Privacy Policy

This Privacy Policy explains how Zero Loop Labs Ltd ("we", "us", "our") collects, uses, and protects your information when you use FinConvert ("the Service"), accessible at finconvert.dev and via our API.

By using the Service, you agree to this Privacy Policy and our Terms of Service.

1. Data Controller

The data controller responsible for your personal data is:

Zero Loop Labs Ltd
Company No. 17035492
17 Heronsforde, London W13 8JE, United Kingdom
Email: privacy@finconvert.dev

2. What We Collect

Data you provide

• Email address — when you join the waitlist or create an account.
• API key identifiers — hashed key material and metadata (creation date, environment type). We never store your raw API key after initial generation.

Data we process transiently

• Bank statement files — files you upload for conversion are processed entirely in memory and returned to you immediately. They are never written to disc, logged, or stored. No copy of your financial data is retained.
• IP addresses — used transiently for rate limiting. Stored in application memory only and discarded on server restart. Never written to disc or a database.

Data we do not collect

We do not use cookies, tracking pixels, analytics services, or advertising technologies. We do not collect browsing behaviour, device fingerprints, or location data.

3. How We Use Data and Legal Bases

Purpose	Data	Legal basis (UK GDPR)
Waitlist registration	Email address	Consent (Art. 6(1)(a))
API authentication	Hashed API key, key metadata	Contract (Art. 6(1)(b))
Rate limiting and abuse prevention	IP address (transient)	Legitimate interest (Art. 6(1)(f))
File conversion	Bank statement content (transient)	Contract (Art. 6(1)(b))

4. Third-Party Processors

We use a minimal number of sub-processors to operate the Service:

Processor	Purpose	Data shared	Location
Vercel Inc.	Website hosting	HTTP request metadata (no PII)	US (EU Data Protection Framework certified)
Fly.io Inc.	API hosting (London region)	Application runtime	UK (London data centre)

We do not sell, rent, or share your personal data with any other third parties.

5. International Data Transfers

Our website is hosted by Vercel, which processes data in the United States under the EU-US Data Privacy Framework (DPF). Our API is hosted by Fly.io in their London data centre within the United Kingdom.

Your uploaded bank statement files are processed exclusively in the London region and are never transferred outside the UK.

6. Cookies

We do not set any cookies. The Service does not use session cookies, persistent cookies, or any tracking technologies.

7. Data Retention

Data	Retention period
Email address (waitlist)	Until you unsubscribe or the waitlist closes
API key metadata	Until you delete your key or close your account
Bank statement files	Not retained — processed in memory and discarded immediately
IP addresses (rate limiting)	Transient — held in memory for up to 60 seconds, discarded on server restart

8. Your Rights

Under the UK GDPR and Data Protection Act 2018, you have the following rights:

• Right of access (Art. 15) — request a copy of the personal data we hold about you.
• Right to rectification (Art. 16) — correct inaccurate personal data.
• Right to erasure (Art. 17) — request deletion of your personal data.
• Right to restrict processing (Art. 18) — limit how we use your data.
• Right to data portability (Art. 20) — receive your data in a machine-readable format.
• Right to object (Art. 21) — object to processing based on legitimate interests.
• Right to withdraw consent (Art. 7(3)) — withdraw consent at any time where consent is the legal basis.

To exercise any of these rights, email us at privacy@finconvert.dev. We will respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

9. Contact

For any questions about this Privacy Policy or your personal data, contact us at:

Zero Loop Labs Ltd
17 Heronsforde, London W13 8JE, United Kingdom
Email: privacy@finconvert.dev