Privacy Policy

Account Information

When you sign up for Finch, we collect your name, email address, phone number (optional), and authentication credentials through Supabase Auth. We may also collect your organizational information if you're part of a coaching group or firm.

Coaching Data

The core of Finch is your coaching practice. We store:

• Client profiles (names, roles, coaching history, behavioral patterns)
• Session transcripts or notes (verbatim or summarized coaching conversations)
• AI analysis and reflections generated from those sessions
• Case notes, action items, and follow-up reminders
• Tags and organizational metadata for your practice management

Integration Data

To integrate with your existing tools, we collect and store:

• Google Calendar credentials (read-only access to your calendar for session scheduling)
• Granola API tokens (if you use Granola for transcript sync)
• Your Anthropic API key — only if you choose to connect your own key (encrypted, stored securely)

Usage Information

We automatically collect analytics about how you use Finch — pages visited, features used, interaction patterns — to improve the platform. We do not track individual session contents or client names in analytics.

Device Information

We collect standard web analytics: IP address, browser type, operating system, pages visited, and time spent on pages. This information helps us diagnose technical issues and understand platform usage.

Core Service Delivery

We use your coaching data (transcripts, notes, client profiles) to generate AI-powered reflections and analysis. This is the core value of Finch — pre-session briefings, post-session analysis, and ongoing case synthesis.

Platform Improvement

We analyze usage patterns to improve the platform, identify bugs, optimize performance, and develop new features. We do this without looking at the actual content of your coaching sessions — we focus only on how the platform is used.

Communication

We use your email address to send you service notifications (password resets, billing updates, platform announcements), and optionally, product updates and educational content about coaching. You can opt out of non-essential emails at any time.

Account Management

We use your account information to authenticate you, manage your subscription, process billing, and support your account.

Legal & Safety

If required by law, we may use your information to comply with legal obligations, enforce our terms of service, or protect the rights and safety of Finch, our users, or the public.

In-Transit Encryption

All data sent to and from Finch is encrypted using TLS 1.2 or higher. Your browser establishes a secure connection before any data is transmitted.

At-Rest Encryption

Sensitive data — API keys, session transcripts, client profiles — is encrypted at rest in our Supabase PostgreSQL database. We use AES-256-GCM encryption for API keys and other highly sensitive credentials.

Access Controls

Only you and your team members (if you've invited them) can access your data. Finch staff do not have access to your coaching data without explicit permission for support purposes.

Regular Security Updates

We keep dependencies up to date, perform regular security patches, and conduct periodic security reviews. We use industry-standard tools for vulnerability scanning.

Infrastructure Security

Finch is hosted on Vercel, which provides DDoS protection, firewalls, and infrastructure security. Our database is hosted on Supabase, which includes automated backups, encryption, and compliance certifications.

Active Accounts

We retain all your data (account information, coaching data, analysis) for as long as your account is active. You can review, export, or delete data at any time through your account settings.

After Account Deletion

When you delete your account, we permanently delete your coaching data, client profiles, and personal account information. Some anonymized usage analytics may be retained for up to 90 days to help us understand platform usage, but these cannot be linked to you.

Backups & Legal Holds

We maintain automated backups for disaster recovery. In rare cases, backup data may take up to 90 days to fully expire after deletion. If we receive a legal request to preserve data, we will retain information as required by law.

Email Communications

We retain transactional emails (password resets, billing confirmations) for account management purposes. You can request deletion of these records by contacting us.

Anthropic (Claude API)

When you request AI analysis, your coaching data (or anonymized version) is sent to Anthropic using your API key. Anthropic processes your data according to their privacy policy and terms of service. They do not use your data to train their models unless you explicitly opt in. See Anthropic's privacy policy.

OpenAI (Search Embeddings)

To let you search across a client's full history by meaning (not just keywords), we generate “embeddings” — numeric representations — of your session content using OpenAI's embeddings API. This content is tokenized first (client and other personal identities are removed and replaced with placeholders) before it is sent, so OpenAI does not receive real names. OpenAI does not use API data to train its models. See OpenAI's privacy policy.

Supabase (Database)

We use Supabase for authentication and data storage. Your account information and coaching data are stored in Supabase's PostgreSQL database. Supabase is SOC 2 certified and complies with GDPR and CCPA. See Supabase's privacy policy.

Vercel (Hosting)

Finch is deployed on Vercel. Vercel provides infrastructure, CDN, and hosting services. They collect standard hosting analytics (IP addresses, page views, uptime metrics). See Vercel's privacy policy.

Resend (Transactional Email)

We use Resend to send password resets, billing notifications, and platform announcements. Your email address is shared with Resend for these communications. Resend does not store your coaching data. See Resend's privacy policy.

Google Calendar (Integration)

If you enable Google Calendar integration, we request read-only access to your calendar to help you schedule sessions. We do not modify your calendar or store your calendar events. Google handles this data according to their privacy policy. See Google's privacy policy.

Granola (Transcript Sync)

If you use Granola for transcript sync, you provide Granola's API token to Finch. We store this token encrypted and use it only to import transcripts from Granola. We do not share your transcript data with Granola beyond what's needed for the sync. See Granola's privacy policy.

Right to Access

You have the right to access all personal data we hold about you. You can download your data through your account settings or request a data export by contacting us.

Right to Correction

You can correct, update, or modify your account information at any time through your settings.

Right to Deletion

You can delete your account and all associated data. We will permanently delete your information within 30 days of your request, except where we're required to retain it by law.

Right to Data Portability

You can request a copy of your data in a portable format (JSON, CSV). Contact us to request a data export.

Right to Opt Out

You can opt out of marketing emails, analytics, and non-essential communication at any time. Opting out will not affect your core service access.

Right to Object (GDPR)

If you're in the EU, you have the right to object to processing of your data for certain purposes. Contact us with your objection.

Exercising Your Rights

To exercise any of these rights, contact us at [email protected] with your request. We'll respond within 30 days.

Session Cookies

We use session cookies to keep you logged in and maintain your preferences. These cookies expire when you close your browser.

Persistent Cookies

We may use persistent cookies to remember your login preference and improve your experience. You can disable persistent cookies in your browser settings.

Analytics

We use minimal analytics (page views, feature usage) to understand how the platform is used and identify bugs. We do not track your individual coaching sessions or client data.

Third-Party Cookies

Our third-party integrations (Google, Granola) may set their own cookies. We recommend reviewing their privacy policies.

Opting Out

You can opt out of analytics by disabling cookies in your browser or requesting not to be tracked. This will not affect your ability to use Finch.