1. Who We Are and What This Policy Is About

Finza is a personal finance app built for Sri Lanka. We help you track your spending, understand your finances, and make smarter money decisions — all in one place.

We take your privacy seriously. This policy explains what data we collect, why we need it, and what your rights are. We follow the EU General Data Protection Regulation (GDPR) as our privacy standard, because we believe it represents the best practice for protecting your personal information — regardless of where you live.

If you have any questions after reading this, you can always reach us at pulasthieka@yahoo.com.

2. What Data We Collect and Why

Here's a clear overview of everything we collect:

We do not collect your name, ID number, passport, biometric data, or payment card details.

3. A Note on SMS Access

Sri Lankan banks don't provide official APIs for accessing transaction data. Because of this, Finza reads your bank notification SMS messages to import transactions automatically — this is the only practical way to offer this feature in the Sri Lankan market.

Here's exactly what we do and don't do with your SMS:

SMS access is optional. If you prefer not to grant it, you can still use Finza by entering transactions manually.

4. How We Use Your Data

We use your data only to provide and improve Finza:

• To run the app — syncing your transactions, showing spending summaries, and keeping your account working.
• To give you AI-powered insights — your transaction history is analysed to surface spending patterns, budgeting tips, and financial advice personalised to you.
• To improve Finza — anonymised, aggregated usage data helps us fix bugs and build better features.
• To contact you — only for important updates about the app or your account, never for unsolicited marketing.

5. How We Store and Protect Your Data

On Android, all your transaction data is stored locally on your device using AES-256 encryption. Nothing leaves your phone unless you choose to enable cloud backup.

On iOS, transaction data passes through our server only to enable SMS parsing (as described above). Parsed transaction records are stored on the device, and nothing is retained on our servers.

All communication between your device and our servers is encrypted (HTTPS / TLS 1.2+).

We keep your data for as long as your account is active. If you delete your account, all your personal data is removed from our production servers within 30 days.

6. AI and Your Data

Finza uses the Anthropic Claude API to generate personalised financial advice. When you request an insight or recommendation, we send a structured summary of your transaction data (amounts, categories, dates) to the AI model. We never send raw SMS content or any personally identifying information to the AI.

Your data is not used to train AI models.

7. Third-Party Services

We work with a small number of trusted services to keep Finza running:

We do not use any advertising networks. Finza has no ads. We don't sell your data to anyone, ever.

8. Your Rights (GDPR)

Under GDPR, you have the following rights over your personal data:

• Access — You can ask us what data we hold about you at any time.
• Correction — You can fix incorrect information directly in the app.
• Deletion — You can delete your account and all associated data from Profile → Delete My Account. We'll remove everything from our servers within 30 days.
• Export — You can export your transaction history as a CSV from the app settings.
• Withdraw consent — You can revoke SMS permission at any time in your phone settings. The app will keep working — you'll just need to enter transactions manually.
• Object to processing — You can ask us to stop processing your data for any reason. Contact us at pulasthieka@yahoo.com.
• Lodge a complaint — If you feel we've handled your data incorrectly, you have the right to complain to a data protection authority. Since we follow GDPR, you can contact the relevant EU supervisory authority, or reach out to us first and we'll do our best to resolve it.

To exercise any of these rights, email us at pulasthieka@yahoo.com.

9. Permissions We Ask For

10. Children

Finza is not intended for anyone under 13 years of age. If you believe a child has created an account, please contact us, and we will delete their data immediately.

11. Changes to This Policy

If we make significant changes to this policy, we'll let you know through a notification in the app before the changes take effect. The “Effective date” at the top of this page will always reflect when it was last updated.

12. Contact

Got a question, concern, or request? We'd love to hear from you.