Privacy you can read in one sitting.

This Privacy Policy applies to the Fit Finance marketing website, the Fit Finance web application, and related services where this policy is linked or referenced. Fit Finance is a product operated by Quantum-22 LTD, a company registered in Cyprus and the data controller for the purposes of this policy ("we", "us", "our").

By accessing or using the Services, you agree to the collection and use of information in accordance with this Policy.

We collect different types of information in order to provide and improve the Services. We deliberately keep this list short.

2.1 Information you provide

• Account details: name, email address, password hash, and other details when you create an account or sign up for early access.
• Business information: company name, VAT number, billing details, and other organisation profile fields you choose to provide.
• Financial records you create: invoices, expenses, customer/vendor records, accounts, and KPI data you input into the Services.
• Support and communication: messages, requests, and information you send us via email or support channels.

2.2 Information collected automatically

• Usage data: pages visited, features used, time spent in the app, and aggregated interaction with the Services. We capture this through our own server-side analytics (no third-party advertising trackers, no fingerprinting).
• Device and technical data: IP address, browser type and version, operating system, device identifiers, and basic diagnostic data needed to operate the Services and prevent abuse.
• Cookies and similar technologies: see the Cookie Policy for the full list.

2.3 Information from third parties

We may receive information about you from third-party providers — for example, authentication providers, payment processors (Stripe), or transactional-email providers (Resend) — when you authorise these connections or when they are necessary to operate the Services.

• To provide, operate, and maintain the Services.
• To create and manage your account, organisations, and team workspaces.
• To process and store the invoices, expenses, KPIs, and related financial data that are the core function of the Services.
• To personalise your experience (locale, default VAT rate, currency preferences).
• To communicate with you about updates, security alerts, and support — never to send marketing without your explicit opt-in.
• To analyse aggregate usage so we can improve performance, identify regressions, and prioritise features.
• To comply with legal obligations and to enforce our Terms of Service.

Where data protection laws (such as the EU/EEA General Data Protection Regulation – GDPR) apply, we process your personal data under one or more of the following legal bases:

• Contract: processing is necessary to deliver the Services, maintain your account, or fulfil our agreement with you.
• Legitimate interests: to improve the Services, secure our systems, prevent abuse, and communicate reasonable updates — provided your rights and freedoms do not override these interests.
• Consent: when you explicitly agree to specific processing (e.g., analytics opt-in via the cookie banner, marketing email opt-in). You can withdraw consent at any time.
• Legal obligation: when we must process data to comply with laws or regulatory requirements (for example, retaining invoice records for tax compliance).

We do not sell your personal data. Ever.

We share information only with the following categories of recipients:

• Service providers and processors: infrastructure, payment, email, and support providers who process data on our behalf under contractual safeguards. See section 6 for the list.
• Professional advisors: lawyers, accountants, or auditors when reasonably necessary for compliance or business purposes.
• Legal and regulatory bodies: when required by law, court order, or to protect our rights, users, or the public.
• Business transfers: in connection with a merger, acquisition, or sale of assets, with appropriate protections for your data.

We rely on a small set of EU-first specialised vendors — covering database hosting, edge delivery, payments, transactional email, and error monitoring. They process data only as instructed by us and only for the purposes for which they were engaged.

The named, up-to-date list lives on our Security overview — a single source of truth that we update whenever we add or change a provider. Material changes are also communicated in-app.

Your application data lives in the European Union by default. Some sub-processors (Stripe, Cloudflare) are global by nature; where data leaves the EU/EEA we rely on Standard Contractual Clauses (SCCs) and other safeguards to keep your information protected.

We retain personal data for as long as necessary to provide the Services, comply with legal obligations, resolve disputes, and enforce our agreements.

You can request immediate deletion of your account from Settings → Account or by emailing us. We will confirm by email when deletion is complete.

We use technical and organisational measures appropriate to the risk:

• Encryption in transit (TLS 1.2+) and at rest for the underlying database and object storage.
• Row-level security so each organisation only sees its own records — enforced at the database layer.
• Single sign-on, password rotation, and least-privilege access for our internal staff.
• Regular dependency scanning and security review of changes before they ship.

For more, see our Security overview. No system is impossible to breach — but we treat your records the way we would want our own treated.

Depending on your location and applicable law, you may have some or all of the following rights:

To exercise these rights, contact us using the details below. We may need to verify your identity before responding to your request, and we will reply within 30 days.

We use cookies and similar technologies to operate the Services, keep you signed in, remember your preferences, and analyse usage in aggregate. The full list — including how to opt out — lives in our Cookie Policy.

The Services are intended for use by businesses and are not directed to individuals under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal information, please contact us so we can take appropriate steps to remove it.

We may update this Privacy Policy to reflect changes in our practices, the Services, or legal requirements. When we make material changes, we will take reasonable steps to notify you — for example, by updating the "Last updated" date, posting a notice in the app, or sending you an email. Material changes also bump the version (currently v2.1).

Questions, requests, or concerns? Reach the team that builds Fit Finance: