legal obligation, explicit consent, or a merger or asset transfer, where the data carries the same protections. Export is unrestricted in CSV, JSON or PDF, and deletion on request completes within 30 days.

Reuse rights

Customers can reuse what Finsi produces without asking: reports, dashboards and segments export at any time in CSV, JSON or PDF, with the privacy policy stating no restrictions on downloading or transferring your data, and segments push in one click into Klaviyo and Meta. On its own side, Finsi uses the connected data to pull daily advertising performance, consolidate multi-source reporting, compute ROAS, CAC and LTV, run benchmarks and generate AI recommendations; end-customer email addresses are processed for segmentation and campaign generation and, the policy says, nothing else. Processing may pass through third-party LLM providers - Anthropic via AWS Bedrock as the primary, OpenAI for fallback and embeddings, Google Gemini for multimodal work, Nano Banana for ad imagery - all accessed under paid or enterprise terms and, per the sub-processor page, contractually bound not to train on customer data. Twelve sub-processors are named with purpose, data accessed and location. Aggregated, anonymised analytics that cannot be tied back to a customer may be kept indefinitely for product improvement.

Data retention & training

Hosting summary

Finsi runs on Amazon Web Services in the us-east-1 region, in the United States. The front end sits on AWS Amplify, the back end on App Runner and ECS inside isolated VPC subnets. Data lives in managed PostgreSQL - Neon and AWS RDS depending on the service - encrypted at rest with AES-256, with automatic backups kept for seven days, point-in-time restore and copies spread across separate AWS availability zones. Secrets sit in AWS Systems Manager Parameter Store or Secrets Manager, encrypted with KMS and rotated annually; traffic is protected by TLS 1.2+ with HSTS. The privacy policy adds that primary processing happens in the United States while backup systems sit in secure EU facilities. Among the sub-processors, only Nango, the OAuth broker, processes in both the United States and Europe; the others are US-based. For an EU customer the transfer therefore rests on standard contractual clauses, not on EU residency, and no EU-region deployment is offered. Note that the domain's resolved IP points to a CloudFront edge node in Frankfurt: that is content delivery, not where data lives. The SOC 2 Type II, ISO 27001 and PCI DSS attestations cited for the underlying infrastructure are AWS's.