Privacy Policy and Personal Data Protection

Version: 2.0 Last updated: October 26, 2026 Jurisdiction: Republic of Argentina

1. Introduction

Finamby respects the privacy of its users and is committed to processing their personal data lawfully, transparently and securely.

This Privacy Policy describes what information we collect, how we use it, how long we keep it, with whom we may share it and what rights users have.

Processing is carried out in accordance with Law 25,326 on the Protection of Personal Data, its implementing regulations and other applicable provisions in the Republic of Argentina.

2. Data controller

The controller of the personal databases used by Finamby is:

Privacy email: [email protected]

This contact may be used for privacy questions and to exercise the rights recognized by Argentine law.

3. Personal data we collect

Finamby processes the following categories of information:

3.1. Registration and account data

• User name or identifier.
• Email address.
• Password protected by cryptographic hashing mechanisms.
• Language and configuration preferences.
• Information needed for authentication and security mechanisms.
• Date and version of the acceptance of the Terms and Conditions and the Privacy Policy.
• Declaration of being 18 years of age or older and the date it was made.
• Record of each consent given to process documents using artificial intelligence (date and version of the policy in force, without the content of the file).

3.2. Financial information recorded

• Account names and identifiers.
• Declared or calculated balances.
• Income and expenses.
• Recorded transfers.
• Dates, amounts, descriptions and categories of movements.
• Budgets, savings goals and due dates.
• Data related to shared expenses.

This data is provided directly by the user or added from information that the user reviews and confirms.

3.3. Information contained in documents

When the user requests the processing of images, receipts or PDF documents, Finamby may temporarily process their content to identify financial transactions.

Documents may contain additional personal information, such as names, identifiers, account numbers, transaction references or third-party data.

Finamby does not ask users to enter passwords, banking keys, authentication codes or any information unnecessary for recording their movements.

3.4. Technical and security information

We may process technical information needed to operate and protect the service, including:

• IP addresses.
• Access dates and times.
• Authentication records.
• Information about errors and operation.
• Technical device or browser data needed for security and compatibility.
• Account sign-in history: date and time, result (successful or failed), authentication method, IP address and browser or device data. This history is kept for 90 days and then deleted automatically.

Technical information is used to prevent unauthorized access, detect failures and keep the application stable.

4. Purposes of processing

Finamby uses personal data exclusively for purposes linked to the legitimate operation of the service, including:

• Creating and managing user accounts.
• Recording, organizing and viewing financial information.
• Calculating balances, budgets and statistics.
• Generating indicative savings suggestions.
• Processing documents using artificial intelligence when the user requests it.
• Managing shared expense groups.
• Providing support and answering inquiries.
• Protecting accounts and preventing fraudulent use.
• Sending operational notifications that are requested or necessary.
• Verifying acceptance of the legal documents and the minimum age declaration.
• Suspending or reactivating accounts where appropriate and notifying the user.
• Complying with applicable legal obligations.

Finamby does not sell its users’ personal data or financial information.

Nor does it use individual financial information to market advertising profiles or to train its own artificial intelligence models.

Any new purpose that requires consent will be disclosed in advance and subject to the corresponding authorization.

5. Basis and consent for processing

Finamby processes the information needed to create accounts and provide its features in accordance with the legally applicable bases and exceptions.

When processing requires consent, it will be requested freely, expressly and in an informed manner.

Processing documents using artificial intelligence is optional and requires a voluntary action by the user.

Before using that feature, Finamby will state that the content will be sent to an external artificial intelligence provider.

The user may choose to record their transactions manually without using automated document processing.

Where applicable, consent may be withdrawn through the mechanisms provided, without affecting the lawfulness of prior processing or legal retention obligations.

6. Document processing using artificial intelligence

Finamby uses a centralized integration with the Anthropic PBC API, an artificial intelligence technology provider based in the United States.

Processing takes place only when the user selects a document and requests its analysis.

6.1. What happens to the files

The original files selected by the user are not stored persistently in Finamby’s database or in a document repository.

They are used to carry out the requested operation and do not remain available as permanent attached documents within the account.

Finamby does not offer a service for later storage or retrieval of the original documents.

6.2. What information is kept

Artificial intelligence may identify amounts, dates, merchants, descriptions, balances and other financial data.

The results are presented to the user for review.

Once confirmed, the selected data may be added to the financial records of their account.

Finamby keeps the confirmed movements and other records, but not the original files from which the information was extracted.

6.3. Transmission to Anthropic

To process a document, Finamby transmits its content to Anthropic over an encrypted connection.

The information is used to generate a response that makes it possible to identify and structure the requested data.

Anthropic processes the information received in accordance with the commercial terms, data processing agreements and retention policies applicable to the contracted integration.

6.4. Retention by the provider

Finamby cannot guarantee the immediate deletion of the content received by Anthropic nor unilaterally control all retention periods applicable to that provider.

6.5. Model training

Finamby does not use its users’ documents or financial data to train its own models.

Anthropic’s use of the data is subject to the commercial terms and processing settings contracted. Finamby will endeavor to use a configuration that does not authorize training models on the data sent, unless there is a valid and specific authorization for another purpose.

6.6. Interpretation errors

The results of artificial intelligence may contain errors.

For this reason, the user may review and confirm the movements before they are added to their financial records.

7. International data transfers

Processing through Anthropic may involve a transfer of personal data to the provider.

Finamby will inform the user about this transfer and will apply the protection mechanisms required by Argentine regulations.

When the transfer is made to a jurisdiction that does not have recognition of adequate protection, Finamby must have a valid legal basis or mechanism, including the corresponding contractual safeguards.

The voluntary use of the artificial intelligence feature does not replace the safeguards required by law for international transfers.

8. Technology providers and third parties

Finamby may use technology providers necessary to operate the service, such as infrastructure, hosting, database, authentication, email and artificial intelligence services.

These providers may access only the data necessary to perform the contracted functions, subject to the corresponding obligations and safeguards.

The artificial intelligence provider currently used is Anthropic PBC.

Finamby does not market or sell personal databases to third parties.

Data may also be disclosed when there is a legal obligation, a valid order from a competent authority or another legitimate basis provided by the applicable regulations.

9. Security measures

Finamby applies technical and organizational measures designed to protect the confidentiality, integrity and availability of personal data.

The measures implemented include:

• Encrypted communications over HTTPS/TLS.
• Application-level AES-256 encryption for the sensitive fields covered by this mechanism.
• Password storage using cryptographic hashing.
• Optional two-factor authentication (recommended) and passkey support.
• Access controls and restricted administrative permissions.
• Logical separation of user information.
• Controls against abusive access attempts.
• Access restrictions to sensitive information.
• Administrative access is limited to account, status and service usage data (for example, sign-in history and number of files processed); administrative staff do not access users’ financial content.

The encryption applied by Finamby is not end-to-end encryption. Certain authorized processes of the service require the application to be able to technically access the data in order to run the requested features.

No computer system can guarantee absolute security.

In the event of a security incident, Finamby will take containment, investigation and mitigation measures, and will notify users and authorities where required under the applicable regulations.

10. Data retention

Account data and financial records will be kept while the account remains active and they are necessary to provide the service.

When the user requests deletion of their account, Finamby will delete or anonymize the personal data that no longer needs to be kept, respecting legal deadlines and the rights of third parties.

The original files used for processing with artificial intelligence are not part of the documents stored persistently by Finamby.

Technical and security logs will be kept only for the periods necessary and justified for their purposes.

Data subject to legal retention obligations may be kept for the required period, with restricted access.

The sign-in history is kept for 90 days. The record of consents and of acceptance of legal documents is kept while the account remains active, as evidence of the authorizations given.

11. Shared expenses and third-party data

When a user takes part in a shared expense group, certain data may be visible to other members.

The information shared may include participants’ names, descriptions, amounts and the distribution of expenses.

Members will not be able to access private accounts and movements that are not part of the group.

When a user leaves a group or deletes their account, shared records may be kept when they are necessary to maintain the consistency of the other participants’ transactions and there is a valid legal justification.

Finamby will endeavor to limit or dissociate identifying information where possible and legally appropriate.

Users must avoid entering third-party personal information that is not necessary or whose processing is not legitimately authorized.

12. Rights of data subjects

In accordance with Law 25,326, users may exercise, as applicable, the rights of:

• Access to their personal data.
• Rectification of incorrect information.
• Updating of outdated data.
• Deletion of data when legally appropriate.
• Confidentiality of data in the cases provided by the regulations.

To exercise these rights, the user may use the features available in Finamby or write to:

[email protected]

Finamby may request information reasonably necessary to verify the identity of the requester and prevent unauthorized access.

Access requests will be answered within the legal period of ten calendar days, and rectification, updating or deletion requests within the legal period of five business days, as applicable.

Deletion may be limited by legal retention obligations or by the rights and legitimate interests of third parties, in accordance with applicable law.

13. Supervisory authority

The Agency for Access to Public Information (AAIP), as the supervisory body for Law 25,326, has the authority to handle complaints and claims filed regarding non-compliance with personal data protection rules.

Official site: https://www.argentina.gob.ar/aaip

14. Communications and notifications

Finamby may send communications necessary for account administration, access recovery, security, relevant changes to the service and notifications configured by the user.

Promotional communications, if implemented in the future, will be handled in accordance with the applicable legal requirements and will offer the corresponding opt-out or unsubscribe mechanisms.

15. Account deletion

The user may request deletion of their account through the application or through the contact channel.

Deletion covers the personal data and financial records that do not need to be kept for legal obligations or other legitimate bases.

Deleting information from active systems does not necessarily imply its instant removal from external providers’ systems, whose retention periods are subject to their respective agreements and obligations.

Finamby will not be able to recover the original files processed using artificial intelligence, since it does not keep them as permanent documents.

16. Changes to the Privacy Policy

Finamby may modify this Policy to reflect regulatory or technological changes or changes in its processing practices.

Relevant changes will be communicated to users through the application or by email.

When new purposes or processing that require consent are added, it will be requested beforehand.

Updated versions will state their effective date.

17. Privacy contact

For questions and requests for access, rectification, updating or deletion of data:

Email: [email protected]