FinDash

Privacy policy

Last updated 17 October 2026. The short version: your spreadsheets are read in your own browser and never uploaded, accounts are optional, and we don't sell your data or use advertising or tracking cookies.

Who we are

FinDash (“we”, “us”) runs the website at findash.tech: a dashboard that turns a small business's monthly figures into revenue, costs, profit and budget. For anything about your data, email support.findash@findash.tech.

What we collect, and why

Spreadsheets you add
Read and totalled by your own browser. The file is never uploaded to us or stored by us.
Your account (optional)
Your email address and password, so you can log in. Passwords are stored by Supabase in hashed form; we never see them. Supabase also records sign-ins, including the IP address, for security.
Saved figures (while logged in)
The worked-out monthly totals and the invoice lines you confirmed, so they're there on any computer you log in on. Not your files and not your photos.
Daily stock records
Original and translated item names, units, storage locations, shelf counts, and confirmed delivery, usage and waste history; what you set for buying each item (minimum, target, supplier and pack sizes) and the supplier item codes you confirm; and the delivery problems you record: what was billed and what arrived, a possible value to check, your notes, and any credit you record. Without a login these stay in this browser; while logged in they are saved separately to your account with Supabase. When you confirm an invoice and choose to add its costs, the reviewed invoice also updates your saved P&L figures. Shelf counts and stock movements do not create additional invoice costs.
Pending invoice and shelf readings
Photo previews and unconfirmed readings, including a shelf count you have not confirmed, stay only in memory for the current visit. They disappear when the page closes. Only confirmed item text and counts enter the stock record; confirmed invoice text and amounts also enter your figures when you choose to add them.
Photos of invoices and shelves (while logged in)
Sent to Claude, Anthropic's AI model, to be read: an invoice photo to read its lines, a shelf photo to count what is visible on that one shelf. We don't keep the photo. From an invoice, only the lines you confirm are kept, as above. From a shelf photo, only the count you confirm is kept, with the count the reading offered, so we can tell how often the counting needs correcting, and the photo's fingerprint, which is a short code worked out from the file so the same photo can't be counted twice; the fingerprint is not the photo and the photo cannot be rebuilt from it.
Advice (when you press Get advice)
Each month's totals (revenue, the four cost groups, net profit and budget) are sent to Claude, which writes the advice. No line items, no names, not your file.
Unrecognised column names (while logged in)
Only the names of the columns in your file, never the numbers, are sent to Claude so they can be matched to the right cost lines.
Figures sent to the API or MCP servers
Monthly figures sent to FinDash's API or MCP servers are worked out and sent straight back. They aren't stored, and no AI model sees them.
Forecasts (only if offered)
If a forecasting model is offered and you press its button, the net profit figure for each month is sent to it, and nothing else.
Daily usage counts (while logged in)
How many photos, advice requests and column matches you used each day, so the daily limits can be applied.
The waitlist (if you join)
Your email address, and nothing else. We use it to email you about FinDash, such as when it opens for you. Only we can see it; we never sell it or use it for advertising. (People who joined earlier were also asked about their business; those answers are kept with their email under the same terms.)
Emails we send
Your email address and the message, when you sign up or reset your password, sent through Resend.
Error reports
If something on a page breaks, the error's technical message, the part of FinDash it came from and the page address are sent to our server log so we can fix it. Never your figures or your file.
Page visits
Vercel Web Analytics counts which pages are visited, the site that linked to them, and the browser, device type and country, without cookies, so we can see how FinDash is used.
Server logs
Like any website, our host (Vercel) logs requests, including IP addresses, for a limited time to run and protect the service.

Guest stock is stored separately from account stock. The Stock workspace settings let you download or restore a JSON backup, or clear guest stock from this browser. Account stock is held in page memory and saved to the account, not cached in browser storage.

What stays in your browser

Browser storage: FinDash keeps your worked-out monthly figures, confirmed invoices and latest advice in your browser's own storage, so they're there next time, along with your display preferences, your light or dark choice and whether you've seen the cookie notice. None of it is sent anywhere, except your figures to your account while you're logged in. Forget my data on the dashboard removes your figures and advice.

Cookies: only two, and only once you log in: fd_access (lasts about an hour) and fd_refresh (up to 30 days, or until you log out), which keep you logged in. Page scripts can't read them. FinDash uses no advertising, analytics or tracking cookies.

Who processes it for us

These services handle data only to provide their service to us:

Some of these are based in the United States, so your data may be processed outside your country. We don't sell your personal information, and we don't share it for advertising.

How long we keep it

Your choices and rights

Depending on where you live (for example under the GDPR in the EU and UK, or US state laws such as California's), you may have the right to access, correct, delete or move your data, to object to or restrict how it's used, and to complain to your data protection authority. Email support.findash@findash.tech to use any of them.

Where the GDPR applies, we rely on providing the service you asked for (your account, saved figures, photos and advice), on your consent (the waitlist, which you can leave at any time) and on our legitimate interest in keeping FinDash working and secure (error reports, logs and page-visit counts).

Security

The site is served over HTTPS. The login cookies can't be read by page scripts. The database only lets each person reach their own figures, and the site never holds Supabase's administrator key. No system is perfect: if you find a problem, please tell us at support.findash@findash.tech.

Children, and changes to this policy

FinDash isn't meant for children under 16; please don't create an account if you're under 16.

If this policy changes, the date at the top changes too, and significant changes are announced on the site.