Privacy policy

1. Controller and scope

The controller is FIND, Owner: Cindy Rupp-Bregenzer, c/o RA Matutis, Rheinstraße 71, CH-7012 Felsberg. Privacy enquiries: info@findmoneyapp.com. The binding provider details are stated in the Legal notice.

This policy applies to findmoneyapp.com, registration and sign-in, accounts, the Founding Beta, uploads, document and image analysis, AI chat, Economic Graph, Money Radar, comparisons, claims, Autopilot, payments, support and transactional messages.

2. Applicable law and principles

FIND primarily follows the Swiss Federal Act on Data Protection. Where the EU GDPR applies because FIND targets people in the EEA or monitors their behaviour there, its additional requirements are taken into account. Data is processed lawfully, fairly, proportionately, for recognisable purposes and as accurately as reasonably possible.

3. Data categories

Depending on use, FIND may process contact and authentication data, technical usage data, profile information, financial and contract details, documents and images, derived facts and confidence values, communications, payment metadata, consent and approval records, support data, security logs and audit trails.

4. Technical, account and profile data

Visits may generate IP address, time, requested URL, referrer, device and browser details, language, approximate region, response status, errors and security events. Account processing includes a technical user ID, email address, authentication status, session and token information and technical password or passkey data. Supabase provides authentication; FIND does not receive plaintext passwords.

Profile data may include country, age range or year of birth, work, housing, mobility, approximate income, available time, interests, skills, goals and areas to check. It is used for personalisation, prioritisation and avoiding unsuitable suggestions.

5. Documents, images and sensitive data

Uploads may contain contract, invoice, insurance, salary, household, item or other personal information. Original files are stored in protected object storage and linked to a technical user ID. Content required for a requested analysis is sent to the AI provider. Unnecessary account, identity, health and third-party data should be redacted before upload.

FIND does not request health data, biometric raw data, religious beliefs or political opinions for ordinary use. Such information should only be submitted when truly necessary and legally permitted.

The document scanner includes a redaction tool. Marked areas are embedded into the generated PDF before upload, so FIND receives only the redacted version of that file. Users must review the preview because redaction can hide information needed for analysis.

For recognised receipts, FIND may save the merchant, purchase date, category, total and visible items as an expense draft. A detected amount counts towards the monthly overview only after the user explicitly confirms it. Drafts can be corrected or dismissed, and the feature can be disabled in the profile.

6. Derived data, AI chat and analysis

FIND may detect or estimate providers, products, prices, terms, notice periods, employers, salary components, items, skills, possible claims, risks and opportunities. It may also create confidence values, fingerprints, open checks, priorities, expected values, status and event data. Derived details may be wrong and are marked with their source and uncertainty where possible.

Questions, selected earlier messages and relevant context are sent to OpenAI to create responses. Document and image analysis includes the content needed for the task. In the signed-in My Assistant area, questions and answers are stored in your account for up to 90 days so you can continue after restarting or on another device. The latest 50 question-and-answer pairs are shown. You can delete the conversation in the chat, export it or remove it with your account. Public product questions outside the saved account conversation are separate.

When voice input is used voluntarily, recording starts only after the microphone button is pressed and the audio is sent to OpenAI for transcription. FIND does not store the audio as an account document; the transcript first appears in the input field and is processed as a chat question only after it is sent.

7. Radar, approvals and audit records

Radar functions may store contract events, deadlines, price changes, open opportunities, priorities, notification fingerprints, delivery status and suppression reasons. For prepared actions, FIND records the draft, recipient, purpose, approval status, time and result. General use never counts as approval for a legally relevant action.

Regional savings alerts and retailer offers are off by default. After you enable them, FIND uses the confirmed postcode or town in your profile to check public offers in that region. The web app does not collect precise device location, and FIND does not keep a permanent movement or location history.

The Decision Simulator, Claims Check and Offer Check may store scenarios, possible entitlements, offer details, risks, action plans, sources, missing evidence and earlier checks. Results remain decision support; FIND does not submit claims, purchase products or conclude contracts without the designated explicit approval.

8. Payments, support and communications

Stripe processes payment method, status, amount, currency, contact and billing data and fraud-prevention information. FIND receives checkout and customer references, amount, discount, payment status and product assignment, but not full card or bank data.

For personal referral links, FIND stores a random referral code, anonymous visits, and registration and payment status. Names, documents, contract details and financial profiles are not shared through the link. This data is used for reach measurement, unambiguous attribution, reversals and misuse prevention. Referral links do not extend the 30-day beta access.

Support contact may involve email address, message, attachments, time and case status. Transactional messages may be sent through Resend. Marketing is sent only where lawful and, when required, with consent and an unsubscribe option.

Founding Beta feedback may include its type, rating, message, affected page, time and a voluntarily attached screenshot. It is used to fix problems and improve the product, not automatically to train a generally available model. After a successful payment, FIND may send a transactional welcome and access confirmation.

FIND users may voluntarily connect their own mailbox through Nylas. After separate activation, automatic background checks and manual refreshes read up to 100 inbox messages per step. The first check covers the latest 100 messages; additional new messages are read in subsequent steps as needed. The server scheduler checks due mailboxes every 15 minutes. FIND uses this information to detect invoices, reminders, contract changes, replies and possible deadlines. FIND stores the Nylas connection reference, mailbox address, provider, message and thread IDs, sender, subject, an excerpt limited to 700 characters, time, detected category and attachment metadata (ID, filename, file type and inline flag); it does not retain full message bodies or attachments as a mailbox copy. Approved messages are sent through the connected mailbox and replies return there. The connection and consent can be withdrawn at any time.

After separate activation, FIND users may voluntarily connect accounts through SIX bLink in read-only mode. Sign-in and consent take place at the selected bank. FIND receives neither e-banking passwords nor bank access tokens and cannot initiate payments. SIX Consent-as-a-Service holds the bank token; FIND stores a pseudonymous permission reference, bank and account label, masked IBAN, currency and the explicitly shared transactions. Revoking the connection deletes imported accounts and transactions from FIND.

9. Purposes and legal bases

Data is used to provide and secure the service, assign accounts, analyse and personalise information, explain and verify results, compare options, prepare approved steps, send notifications, process payment and support, improve quality, correct errors, prevent misuse and fraud, enforce rights and meet legal obligations.

Where the GDPR applies, processing relies as appropriate on contract performance or pre-contract steps, legal obligations, legitimate interests in secure and efficient operation, or consent. Consent can be withdrawn for the future.

10. Profiling and automated decisions

FIND uses profiling and AI-supported assessments to prioritise economic opportunities. The current service does not make a solely automated decision with legal or similarly significant effects on a user. Contracts and claims are decided by users or third parties.

11. Recipients and service providers

Data is shared only when required for the selected function, based on consent or a legal duty, needed to protect rights, or processed by a provider on FIND’s behalf. Main categories are hosting/CDN/storage, authentication, AI processing, payment processing and email delivery.

Cloudflare provides website delivery, Worker runtime, database and object storage and security services. Supabase provides authentication and session management. OpenAI supports text, document, image, comparison and chat functions. Stripe handles checkout, payments, discounts, fraud prevention and receipts. Resend may deliver transactional email. Nylas provides the voluntary connection to Gmail, Microsoft, iCloud, Yahoo and other IMAP-compatible mailboxes and sends through the connected user mailbox. Nylas and the respective email provider process authentication, mailbox, message and delivery data; the current beta uses Nylas infrastructure with US data residency. After separate activation, SIX bLink provides the consent-based read-only bank connection. With Consent-as-a-Service, bank access tokens remain with SIX and FIND requests no payment scope.

12. International transfers

Providers may process data in Switzerland, the EEA, the United States and other countries used by global networks or subprocessors. Where a country lacks recognised adequate protection, appropriate safeguards such as recognised standard contractual clauses, transfer assessments and supplementary measures are used where required.

13. No data sales and retention

FIND does not sell or rent uploads, personal financial profiles or chat questions to advertising networks. Account data is generally kept until deletion or the end of necessary contract and evidence periods. Scans and originals remain until the relevant scan or account is deleted unless a legal duty or legitimate evidence interest requires retention. Payment and contract records may be retained for up to ten years under Swiss requirements.

14. Deletion and security

Deleting a scan removes assigned active records and originals. Account deletion removes or anonymises active product data and closes the Supabase authentication account unless retention is required. Temporary backup or security-log copies may remain until the next deletion cycle. FIND does not report deletion as complete if a technical step fails.

Security measures include encrypted transfer, technical user separation, server-side secret management, limited upload types and sizes, signed payment webhooks, access controls, recorded approvals and deletion functions. No digital system can guarantee absolute security.

15. Cookies and local storage

FIND currently uses no first-party marketing or advertising cookies. Technically necessary browser storage or cookies may be used for authentication, security and session continuity. Interface state and temporary chat context may be stored locally. This policy and any required consent process will be updated before analytics or marketing technologies are added.

16. Your rights and complaints

Under applicable law, individuals may request access, correction, deletion, restriction, disclosure or transfer of certain data, object to processing and withdraw consent for the future. FIND may require proof of identity and rights may be limited by retention duties, overriding interests or third-party rights. Requests: info@findmoneyapp.com.

Privacy concerns should first be directed to FIND. Individuals may also contact the Swiss Federal Data Protection and Information Commissioner or another competent supervisory authority.

17. Minors and changes

Paid services are not intended for people under 18. This policy is updated when features, providers, storage locations or law change. Material changes will be communicated where appropriate or required.