%22%2F%3E%3Cpath%20d%3D%22M-4%2066%20C%2014%2050%2C%2034%2082%2C%2050%2066%20S%2084%2050%2C%20100%2066%22%20stroke%3D%22white%22%20stroke-opacity%3D%220.55%22%2F%3E%3C%2Fg%3E%3C%2Fsvg%3E)
Privacy policy
Updated 2026-07-27
Finkavo is built for people who care about their tax and admin data — which means we care about it too. This page explains what we collect, what we don't, and what you can do about it. It's not a legal wall of text; it's the actual arrangement.
What we collect
Your account details (name, email, password hash via Better-Auth). Your onboarding responses (residency status, employment type, tax regime). Every ask you send and answer you get back. Letters and vault documents you upload (encrypted at rest — end-to-end encrypted if you opt in). Invoices you upload or paste for tracking (Invoice Ingest), and broker/investment transaction data if you use the broker-import feature under Settings → Investments. Household member details (name, birthdate, NIF) if you add a spouse or dependent so obligations can be tagged correctly. Saved searches, calendar events, dashboard preferences. Session cookies. If you opt in to analytics, PostHog events (identified by an opaque hash of your user id, never by email). If you mention identifiers like your NIF or NISS in a conversation or in an uploaded document, the assistant will store them on your profile so it can reason about your tax situation — you can view or delete them under Settings → Profile → Extras. Separately, our broker capital-gains calculator at /tools/broker-capital-gains never sends your transaction data anywhere — it parses the CSV you paste entirely in your browser.
What we don't collect
Third-party trackers. Advertising IDs. Cross-site cookies. Marketing pixels. Your primary Portal das Finanças login — Finkavo never asks for it and cannot use it. Payment card numbers (Stripe handles those directly once you subscribe). The one narrow, opt-in exception is a separate AT "sub-user" credential you can choose to connect — see "AT (Portal das Finanças) sub-user access" below.
How long we keep it
Everything is tied to your account. When you delete your account from settings, we remove every database row that identifies you and revoke any Google or Apple calendar connection — usually within minutes. Vault documents are AES-256-GCM encrypted with a per-document key wrapped by a master key we hold; when you delete an account, the wrapped key is destroyed at the same time as the database row, so the encrypted blob — even if a copy survives on a storage layer with a rolling recovery window — is cryptographically unrecoverable (GDPR right-to-erasure via crypto-shredding, per NIST SP 800-88 for AES-256-GCM). AT sub-user credentials (see below) use the same per-record encryption and are deleted the moment you disconnect them, independent of account deletion. Deleted conversations are soft-deleted for 30 days so you can restore, then hard-purged by a nightly job. Reminder-send records (used to prevent double-emails) are kept for 90 days. Waitlist submissions (email + optional "what brought you here" note, submitted from the marketing landing) are kept for 12 months from submission, or until you sign up for an account — whichever comes first. Portugal Tax Playbook downloads (email address, for the linked drip series) follow the same 12-month-or-until-signup rule and every email carries a one-click unsubscribe. If you never sign up and want an email removed sooner, email hello@finkavo.com. If we ever need to keep something for legal reasons (fraud investigation, court order) we'll say so — that hasn't happened.
Who we share it with
Only the vendors we need to run the app: CockroachDB Serverless (Frankfurt) for the database, Cloudflare R2 (EU) for encrypted file storage, Cloudflare Workers AI for embeddings, OpenAI for LLM inference, Tavily for web search when our own corpus doesn't cover your question (US processor, DPA + SCCs), Resend for transactional email, PostHog EU for analytics (opt-in only), Stripe for payments (once you subscribe). Session cookies + password hashes are handled by Better-Auth, which runs inside the same Cloudflare Worker as Finkavo — no external processor, no third party sees your credentials. GitHub is a processor only if you choose to sign in with GitHub, and Apple/iCloud only if you choose to connect Apple Calendar sync (see those sections below). All third-party vendors are bound by DPAs. No data broker sales. Separately, features like sharing your obligations or vault documents with an accountant (magic-link share) send data only where you explicitly direct it, to an email address you choose — that's you sharing your own data, not us routing it to a vendor.
Google account access
Signing in with Google is optional. When you choose to connect Google Calendar from your profile settings, Finkavo requests one Google Calendar API scope (https://www.googleapis.com/auth/calendar.app.created). This is the app-created variant: it lets Finkavo create a single dedicated 'Finkavo — Tax deadlines' calendar under your account and read/write events on that calendar only. Finkavo cannot see, read, or modify any of your other Google calendars. Finkavo's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: Finkavo does not transfer your Google data to third parties except as needed to provide the reminder feature (the DPA vendors listed above), does not use your Google data for advertising, and does not allow humans to read your Google data unless we have your affirmative agreement, it is necessary for security, or the data is aggregated and anonymised. You can revoke Finkavo's access at any time from the profile settings page, or from https://myaccount.google.com/permissions.
Apple / iCloud Calendar access
Connecting Apple Calendar sync is optional and off by default. Instead of an OAuth redirect, you generate an app-specific password at appleid.apple.com/account/manage and paste it into Finkavo along with your Apple ID email. We use it once to create a dedicated "Finkavo" calendar in your iCloud account via CalDAV, then push deadline events to that calendar only — Finkavo never touches your other iCloud calendars, mail, photos, or files. The app-specific password is encrypted at rest (AES-256-GCM, per-record key, same model as Vault documents) — Finkavo staff cannot read it in plaintext. You can disconnect at any time from Settings → Calendar sync, which deletes the stored credential immediately, or revoke the app-specific password directly at appleid.apple.com.
GitHub sign-in
Signing in with GitHub is optional. If you choose it, Finkavo receives only the fields GitHub returns by default: your GitHub user id, your primary verified email address, and your display name. We do NOT read your repositories, organisations, private code, followers, or any other GitHub data — the OAuth app requests only the default 'read:user' + 'user:email' scopes. Finkavo does not post to GitHub on your behalf. You can revoke Finkavo's access at any time from https://github.com/settings/applications — that immediately breaks any active session that was minted via GitHub sign-in.
AT (Portal das Finanças) sub-user access
Connecting direct AT integration (VAT, e-Fatura, or Modelo 3) is optional, off by default, and today only stores your credentials — it does not yet submit anything to AT on your behalf; the submission features are still in development. If you opt in, you first create a separate "sub-user" account yourself, inside Portal das Finanças, scoped to only the permission you're granting — this is a delegated access mechanism AT provides, not your own primary login, and Finkavo never asks for or has access to your main Portal das Finanças credentials. You then paste that sub-user's username and password into Finkavo under Settings → AT integration; we encrypt both (AES-256-GCM, per-record key wrapped by a server key, same model as Vault documents) before storing them, and nothing decrypts them until the AT-submission feature they support actually ships. You can remove a connected sub-user at any time — removal deletes the stored credential immediately.
Your rights
Under RGPD you can access, correct, export, or delete your data. Access + correction: /app/settings/profile. Export: same page, Danger Zone → Export my data (JSON). Delete: same page, Danger Zone → Delete my account. You don't need to ask anyone. You also have the right to lodge a complaint with the Portuguese Data Protection Authority (CNPD — https://www.cnpd.pt/) or the supervisory authority in your EU country of residence.
Data controller
Data controller: Abolfazl Shirkavand, operating as sole proprietor (empresário em nome individual), registered at Rua Francisco Marques Beato n.º 8, 5.º B, Moscavide, Portugal. Contact: hello@finkavo.com. No Data Protection Officer has been formally designated because Finkavo does not carry out large-scale monitoring of data subjects nor process special-category data as its core activity (RGPD Art. 37(1)) — hello@finkavo.com is the direct route for privacy questions and RGPD requests.
Contact
hello@finkavo.com. We'll respond within 3 business days. For RGPD-specific requests we'll respond within the 30-day statutory window.