Privacy Policy | Finovia ERP

1. Scope

This Policy applies to information we process as a controller for our website and Service. If your organization uses Finovia, your organization may also be a data controller for personal data stored in the Service.

2. Information we collect

We may collect the following categories of information:

Account information: name, email, password (stored as a hash), role and authentication details.
Organization and business information: tenant/company name, settings, and configuration.
Business records you upload or create: invoices, customers/vendors, inventory items, journal entries, documents, and other operational data ("Customer Content").
Usage and device data: log data, approximate location derived from IP, browser type, pages viewed, and performance metrics.
Support communications: messages and attachments you send to support.
Cookies and similar technologies: used to keep you signed in, remember preferences, and measure performance.

3. How we use information

We use information to:

Provide and maintain the Service (authentication, access control, features).
Secure the Service (fraud prevention, abuse detection, auditing).
Process transactions you initiate and provide customer support.
Improve the Service (debugging, analytics, product development).
Communicate with you about the Service (service notices, updates).
Comply with legal obligations and enforce our terms.

4. Legal bases (where applicable)

Depending on your location, we rely on legal bases such as performance of a contract, legitimate interests (e.g., securing and improving the Service), compliance with legal obligations, and consent where required (e.g., certain cookies).

5. How we share information

We may share information with:

Service providers that help us operate the Service (hosting, email, monitoring, payment processing). They are authorized to process data only as needed to provide services to us.
Your organization: administrators of your tenant may access and manage user accounts and data within your tenant.
Legal and compliance: if required by law, regulation, or valid legal process, or to protect rights, safety, and security.
Business transfers: in connection with a merger, acquisition, or sale of assets.

6. Data retention

We retain personal data for as long as necessary to provide the Service and for legitimate and essential business purposes (e.g., security, dispute resolution, and compliance). Retention of business records may be controlled by your organization.

7. Google user data used by Orbit

If you connect Google Calendar or Google Drive to Orbit, Finovia uses the Google account information and permissions you approve only to provide the integration features you request:

Google Calendar: read your calendar list so you can choose a destination, and create, update, or remove Orbit-generated events in the calendar you select.
Google Drive: search and display read-only file metadata such as file name, type, size, modification time, and link so you can deliberately attach a Drive link to an Orbit item. In Google Picker mode, you select the files that Finovia can access. Google's per-file permission also permits content operations on those files, but Finovia uses it only to retrieve metadata for links. Legacy connections use metadata search until explicitly migrated. Finovia does not use these permissions to read file contents, upload files, edit files, delete files, or change Drive sharing settings.

Finovia stores encrypted OAuth access and refresh tokens, the Google account identifier and email returned by Google, granted scope names, Calendar mapping identifiers, and metadata for Drive files you choose to link. Other members of your Finovia organization may see an intentionally linked file's name and provider link, but they still need permission from Google to open it.

We do not sell Google user data, use it for advertising, or use it to train generalized artificial-intelligence or machine-learning models. We do not transfer Google user data except as necessary to provide or secure the user-facing integration, comply with applicable law, or as part of a merger or acquisition with appropriate safeguards and user notice where required.

You can disconnect a Google integration from Orbit at any time. Orbit then clears the stored access and refresh tokens and asks Google to revoke access. Calendar disconnect also removes Orbit-managed events for the disconnected mappings. Metadata for Drive links you previously added remains in the relevant Orbit item until an authorized user removes that attachment or the applicable business record is deleted.

Finovia's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

8. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect information. No system is completely secure, and we cannot guarantee absolute security.

9. Your rights and choices

Depending on your location, you may have rights to access, correct, delete, or export your personal data, and to object to or restrict certain processing. You can also update some information through your account settings.

If your request relates to data stored within an organization tenant, we may direct you to the tenant administrator.

10. Cookies

We use cookies and similar technologies for authentication, preferences, and analytics. You can control cookies through your browser settings. Disabling cookies may affect some features of the Service.

On our public website, we ask for your consent before using analytics and advertising cookies from Google, Meta and LinkedIn. These help us measure visits and the performance of our advertising. They are not used inside the Finovia application. You can change your choice at any time using the "Cookie settings" link at the bottom of the website.

11. International transfers

Your information may be processed in countries other than where you live. Where required, we use appropriate safeguards for cross-border data transfers.

12. Children’s privacy

The Service is not directed to children under 13 (or a higher age where required by law). We do not knowingly collect personal data from children.

13. Changes to this Policy

We may update this Policy from time to time. If we make material changes, we will provide notice in the Service or by other appropriate means.

14. Contact

Questions about privacy? Contact us at support@appnovia.com.