Privacy policy

This policy explains how FinTria AI, registered with the Qatar Financial Centre, Doha, Qatar ("FinTria AI", "we", "us") handles personal data. It applies to visitors of fintria.ai, to people who contact us or apply for a role, and to Authorised Users of the FinTria AI platform.

It also explains, in section 4, the different position we are in when our Customers use the platform to process invoices that contain personal data about their own staff and suppliers. There, the Customer decides what is processed and why; we process it on their instructions.

For this website, our marketing, our hiring, and the account details of platform users, FinTria AI is the data controller. We are registered with the Qatar Financial Centre and subject to the QFC Data Protection Regulations 2021. Where we serve customers in the European Economic Area or the United Kingdom, we also apply the GDPR and UK GDPR to the personal data of people located there.

You can reach the person responsible for privacy at hello@fintria.ai.

We collect personal data in four situations:

• Visiting the site - server logs record your IP address, browser type, the pages you request and the time of the request. We use them to keep the site running, to detect abuse, and to understand aggregate traffic. We do not run advertising or behavioural analytics on this site (see the Cookie Policy).
• Contacting us or requesting a demo - your name, work email, phone number, company, role, ERP system and the message you write. We use them to reply, to arrange the demo, and to keep a record of the conversation. Legal basis: taking steps at your request before entering a contract, and our legitimate interest in responding to enquiries.
• Applying for a role - your name, contact details, CV, links you share and your answers to our questions. We use them to assess your application and to contact you about it. Legal basis: taking steps at your request before a contract, and our legitimate interest in hiring.
• Using the platform - your name, work email, role, the workspace you belong to, your sign-in activity, your approvals and other actions (which form the audit trail), and technical data about your device and session. We use them to operate the Service, to secure it, to support you and to bill the Customer. Legal basis: performance of our contract with the Customer, our legitimate interest in security and product improvement, and legal obligations such as keeping financial records.

Invoices, purchase orders, supplier master data and mail that Customers route through the platform often contain personal data - a supplier's contact name, an employee's expense claim, a signature. For that data the Customer is the controller and FinTria AI is a processor.

We process it only to provide the Service as described in our Terms and any data processing agreement with the Customer; we do not use it for our own purposes, we do not sell it, and we do not use it to train models offered to anyone else. If you are a supplier or employee of one of our Customers and have a question about your data, please contact that Customer first; we will help them respond.

The platform's Agents send document content to large language models to extract fields, match documents and draft summaries. Depending on the Customer's configuration this may involve a model provider acting as our subprocessor under a contract that prohibits retaining the content beyond the request and prohibits using it for training.

Output is always presented to a person in the Customer's workspace for review before it takes effect. No decision with legal or similarly significant effect on an individual is taken by automated means alone.

We share personal data only with:

• Subprocessors that host and run the Service - cloud infrastructure, email delivery, error monitoring, and AI model providers - each bound by a contract that limits what they may do with the data. A current list is available on request.
• The systems a Customer connects, such as its ERP or identity provider, on the Customer's instructions.
• Professional advisers - lawyers, accountants, auditors - under confidentiality.
• Authorities, where the law requires it or to establish, exercise or defend legal claims. We will tell the affected Customer where we are permitted to.
• A successor, if FinTria AI is involved in a merger, acquisition or sale of assets, in which case this policy continues to apply.

Our infrastructure is hosted in regions chosen with our Customers' residency requirements in mind; the region for a given workspace is stated in the Customer's Order Form. Where personal data leaves the QFC, the EEA or the UK we rely on an adequacy decision or on standard contractual clauses and equivalent safeguards, and we assess the destination before the transfer.

Website logs: up to ninety days. Contact and demo enquiries: up to two years after the last contact, unless a customer relationship follows. Job applications: up to twelve months after the process closes, unless you ask us to keep your details longer or to delete them sooner. Platform account data and the audit trail: for the life of the Customer's subscription and the export and deletion periods set out in the Terms, then deleted - except records we must keep for accounting or regulatory purposes, which we retain for the period the law requires and then delete.

Data is encrypted in transit and at rest. Access inside FinTria AI is role-based, logged and limited to people who need it to do their job. Platform workspaces support single sign-on and enforce role-based permissions and approval limits that the Customer configures. We test our systems, keep them patched, and have an incident response process; if a breach affects your personal data we will notify the relevant Customer or you, and any regulator, as the law requires.

Subject to the law that applies to you, you may ask us to: give you access to the personal data we hold about you; correct it; delete it; restrict or object to how we use it; give it to you in a portable format; and withdraw a consent you gave. Where we act as a processor we will pass your request to the Customer and help them respond.

To exercise a right, email hello@fintria.ai. We will respond within one month, or sooner where the law requires. If you are not satisfied you may complain to the QFC Data Protection Office or, if you are in the EEA or UK, to your local supervisory authority.

The Service and this website are for organisations and their staff. We do not knowingly collect personal data from anyone under eighteen. If you believe we have, tell us and we will delete it.

We will update this policy when our practices or the law change. The date at the top shows the latest revision. For significant changes we will notify platform administrators by email and show a notice in the product.

Privacy questions and rights requests: hello@fintria.ai. Post: FinTria AI, Qatar Financial Centre, Doha, Qatar.