Privacy Policy

1. Who We Are

FinCA Agent is operated by Shaukat (AI Solutions Consultant), based in Rawalpindi, Punjab, Pakistan. We provide an AI-powered financial operations platform for Chartered Accountants and FinTech/IT finance teams.

For the purposes of this Privacy Policy, "we", "us", and "our" refer to FinCA Agent. "You" refers to any individual or organisation that accesses or uses the Platform.

2. What Data We Collect

3. How We Use Your Data

We use the data we collect for the following purposes only:

• Providing the Service: Processing your workflow runs, generating reports, and delivering deliverables (DOCX/XLSX files)
• Account management: Authenticating your identity, managing your subscription, and enforcing usage limits
• Service improvement: Monitoring platform performance, diagnosing errors, and improving reliability
• Communication: Sending service notifications, billing confirmations, and support responses
• Legal compliance: Meeting our obligations under applicable law

4. ERP and Accounting Data

When you connect QuickBooks Online or Xero, FinCA Agent requests read-only access to your financial data, specifically:

• Profit & Loss statements
• Balance Sheet data
• Accounts Receivable aging reports
• Revenue by customer reports

We do not request write access to your accounting software. We cannot create, modify, or delete any records in your QuickBooks or Xero account.

ERP access tokens are:

• Encrypted before storage using AES-128-CBC (Fernet) encryption
• Never transmitted to third parties
• Automatically refreshed when they expire
• Immediately deleted when you disconnect the integration

Your use of QuickBooks Online is also subject to Intuit's Privacy Statement. Your use of Xero is also subject to Xero's Privacy Policy.

5. Uploaded Financial Documents

When you upload files (Excel trial balances, CSV bank statements, PDF financial statements):

• Files are processed in memory on our servers
• Extracted financial data is used to generate your requested report
• The original file is not written to disk and is not retained after the workflow run completes
• Extracted data is stored as part of your workflow run record, which you can delete at any time

6. Data Storage and Security

Where your data is stored

Your data is stored on servers provided by Railway (cloud infrastructure), located in data centres operated by railway.app. Our PostgreSQL database is hosted within Railway's managed database service.

Security measures

• Encryption in transit: All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher (HTTPS)
• Encryption at rest: ERP credentials are encrypted using AES-128-CBC before database storage
• Password security: Passwords are hashed using bcrypt before storage — we cannot retrieve your plaintext password
• Access tokens: JWT tokens expire after 60 minutes; refresh tokens after 30 days
• Tenant isolation: Each organisation's data is strictly isolated at the database level — no user can access another organisation's data
• Audit trail: All workflow runs produce a timestamped, immutable audit trail accessible only to the account owner

Security limitations

No system is completely secure. While we take reasonable steps to protect your data, we cannot guarantee absolute security. In the event of a data breach that affects your personal data, we will notify you promptly in accordance with applicable law.

7. Data Sharing

We do not sell, rent, or share your personal or financial data with third parties for commercial purposes. We share data only in the following limited circumstances:

8. Data Retention

9. Your Rights

You have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate or incomplete data
• Deletion: Request deletion of your account and associated data
• Export: Request an export of your workflow run history
• Objection: Object to processing of your data in certain circumstances
• Disconnect: Remove ERP integrations at any time from within the Platform

To exercise any of these rights, contact us at support@hayatcloud.com. We will respond within 30 days.

10. Cookies

FinCA Agent uses minimal cookies and browser storage:

• Authentication token (localStorage): Stores your JWT session token to keep you logged in. This is essential for the Platform to function and is cleared on logout.
• No advertising cookies: We do not use advertising, tracking, or analytics cookies
• No third-party cookies: We do not load third-party advertising scripts

11. Children's Privacy

FinCA Agent is a professional financial platform intended for use by qualified accounting and finance professionals. It is not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us immediately.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or a notice within the Platform at least 14 days before the changes take effect. The "Effective Date" at the top of this page indicates when the current version was last updated.

Continued use of the Platform after the effective date of any changes constitutes your acceptance of the updated policy.