Privacy Policy
Last updated: August 2026
Finovora, operated by Hunze Enterprises (KvK: 94667225), is committed to protecting the privacy of its users. This Privacy Policy explains what personal and business data we collect, how we use it, who we share it with, and what rights you have under the General Data Protection Regulation (GDPR).
By using the Finovora platform, you agree to the processing of your data as described in this policy.
Our contact details:
Hunze Enterprises
Overtoom 203-2
Amsterdam, 1054HT
Netherlands
info@finovora.com
2. What data we collect
We collect two categories of data: account data you provide directly, and document data you upload to the platform for processing.
2.1 Account data
- Name and email address
- Company name
- Billing information (processed by Stripe — we do not store card details)
- Account preferences and settings
- Login activity and session data
2.2 Document data (invoice processing)
- Invoice files you upload or that are automatically captured from your connected email inbox
- Data extracted from those invoices: supplier names, invoice amounts, dates, VAT details, payment terms, line items, and any other data present in the document
- Categorisation data assigned by the AI processing layer
2.3 Usage data
- Pages visited and features used within the platform
- Upload activity and processing logs
- Browser type, device type, and IP address
- Error logs for debugging and service improvement
3. Legal basis for processing
Under GDPR, we process your data on the following legal bases:
| Data type | Legal basis |
|---|---|
| Account data | Performance of contract (Art. 6(1)(b)) — necessary to provide the service |
| Document and invoice data | Performance of contract (Art. 6(1)(b)) — the core service you have paid for |
| Usage data | Legitimate interests (Art. 6(1)(f)) — to maintain, improve, and secure the platform |
| Marketing communications | Consent (Art. 6(1)(a)) — only where you have opted in |
4. How we use your data
We use your data exclusively for the following purposes:
- Providing the service — processing your invoices, extracting data, categorising expenses, and displaying results in your dashboard
- Account management — managing your subscription, processing payments, and communicating about your account
- Service improvement — analysing usage patterns to improve platform performance, accuracy, and features. Invoice content is never used to train AI models without your explicit consent.
- Security — detecting and preventing fraud, unauthorised access, and abuse
- Legal compliance — meeting our obligations under applicable Dutch and EU law
We do not sell your data. We do not use your invoice data for advertising. We do not share your data with third parties except as described in Section 5.
5. Who we share data with
Finovora uses a small number of trusted third-party service providers to operate the platform. Each is bound by data processing agreements and handles your data only for the specific purpose described.
| Provider | Purpose | Location |
|---|---|---|
| AWS (Amazon Web Services) | Cloud infrastructure, invoice file storage (S3), database (RDS), AI document processing (Textract) | EU — Frankfurt (eu-central-1) |
| Anthropic (Claude API) | AI-powered invoice categorisation | USA — covered by Standard Contractual Clauses |
| Stripe | Payment processing and subscription management | USA — covered by Standard Contractual Clauses |
| Microsoft 365 | Business email and internal communication | EU |
Important note on Anthropic (Claude API): Invoice data passed to Claude for categorisation does not include personally identifiable information where avoidable. Structured extraction output (amounts, categories, dates) rather than raw invoice images is passed where technically feasible. Anthropic does not use API inputs to train its models by default.
No data is transferred outside the European Economic Area except to the providers listed above under appropriate GDPR transfer mechanisms (Standard Contractual Clauses).
6. Data retention
We retain your data for the following periods:
| Data type | Retention period |
|---|---|
| Account data | Duration of your subscription + 12 months after termination |
| Invoice files and extracted data | Duration of your subscription + 30 days after termination |
| Billing and payment records | 7 years (Dutch tax law requirement) |
| Usage and log data | 12 months rolling |
Upon account termination, you may request a full export of your data within the 30-day retention window. After this period, data is permanently deleted.
7. Data security
We take the security of your financial data seriously and implement the following measures:
- All data is encrypted in transit (TLS 1.2+) and at rest (AES-256)
- Invoice files are stored in AWS S3 with private access controls — files are not publicly accessible
- Access to production systems is restricted to authorised personnel only
- All processing infrastructure is hosted within the EU (AWS Frankfurt)
- Regular security reviews and access audits
Despite these measures, no system is completely secure. In the event of a data breach that affects your rights and freedoms, we will notify you and the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) within 72 hours as required by GDPR.
8. Your rights under GDPR
As a data subject under GDPR, you have the following rights:
- Right of access — you may request a copy of all personal data we hold about you.
- Right to rectification — you may ask us to correct inaccurate or incomplete data.
- Right to erasure — you may request deletion of your personal data. Note that some data may be retained for legal compliance reasons (e.g. billing records under Dutch tax law).
- Right to restriction — you may ask us to restrict processing of your data in certain circumstances.
- Right to data portability — you may request your data in a structured, machine-readable format.
- Right to object — you may object to processing based on legitimate interests.
- Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
To exercise any of these rights, contact us at info@finovora.com. We will respond within 30 days. If you believe we are processing your data unlawfully, you have the right to lodge a complaint with the Dutch Data Protection Authority at autoriteitpersoonsgegevens.nl.
9. Cookies
Finovora uses cookies to operate the platform and improve your experience. Strictly necessary cookies (session management, authentication, security) are used without consent as they are essential for the platform to function.
10. Children
Finovora is a business-to-business service and is not intended for use by individuals under the age of 18. We do not knowingly collect data from minors.
11. Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will notify you of material changes via email or platform notification at least 14 days before they take effect. The current version is always available at www.finovora.com/privacy.
12. Contact
For any questions about this Privacy Policy or your data:
Hunze Enterprises
info@finovora.com
Overtoom 203-2, Amsterdam 1054 HT
Netherlands