Fincate Ltd (trading as Fincate Pro) provides software for authorised financial advice firms. For personal data about platform users (names, work email addresses, hashed passwords, roles, sign-in and audit records, billing contacts) we are the controller. For personal data about a firm's clients entered into the Service, the firm is the controller and we are a processor acting on the firm's instructions under our terms.
Account data — user names, emails, roles, hashed passwords (bcrypt), optional two-factor secrets and passkey public keys, sign-in times and audit logs: to operate and secure the Service (legitimate interests / contract). Billing data — subscription and payment status via our payment provider, Stripe; we do not hold card numbers. Firm client data — the content firms enter or import (fact-finds, plan details, report content): processed only to provide the Service to that firm, never for our own purposes, never for advertising, and never used to train AI models. Launch registrations — your name, firm, work email and the tools you're interested in, if you register interest while sign-ups are paused: used only to email you when sign-ups open (your consent), kept until you ask us to remove them or for up to 12 months after that email, then deleted. Usage statistics — aggregated counts of reports produced, sign-ins and feature usage: used to operate, support, improve and market the Service and administer accounts. These are counts and metadata only — no client personal data or report content — and anything shared externally is aggregated so no firm or client is identifiable.
Client data is encrypted at rest (AES-256-GCM) — database files and backups hold ciphertext. The report engine runs on the platform: client data is not sent to third-party AI services. Access is controlled per firm with strict tenancy isolation, session security, optional/mandatory two-factor authentication and full audit trails (including any platform support access, which is banner-flagged and recorded). Nightly backups are retained on a rolling schedule with tested restore procedures.
We use a small number of service providers: our hosting provider (UK/EU data centre) and Stripe (payments). We do not sell personal data and do not share it with anyone else except where required by law.
Account and audit data is kept for the life of the firm's subscription and for up to 6 years after termination for legal and accounting purposes. Firm client data is retained according to the firm's own retention setting within the Service (unlimited by default, configurable per firm; expired reports are purged automatically); on termination it is made available for export for 30 days and then deleted from the live service and thereafter from backup rotation.
The Service uses a single essential session cookie to keep you signed in. No advertising or analytics cookies are set.
Platform users may ask us for access to, correction of, or deletion of their account data, and have the other rights set out in UK GDPR, by emailing support@fincatepro.co.uk. Requests about a firm's client data should be made to the advising firm (the controller); we assist firms with such requests. You may complain to the Information Commissioner's Office (ico.org.uk).
Fincate Ltd (trading as Fincate Pro), Florence House, Mold, CH7 1JW — support@fincatepro.co.uk.