Privacy policy
What Finrose does with your company's data, and with data about the people who use it.
Last updated October 23, 2026
Who we are
Finrose is a service operated by Bifrost Partners LLC, a Delaware limited liability company, 2810 N Church St, PMB 540960, Wilmington, Delaware 19802-4447, US ("Finrose", "we"). Privacy questions go to hi@finrose.co.
For your company's books, bank data and documents, your company is the controller and we are its processor. For the details of the people who use Finrose, we are the controller.
Data we process
- People: names, work email addresses and chat user ids of the people in your company's Finrose channel, and who approved what.
- Messages and files: what people send to Finrose, and the files they share with it or forward to your company's Finrose email address, such as receipts, invoices and bank statements. Finrose reads every message and file posted in your company's Finrose channel. From messages that don't mention Finrose, it keeps the receipts and invoices it finds in shared files and nothing else: no message text and no other file. When someone mentions Finrose, it reads the channel's messages from the last 24 hours as background, and keeps them only as part of that conversation.
- Mailbox search results and attachments found, when your company connects Gmail: which messages match Finrose's search for a bank line's receipt, and the PDF and image attachments it keeps from them. Finrose doesn't keep a message's subject, sender or text.
- Books: what Finrose reads from your accounting system (accounts, entries, contacts, open invoices and bills, balances, company details), and the entries it proposes or books.
- Bank and payouts: transactions and balances from the bank feeds and tools you connect, or from statements you share. From Shopify, Finrose reads only Shopify Payments payouts and their fees and refunds, never your customers' names, emails or addresses.
- What you ask Finrose to remember, such as how an expense is booked.
- Reports and files Finrose makes for your company, such as the first look, monthly packs and workbooks: a copy of each as it was sent, and for links to them, when each link was opened and the browser it was opened in (no IP address).
- Credentials for the systems you connect, stored encrypted.
- finrose.co: the email address you sign up with, what you write to us, and the IP address a signup comes from, to stop abuse. Visits are counted with Vercel Web Analytics, which sets no cookies.
Why we process it
- To propose entries, book them once an approver approves them, and answer questions about your books.
- To keep a record of who approved each entry and when.
- To run, secure and support Finrose, and to answer you.
We don't sell your data, and we don't use it to train AI models. The AI models Finrose uses run with zero data retention: the provider keeps nothing after answering.
Where the GDPR applies, the legal basis is our contract with your company and our legitimate interest in running and securing Finrose.
Subprocessors
- Vercel
- Hosting, functions and file storage
- Frankfurt, Germany
- Supabase
- Database
- Frankfurt, Germany
- Anthropic, through Vercel AI Gateway
- Language models, with zero data retention: neither keeps your content after answering
- United States
- Slack
- The chat workspace where Finrose works
- Per your Slack workspace
- Intuit QuickBooks Online
- Your books, when you connect them
- Per your Intuit account
- Visma e-conomic
- Your books, when you connect them
- Per your e-conomic agreement
- Mercury
- Bank feed, read-only
- Per your Mercury account
- Stripe Financial Connections
- Bank feeds for US banks, read-only
- United States
- Plaid
- Bank feeds for US banks, read-only
- United States
- Enable Banking
- Bank feeds for European banks, read-only
- Finland (EU)
- Shopify
- Payouts from your store, read-only, when you connect it
- Per your Shopify account
- Composio
- Connections to other tools you choose to connect, such as Stripe. When you connect Gmail, it searches your mailbox for receipts, reads the matching messages to find their attachments, and may keep its request logs for up to a year
- United States
- Resend
- Email sent by Finrose, and receipts forwarded to your company's Finrose address
- United States
- Stripe
- Payments for Finrose
- United States
Slack, Intuit, Visma e-conomic, Mercury and Shopify are services your company already uses; their own terms cover the data they hold. Finrose reaches them only with the access your company grants.
Where data is kept
Finrose runs, and stores your data, in Frankfurt, Germany. Language models, email and connections to other tools are run by the providers above in the United States. Transfers out of the European Economic Area rely on the Standard Contractual Clauses in those providers' data processing terms.
Retention
- While your company uses Finrose, we keep this data for as long as Finrose needs it to serve you.
- When your company cancels, Finrose stops reading your systems and deletes stored credentials at once. Everything else is deleted within 30 days, and from backups within 90 days, except what the law requires us to keep.
- An approver can disconnect your accounting system at any time. Finrose then revokes its access where the system allows it, and deletes the stored credential.
- If you uninstall Finrose from Shopify, Finrose deletes its access to your store at once. Payout data from the store that isn't booked yet is deleted when Shopify asks, 48 hours later.
- Entries Finrose booked stay in your accounting system. They are yours.
- A link to a report works for 30 days, and stops at once when an approver disconnects your accounting system. The copies of reports and files Finrose made are kept like the rest of your data, and deleted within 30 days of cancelling.
Security
- Credentials are encrypted with AES-256-GCM before they are stored.
- Each company's data is kept apart from every other company's in the database.
- Files are kept in private storage. A report link is an unguessable address, posted only in your company's channel; anyone who has it can open the report until it expires or is revoked. Search engines are told not to index it.
- Nothing is booked without an approver's approval.
Your rights
You can ask to access, correct, export or delete personal data about you, or object to its use, by writing to hi@finrose.co. For data your company controls, such as its books, ask your company; we help it answer. Where the GDPR applies, you can also complain to your data protection authority. These requests are open to US residents with state privacy rights too.
Changes
We post changes here and give your company's approvers 30 days' notice before they take effect.