Privacy Policy

Who we are

Finalizo is operated by Nebula Craft Design Ltd, a company registered in England and Wales (company number 17180534), with registered office at 61 Bridge Street, Kington, HR5 3DJ, United Kingdom.

For account holders and visitors to finalizo.com, Nebula Craft Design Ltd acts as the data controller for the personal information we collect to provide, secure, bill, and improve the service.

For client data uploaded by freelancers, sole traders, agencies, companies, or teams into handover packs, Finalizo generally acts as a data processor. The account holder is responsible for deciding what client data is uploaded, why it is processed, and how long it should be retained. The account holder remains responsible for giving clients any notices and handling requests that belong to the controller.

For privacy questions, data rights requests, or data processing questions, contact privacy@finalizo.com.

What data we collect

We collect account data including your name, email address, profile image from Google sign-in, authentication provider, timezone, workspace preferences, referral code, onboarding state, role, and subscription plan.

We collect product usage data including projects created, handover packs sent, pack views, sign-off timestamps, certificate records, support terms, integrations configured, API keys created, webhooks delivered, and product interactions needed to operate the service.

We store client data that you add to Finalizo, including client names, email addresses, company names, project names, handover records, resources, comments, support boundaries, and sign-off details. We process this client data on your behalf.

We store credential data that you choose to add to a handover pack. Credential passwords are encrypted with AES-256-GCM before storage. You should only add credentials you are authorised to process and hand over.

We collect billing metadata such as Stripe customer IDs, subscription status, invoice IDs, invoice URLs, payment status, billing period dates, cancellation feedback, and tax-related billing metadata. Stripe processes card details directly; we never see or store full card numbers or CVC values.

We collect technical data such as IP address, browser type, device information, request logs, session cookies, user agent, referrer, error traces, analytics events, and approximate location derived from infrastructure logs for security, fraud prevention, reliability, support, and product functionality.

How we use your data

We use your data to provide the Finalizo service, authenticate users, create handover packs, send transactional emails, collect sign-offs, deliver credential records, process billing, maintain integrations, and provide customer support.

We use transactional emails for magic links, handover notifications, sign-off requests, pack-view alerts, billing notices, trial reminders, account deletion confirmations, and account security events.

If you opt-in to marketing communications (for example, when downloading a checklist or signing up), your email address is added to our marketing audience hosted securely on Resend. This includes the optional checklist capture shown in our exit-intent prompt on the marketing site. We may send product emails about Finalizo features and educational content. You can unsubscribe from marketing emails at any time using the link in the email footer. Transactional emails required to operate the service will still be sent regardless of your marketing preference.

We use technical and usage data to prevent fraud and abuse, monitor reliability, debug errors, improve the product, measure feature adoption, and understand product usage through privacy-conscious analytics.

Our legal bases under UK GDPR and EU GDPR may include performance of a contract, legitimate interests in running and securing the service, compliance with legal obligations, consent where required, and your instructions where we process client data as a processor.

Processors and sub-processors

We use trusted service providers to operate Finalizo. The current provider categories and named providers are listed in our Subprocessor Register. We only share the data needed for each provider to perform its function. We do not sell personal data.

When we act as your processor, these providers may act as sub-processors under the Data Processing Addendum.

International transfers

Some processors may process data outside the United Kingdom or European Economic Area. Where required, we rely on appropriate safeguards such as adequacy decisions, Standard Contractual Clauses, or equivalent contractual protections.

Data storage and security

Finalizo stores application data in managed PostgreSQL infrastructure and persistent handover files in private Cloudflare R2 storage. The applicable provider, location, and transfer information are maintained in the Subprocessor Register and may depend on the enabled production configuration.

Credential passwords are encrypted with AES-256-GCM before storage. Encryption keys are stored separately in environment variables and are not committed to source control.

Traffic is protected with HTTPS/TLS. Production access is limited to authorised team members who need access to operate, secure, and support the service. We use role-based access, audit trails where available, rate limiting, and security monitoring.

We maintain recovery copies according to the configured hosting and storage provider controls. The current target for rolling backups is 30 days, but a backup copy may remain until it is overwritten or expires under the provider's retention controls.

Data retention

Active account, project, content, file, and credential data is retained while your account remains active. You can export your data or request deletion from account settings where available or by contacting us.

When you delete your account, we schedule account, project, content, file, and credential data for permanent deletion after a 30-day recovery window. We may retain billing, security, fraud prevention, backup, and legal records where required by law or necessary to establish, exercise, or defend legal claims.

Unless a longer period is required by law or a legal hold, our operational targets are: sign-off certificates, snapshots, and core closeout evidence for 6 years from sign-off; billing, invoice, and tax records for 6 years where applicable; security and access logs for 12 months; analytics events for 12 months before aggregation or anonymisation; support records for 24 months after closure; and rolling backups for 30 days. A minimal suppression record may be retained for as long as needed to honour an opt-out.

AI prompts are not retained as product content unless you or an authorised workspace user saves them. Provider retention and processing are described in the AI Terms & Disclosure.

Your rights

If UK GDPR, EU GDPR, or similar privacy law applies to you, you may have the right to access your data, correct inaccurate data, request deletion, export your data in a portable format, restrict processing, object to processing, and withdraw consent where processing is based on consent.

To exercise any of these rights, email privacy@finalizo.com from the email address associated with your account. We normally respond within one calendar month, subject to lawful extensions or limits. We may ask you to verify your identity before acting on a request.

If you are a client of a freelancer or agency using Finalizo, please contact that freelancer or agency first because they are usually the controller of your client data. We will support them in responding to lawful requests.

You may also have the right to complain to the UK Information Commissioner's Office or your local supervisory authority.

Cookies

Finalizo uses essential cookies for authentication sessions, security, preference storage, and core application functionality, including Auth.js/NextAuth session cookies. See our Cookies & Tracking Policy for the current list and controls.

We use analytics cookies or similar browser storage through PostHog to understand product usage, improve onboarding, and measure reliability. These analytics only load after you accept the cookie prompt on the site. Declining the prompt does not affect core product functionality.

We do not use advertising cookies, cross-site behavioural advertising pixels, or sell personal data.

Third-party processors

Contact

Data controller: Nebula Craft Design Ltd (company number 17180534)

Registered office: 61 Bridge Street, Kington, HR5 3DJ, United Kingdom

Privacy contact: privacy@finalizo.com

We normally respond to privacy rights requests within one calendar month unless a different period is required or permitted by applicable law.