Privacy Policy

This Privacy Policy ("Policy") describes how ForezynPlan, Inc. ("ForezynPlan", "we", "us", or "our") collects, uses, stores, shares, and protects personal information in connection with our cloud-based financial planning platform, website, APIs, and all related services (collectively, the "Service").

This Policy applies to all individuals who interact with ForezynPlan, including visitors to our website, registered users, trial account holders, and paying subscribers. If you use the Service on behalf of an organisation, you confirm that you are authorised to accept this Policy on that organisation's behalf.

Where ForezynPlan processes personal data on behalf of a business customer as a data processor, the terms of our Data Processing Agreement ("DPA"), available at forezynplan.com/dpa, shall govern such processing and take precedence over this Policy to the extent of any conflict.

We are committed to processing personal data responsibly and in full compliance with applicable privacy laws, including the General Data Protection Regulation ("GDPR"), the UK GDPR, the California Consumer Privacy Act ("CCPA"), and other applicable data protection legislation.

Account & Registration Information. When you create an account, we collect your full name, email address, job title, company name, phone number, and account password (stored as a salted cryptographic hash). If you sign up via a third-party identity provider (e.g., Google, Microsoft), we receive the profile information authorised by that provider.

Payment & Billing Information. When you subscribe to a paid plan, payment details (card number, expiry, CVC) are collected and processed directly by our PCI DSS-compliant payment processor, Stripe. We store only a tokenised reference, last four digits, card brand, and billing address. We never store raw card data on our servers.

Usage & Log Data. We automatically collect technical information when you use the Service, including your IP address, browser type and version, operating system, device identifiers, pages visited, features used, session duration, referring URLs, and error logs. This information is used to operate, secure, and improve the Service.

Financial & Business Data. The Service is designed to process financial information you upload or connect, including cash-flow data, revenue projections, expense records, balance sheet figures, and integration data from third-party accounting, banking, and ERP systems (e.g., Xero, QuickBooks, Stripe, Plaid). This data is treated as confidential and is not used for any purpose other than providing the Service to you.

Communications & Support. We retain records of any correspondence between you and ForezynPlan, including support requests, feedback submissions, survey responses, and email or in-platform messages. This information is used to respond to your enquiries and improve our support quality.

Third-Party Integration Data. If you connect third-party services to ForezynPlan (e.g., accounting platforms, bank feeds, CRM tools), we receive data from those services as authorised by you. The scope of data received depends on the permissions you grant during the integration setup.

If you are located in the European Economic Area, the United Kingdom, or Switzerland, ForezynPlan processes your personal data on the following legal bases under the GDPR and UK GDPR:

Performance of a Contract (Article 6(1)(b)). We process data that is necessary to provide the Service to you, including account management, billing, and delivering the features you have subscribed to. Without this data, we cannot fulfil our contractual obligations to you.

Legitimate Interests (Article 6(1)(f)). We process data to pursue our legitimate business interests, including improving the Service, preventing fraud and abuse, ensuring network and information security, and communicating with you about product updates. We have assessed that our legitimate interests are not overridden by your fundamental rights and freedoms.

Legal Obligation (Article 6(1)(c)). We process data where required to comply with applicable law, including tax and accounting obligations, responding to lawful requests from regulatory or law enforcement authorities, and enforcing our legal rights.

Consent (Article 6(1)(a)). Where we rely on your consent — for example, to send marketing communications or to place non-essential cookies — you may withdraw that consent at any time without affecting the lawfulness of processing based on consent before withdrawal.

We use the personal information we collect for the following purposes:

Service Delivery & Operations. To create and manage your account, authenticate your identity, deliver the features and functionality of the Service, process payments, provide customer support, and send transactional communications (e.g., receipts, password resets, security alerts).

Product Improvement & Analytics. To understand how users interact with the Service, identify usage patterns, diagnose technical issues, test new features, and inform our product roadmap. Where possible, we rely on aggregated or anonymised data for these purposes.

Security & Fraud Prevention. To monitor for suspicious activity, detect and investigate potential security incidents, enforce our Terms of Service, and protect the rights, property, and safety of ForezynPlan, our users, and third parties.

Marketing & Communications. To send you promotional emails, product newsletters, and event invitations where you have provided consent or where we have a legitimate interest in doing so. You may opt out of marketing communications at any time via the unsubscribe link in any email or through your account notification settings.

Legal & Compliance. To comply with applicable laws and regulations, respond to lawful requests from courts or government authorities, enforce our agreements, and exercise or defend legal claims.

We do not sell, rent, or trade your personal information to third parties for their own marketing purposes. We may share your information in the following limited circumstances:

Service Providers & Sub-Processors. We engage trusted third-party companies to perform services on our behalf, such as cloud infrastructure (Microsoft Azure), payment processing (Stripe), email delivery (SendGrid), analytics (Mixpanel), and customer support tooling (Intercom). These providers are contractually obligated to process data only on our instructions and in accordance with our Data Processing Agreement. A current list of our sub-processors is available at forezynplan.com/sub-processors.

Professional Advisors. We may share information with our lawyers, accountants, insurers, and financial advisors where necessary, under appropriate confidentiality obligations.

Business Transfers. In the event of a merger, acquisition, reorganisation, asset sale, or similar transaction, your information may be transferred as part of that transaction. We will provide notice before your information is transferred and becomes subject to a different privacy policy.

Legal Requirements & Protection. We may disclose your information if required to do so by law or in response to a valid legal process (e.g., a court order or subpoena), or where we believe in good faith that disclosure is necessary to: (a) protect the rights, property, or safety of ForezynPlan, our users, or the public; (b) detect, prevent, or address fraud or security issues; or (c) enforce our Terms of Service.

With Your Consent. We may share your information with third parties when you have given us explicit consent to do so, such as when you enable a specific integration or participate in a co-marketing programme.

We use cookies, pixel tags, web beacons, and similar tracking technologies ("Cookies") to operate and improve the Service, and to understand how users engage with our website and platform.

Essential Cookies are strictly necessary for the Service to function. They enable core features such as user authentication, session management, security controls, and load balancing. These cookies cannot be disabled without significantly impairing the Service.

Analytics Cookies help us understand how visitors interact with our website and platform. We use tools such as Google Analytics and Mixpanel to collect aggregated usage data, including page views, session duration, and feature adoption. This data is used to improve our product and does not identify you personally.

Functional Cookies remember your preferences and settings (e.g., language, currency, dashboard layout) to provide a personalised and consistent experience across sessions.

Marketing Cookies (where you have consented) are used to deliver relevant advertising on third-party platforms, to measure the effectiveness of our marketing campaigns, and to limit the frequency of ads you see. These cookies may be set by our advertising partners.

You can manage your cookie preferences at any time through our Cookie Preference Centre, accessible via the cookie banner or the footer of our website. You may also control cookies through your browser settings; however, disabling certain cookies may affect the functionality of the Service.

We retain personal data for as long as your account is active and for a further period as reasonably necessary to: fulfil the purposes described in this Policy; comply with our legal obligations (including tax, accounting, and regulatory retention requirements); resolve disputes; and enforce our agreements.

Account Data. We retain your account data (name, email, profile, settings) for the duration of your subscription and for up to 12 months after account closure, after which it is deleted or anonymised unless retention is required by law.

Financial & Business Data. Data you upload into the Service is retained for the duration of your subscription. Following account closure or cancellation, you have a 30-day window to export your data. After this period, your financial data will be securely deleted from our active systems within 90 days, and from backups within 180 days.

Payment Records. We retain billing records and invoices for a minimum of seven (7) years in accordance with applicable tax and accounting laws.

Communication Records. Support tickets, feedback, and email correspondence are retained for up to three (3) years to enable continuity of service and quality improvement, after which they are anonymised or deleted.

You may request deletion of your account and associated personal data at any time by contacting privacy@forezynplan.com. We will process verified deletion requests within 30 days, except where retention is required by applicable law.

ForezynPlan is headquartered in the United States. If you access the Service from outside the US — including from the European Economic Area (EEA), the United Kingdom, or Switzerland — your personal data may be transferred to, stored in, or processed in the United States or other countries that may not provide the same level of data protection as your home jurisdiction.

Where we transfer personal data from the EEA, UK, or Switzerland to countries not recognised as providing an adequate level of protection, we rely on one or more of the following safeguards: (a) Standard Contractual Clauses ("SCCs") approved by the European Commission; (b) the UK International Data Transfer Agreement (IDTA) or addendum to SCCs for UK transfers; (c) the EU-US Data Privacy Framework (where applicable); or (d) your explicit consent.

Copies of the applicable transfer safeguards are available upon request by emailing privacy@forezynplan.com. By using the Service, you acknowledge that your personal data may be transferred internationally as described in this section.

ForezynPlan does not make decisions that produce legal or similarly significant effects on individuals based solely on automated processing or profiling, without human involvement.

We do use automated processing as part of the Service's analytical features — for example, to generate cash-flow forecasts, surface anomalies in financial data, or suggest scenario parameters based on your historical data. These automated outputs are tools to assist your decision-making; they do not constitute automated decisions about you as an individual and do not produce legal effects on you.

If we introduce any automated decision-making processes in the future that may produce legal or significant effects, we will update this Policy and provide you with the ability to request human review of any such decision.

The Service is not directed to, and is not intended for use by, individuals under the age of 16 ("children"). We do not knowingly collect, solicit, or process personal data from children. If you are under 16, please do not use the Service or provide any personal information to us.

If we become aware that we have inadvertently collected personal data from a child under 16, we will take immediate steps to delete that information from our systems. If you are a parent or guardian and believe that your child has provided us with personal data without your consent, please contact us immediately at privacy@forezynplan.com and we will investigate and act promptly.

The Service may contain links to third-party websites, products, or services, as well as integrations with third-party platforms. These third parties operate independently from ForezynPlan and have their own privacy policies. ForezynPlan is not responsible for the privacy practices, content, or security of any third-party services.

When you enable a third-party integration (e.g., connecting your Xero or QuickBooks account), you authorise the transfer of data between ForezynPlan and that provider. The data practices of the third-party provider are governed by its own privacy policy and terms, which we encourage you to review before enabling any integration.

Our website may include social media features (e.g., LinkedIn share buttons). These features may collect your IP address and set cookies to function properly. Your interactions with these features are governed by the privacy policy of the relevant social media provider.

We may update this Privacy Policy from time to time to reflect changes in our data practices, legal requirements, or the Service. The "Last Updated" date at the top of this page indicates when the Policy was last revised.

For material changes — defined as changes that significantly affect your rights, the types of data we collect, or the purposes for which we use it — we will notify you at least 14 days before the changes take effect, via email to the address associated with your account and/or via a prominent notice within the Service.

For minor or clarificatory changes, we may update the Policy without individual notice. We encourage you to review this Policy periodically. Your continued use of the Service after the effective date of any update constitutes your acceptance of the revised Policy.