Terms of Use & Privacy Policy

1.1

In order to use the Account Service you may need to link one or more of your existing payment accounts and/or card solutions, such as debit card, credit card and/or checking account, which you would like to apply the Account Service to. This is referred to as the "Transaction Link".

We will not be able to provide the parts of the Account Service that rely on transaction or account data without a functioning Transaction Link or for any account or card not linked. By using the Account Service you confirm that you accept these Terms of Use.

1.2

Based on your request to create and uphold the Transaction Link, the financial institution(s) where you have the account(s) and/or the card issuer(s) of your card(s), jointly the "Transaction Issuers", will provide to Finton information about the purchases and payments that you make using your linked payment methods, such as purchase amount, merchant information and point of sale, transaction text, date, account balance and other related account or transaction information, jointly the "Transaction Data".

You accept and agree that the Transaction Issuer may disclose your Transaction Data, card or payment account details linked to the respective payment method or card(s) to Finton.

1.3

The Account Service integrates with Enable Banking Oy as open-banking connectivity provider. When you link a bank account you have separately accepted Enable Banking's connectivity terms and privacy rules.

Gokind AB enriches and categorizes transaction data as a processor on our behalf. Enable Banking and Gokind process personal data only as needed to provide the Account Service and are bound by data processing agreements with Finton.

1.4

Based on your Transaction Data and the information that you provide in connection with registration for and use of the Account Service, we will provide you with the Account Service, which includes Finton providing you with insights into your economy, loan situation, spending patterns and the use of other consumer related products, services and utilities, which could be relevant for you based on your spending and preferences.

Finton may also offer an optional AI chat where you can ask questions about your finances. Answers are generated automatically based on your linked data and do not constitute personal financial advice, insurance advice, investment advice, pension advice, credit assessments or recommendations. Questions that rely on transaction data still require a functioning Transaction Link.

1.4a

The AI chat is voluntary and may be offered in beta. Usage may be subject to a daily limit. You can clear your chat history at any time by starting a new chat in the app. Chat messages are also automatically deleted after 90 days. For how chat data is processed and retained, see our Privacy Policy below.

1.4b

Finton may offer optional insurance, pension and wealth aggregation through our partner Insurely. This part of the Account Service allows you to retrieve and view information relating to your insurance policies, pension accounts and/or investment accounts from the companies of your choice, such as insurance companies, pension providers, investment platforms or other relevant providers, each a "Company".

This part of the Account Service consists of data access services that collect information from such Companies on your behalf and at your request. The service is voluntary and separate from bank linking.

1.4c

When you choose to retrieve insurance, pension and/or investment data through the Account Service, you authorise Finton to retrieve information from the relevant Company through your mobile device or computer and to use that information within the Account Service in accordance with these Terms and our Privacy Policy.

The retrieval of such data takes place by means of your authentication with the relevant Company, for example through BankID or another login or authentication method made available by that Company. You are responsible for ensuring that you have the right to access and use the relevant account, insurance policy, pension account, investment account or other information made available through the Company.

If you complete an Insurely flow, we may store a snapshot of the results to display them in the app and to provide related insights and summaries.

1.4d

The Companies from which you retrieve information may have their own terms and conditions that apply when you access your information. By using this part of the Account Service, you acknowledge that such third-party terms may apply.

Finton relies on the information provided by the relevant Company and does not independently verify the accuracy, completeness or timeliness of such information. Finton is not responsible for errors, omissions or delays in information provided by a Company, or for any consequences arising from your use of such information.

If you cannot provide accurate and complete information, or if the relevant Company does not make the requested information available, we may not be able to provide this part of the Account Service to you.

1.5

In order to use the Account Service you need to connect it to a Transaction Issuer and/or Company that is supported. The Account Service gives you a convenient way to provide information about some of your preferences, spending, financial situation, insurance coverage, pension situation and/or investment accounts, but you have to apply your own knowledge about your financial life and preferences when assessing the information and suggestions provided by the Account Service.

You are granted a non-exclusive, non-transferable and revocable right to use the Account Service for its intended personal purpose, subject to your compliance with these Terms.

You may not copy, modify, distribute, publish, misuse, interfere with or otherwise use the Account Service for illegal purposes or in a way that may harm Finton, our partners or any third party. You may not change, manipulate or otherwise influence the instructions that Finton or our partners provide to your mobile device or computer in connection with the collection of data.

1.6

Finton and the Account Service do not offer financial advice, lending, insurance advice, pension advice, investment advice, brokerage services or credit intermediation.

All information, summaries, scores, comparisons and insights provided by Finton are general and automatically generated based on the data available through the Account Service. They do not constitute personal financial advice, insurance advice, investment advice, pension advice, recommendations, credit assessments, lending decisions or offers to enter into any financial, insurance, pension or investment product.

You are solely responsible for any financial, insurance, pension, investment or other decision that you make based on information displayed in or obtained through the Account Service.

1.7

You must be at least 18 years old and reside in the EEA to use the Account Service.

1.8

Your data is processed in accordance with our Privacy Policy. By using the Account Service, you agree to this processing.

1.9

The Account Service is provided "as is" without warranty of any kind. Your use of the Account Service is at your sole responsibility and risk.

We endeavour to ensure that information in the Account Service is as accurate and up to date as possible. However, we cannot guarantee the availability of the Account Service or the reliability, completeness, timeliness or accuracy of the information presented in the Account Service.

Finton and Haveton AB are not liable for any direct or indirect losses resulting from the use of the Account Service, from any financial, insurance, pension, investment or other decision based on information provided through the Account Service, or from downtime, interruption, non-accessibility, errors, omissions or malfunction of the Account Service.

We may modify, suspend, restrict or discontinue all or parts of the Account Service, temporarily or permanently, if this is necessary for technical, maintenance, security, legal or operational reasons.

1.10

To the extent permissible by local law or regulations, these Terms of Use shall be governed by and construed in accordance with Swedish law.

Both parties submit, to the extent permitted by local law or regulations, to the non-exclusive jurisdiction of the District Court of Stockholm to resolve any dispute that may arise from these Terms of Use.

The Terms of Use and Privacy Policy may be altered by giving at least 60 days notice to you before being put into effect, where you have the right to forthwith terminate the use of the Account Service.

1.11

Any provision of these Terms of Use declared void or unenforceable by any competent authority or court shall, to the extent of such invalidity or unenforceability, be deemed severable and shall not affect the other provisions remaining, which shall continue unaffected.

1.12

These Terms of Use were last updated on 1 July 2026 and replace all previous versions thereof.

1. Who we are

Haveton AB, "Finton", "we" or "us", is the data controller for personal data processed in the Account Service. For questions about this Policy or to exercise your rights, contact us at [email protected].

2. What data we collect

When you link accounts and/or cards to the Account Service through the Transaction Link, we process bank or card provider details and connectivity metadata, such as timestamps and IP address, needed for a secure link.

Transaction Issuers provide purchase and payment information, such as amount, transaction text, merchant or labelled information, date, account balance and related account information, jointly "Transaction Data", via Enable Banking. We do not use Transaction Data older than two years when generating insights, summaries, scores and similar in-app features.

We may collect and process the following categories of personal data:

• Identity and account data: email address, first and last name, display name, user ID, notification preferences, device push token and referral information.
• Financial data: transactions, including amount, date, currency, counterparty and category, account names, the last four digits of your IBAN for display, account balance snapshots and bank connection session metadata. We do not store your full IBAN.
• Derived and behavioural data: inferred spending scores, automated insights and recommendations, your category choices and in-app notifications.
• Chat and conversation data: messages you send in the optional AI chat, assistant responses, timestamps and related metadata, such as daily usage limits.
• Insurance, pension and wealth data, optional: if you complete an Insurely flow, we may process and store a snapshot of insurance, pension and/or investment results returned through Insurely to display them in the app. This may include information about insurance policies, insurance coverage, premiums, insured objects, policy terms, pension accounts, investment accounts, holdings, account values and related information made available by the relevant Company.
• App and operational data: crash reports, device information, feedback you submit and email activity for account verification and service messages.

3. Why we use your data

We process your personal data to:

• Provide the Account Service, including insights into your economy, spending, linked accounts, insurance coverage, pension situation and/or investment accounts.
• Retrieve, display and summarise information from Transaction Issuers and Companies that you choose to connect.
• Answer questions in the optional AI chat using your linked transaction, account and other relevant app data.
• Generate automated insights and summaries, such as spending guidance, score summaries and recommendations.
• Provide overviews, insights and summaries based on linked insurance, pension and investment data.
• Help you understand your insurance coverage, pension situation and/or investment accounts based on the information retrieved from the Companies you choose to connect.
• Improve app functionality, maintain security, prevent misuse and comply with legal requirements.
• Send notifications and relevant offers where you have given consent.

The parts of the Account Service that rely on Transaction Data cannot be provided without processing Transaction Data and related account information. The parts of the Account Service that rely on insurance, pension and/or investment data cannot be provided without processing the relevant data retrieved at your request.

We do not use your data for purposes incompatible with those described here.

Legal basis: The primary legal basis is performance of our contract with you under GDPR Art. 6(1)(b), meaning delivering the Account Service you request. Where we send marketing or optional notifications, we rely on your consent under Art. 6(1)(a), which you may withdraw at any time. Where required for security, troubleshooting, fraud prevention or product improvement, we may rely on our legitimate interests under Art. 6(1)(f), balanced against your rights and interests.

4. Who we share data with

We do not sell your personal data.

We share data with trusted processors and partners only as needed to operate the Account Service, under data processing agreements and appropriate safeguards where required.

Processors and subprocessors we use include:

• Google Firebase / Google Cloud — authentication, app infrastructure, secure storage and cloud functions. Primary database region: EU, europe-north2, Finland.
• Enable Banking Oy — open-banking connectivity for Transaction Links.
• Gokind AB — transaction enrichment and categorization.
• Insurely — optional insurance, pension and wealth aggregation initiated by you, including retrieval of data from the Companies selected by you.
• OpenAI — AI chat responses and automated insights. Data sent may include chat messages and a bounded snapshot of your transaction and account data.
• SendGrid — transactional email, such as account verification.
• Sentry — error monitoring. We aim to avoid combining email with financial details in error reports.
• Expo / EAS — mobile app build and over-the-air updates.

Certain processors may process data outside the EU/EEA. Where required, transfers are covered by standard contractual clauses or other appropriate safeguards under GDPR Chapter V.

Aggregated statistics that do not identify individuals may be used for analytics and product improvement.

5. How we protect your data

We apply technical and organizational measures including:

• Data minimization: we store normalized transaction fields needed for the app, not full raw bank payloads on identified transactions.
• Account identifier minimization: we store only the last four IBAN digits for display, not your full IBAN.
• Identity separation: financial event data, such as transactions and accounts, is linked to a pseudonymous identifier separate from your profile, reducing direct linkage in backups and exports. This is pseudonymization. The data remains personal data for us because we hold the mapping to your account.
• Access controls: Firestore security rules restrict data access to the authenticated account owner. Server-managed fields cannot be altered by the client.
• Encryption: data is encrypted in transit and at rest via our cloud infrastructure provider.

No method of transmission or storage is 100% secure. We use commercially acceptable means to protect your data but cannot guarantee absolute security.

6. How long we keep your data

We retain personal data only as long as necessary for the purposes above or to comply with legal obligations:

• Transactions and account data: until you delete your account.
• AI chat messages: 90 days from creation, then automatically deleted. You can also clear chat immediately by starting a new chat.
• Temporary unidentified transaction payloads: up to 30 days, then automatically purged.
• Insurely snapshots and related insurance, pension and wealth data: until you delete your account.
• Identity profile and preferences: until you delete your account.

When you delete your account, we remove your personal data from our systems. Deletion is initiated immediately; residual copies in backups may take up to 30 days to be fully purged.

7. Your rights under GDPR

You have the right to:

• Access — know what personal data we process and request a copy.
• Rectification — correct inaccurate or incomplete data.
• Erasure — delete your data, also known as the right to be forgotten.
• Restriction — limit how we process your data in certain circumstances.
• Portability — receive your data in a machine-readable format.
• Object — object to processing based on legitimate interests.
• Withdraw consent — where processing is based on consent.
• Complain — lodge a complaint with the Swedish Authority for Privacy Protection, IMY.

In the app, you can export your data and delete your account from Settings. Export provides your data in CSV/JSON format. Account deletion removes your profile, transactions, chat history, Insurely snapshots and related data.

You can clear AI chat history immediately by starting a new chat. For other requests, contact [email protected].

8. AI and automated processing

Finton uses automated processing to generate insights, scores, recommendations, summaries and AI chat responses. These are general and informational. They do not constitute personal financial advice, insurance advice, investment advice, pension advice, credit assessments, lending decisions or recommendations.

When you use the AI chat, your message and a bounded snapshot of recent transaction context and up to 24 recent chat messages are sent to our AI provider to generate a response. Chat history is stored in your account and subject to the 90-day retention above.

Finton does not make decisions with legal or similarly significant effects on you based solely on automated processing under GDPR Art. 22.

9. Children

The Account Service is intended for users who are at least 18 years old and reside in the EEA. We do not knowingly collect personal data from anyone under 18.

10. Security

We use encryption, secure access controls and regular review of our systems to protect your information. Access to personal data within Haveton is limited to personnel who need it to operate the service.

11. Updates to this Policy

We may update this Privacy Policy from time to time. Significant changes will be notified in the app and/or via contact information you have provided. The "Effective date" at the top indicates when this version took effect. Continued use after changes constitutes acceptance where permitted by law.

1. What we use on finton.app

• Strictly necessary storage: We store your cookie choice in localStorage, finton_cookie_consent, so we can remember whether you accepted analytics or chose necessary cookies only.
• Analytics, optional: If you accept analytics in our cookie banner, we use Google Analytics 4 to measure anonymous website usage and improve the site. Google Analytics uses cookies and similar technologies. Analytics is loaded with Google Consent Mode; analytics storage stays denied until you opt in.
• Security-related storage: Google tags may use security-related storage needed to operate the measurement stack safely.

We do not use third-party advertising cookies on finton.app. Contact form submissions are sent by email via SendGrid on our servers. SendGrid does not set marketing cookies on your browser when you browse this website.

2. Legal basis and consent

Strictly necessary storage is used to provide the cookie choice you expect. Analytics cookies are used only if you click Godkänn alla / accept analytics in the cookie banner. If you choose Endast nödvändiga, analytics remains off.

We do not treat continued browsing alone as consent to analytics.

3. Managing cookies

You can change your choice by clearing site data for finton.app in your browser and reloading the page to see the cookie banner again.

You can also block or delete cookies in your browser settings. Note that blocking all storage may affect how the cookie banner remembers your preference.