Privacy policy
Finchley is provided by Rendella Media Ltd, a company registered in England and Wales (company number 14583630), of 86-90 Paul Street, London, EC2A 4NE. This policy explains what personal data we handle, why, and what your rights are. It is written for two audiences: agencies who use the dashboard, and people who talk to an assistant on a client’s website.
Who is responsible
Dashboard accounts. For the people who sign in to Finchley (agency staff and invited client viewers), Rendella Media is the data controller.
Client knowledge and widget conversations. For documents an agency uploads and for conversations between an assistant and a website visitor, the agency (or its client, as agreed between them) is the controller and Rendella Media is the processor, acting on the agency’s instructions. Website visitors should contact the business whose site they were using.
What we collect
- Account details: name, email, password (hashed), agency name, role, sign-in times.
- Billing: subscription status and the last four digits of a card. Card numbers are held by Stripe, not by us.
- Knowledge: the files and web pages an agency adds to a workspace, and the text extracted from them.
- Conversations: messages between an assistant and a visitor, the answers given, which sources were cited, any tool calls, and, if a visitor asks for a person, the name and email they enter.
- Usage: counts of conversations and model spend per workspace, and the settings an agency chooses.
- Technical: IP address and browser details in server logs, kept for security and for a limited time.
- Walkthrough requests: if you ask for a walkthrough on our website, the name, email address and agency size you enter, together with your IP address and browser details. We keep these for 12 months.
Why, and on what basis
To provide the Service you asked for (contract); to keep it secure and to prevent abuse (legitimate interests); to bill you (contract and legal obligation); and to email you about your account (contract). We do not sell personal data and we do not use anyone’s data to train models.
Who we share it with
| Provider | What for |
|---|---|
| DigitalOcean (London, UK) | Servers, database and file storage |
| Anthropic | Generating answers, grading tests and reading scanned documents, normally under the agency’s own API key |
| OpenAI | Turning knowledge into searchable embeddings, normally under the agency’s own API key |
| Nango | Connecting apps such as Shopify and HubSpot when an agency enables them |
| Stripe | Subscriptions and card payments |
| Resend (US) | Transactional email such as invitations and handoff notifications |
PDFs, Office files and images an agency uploads may also be read by document-reading software running on our own servers, so that their text can be indexed.
Some providers are outside the UK. Where they are, transfers rely on the UK International Data Transfer Agreement or an adequacy decision.
How long we keep it
- Conversations: for the period the agency sets per workspace (30 days, 90 days or a year; the default is 90 days), applied to existing conversations when the setting changes. Test and preview conversations the agency runs itself are kept for 30 days. Daily usage counts are kept without the conversation text.
- Knowledge: until the agency removes the source or the workspace. A removed workspace, or a removed agency, is kept for 30 days, then deleted.
- Accounts and billing records: for the life of the account, then as long as tax law requires for invoices.
- Server logs: 14 days.
Your rights
Under UK GDPR you can ask for a copy of your data, ask us to correct or delete it, object to or restrict processing, and complain to the Information Commissioner’s Office. Agency owners can export everything the agency holds (as JSON plus the original files; the download link lasts 7 days) and remove the agency from the dashboard under Your agency, Your data; anyone can change their details or delete their own account from their account page. Website visitors should ask the business whose site they used; we will help that business respond.
Cookies
The dashboard uses a session cookie, a security (CSRF) cookie and, when you sign in, a “remember me” cookie so you stay signed in; all three are needed for it to work. The widget stores a visitor token in the browser’s local storage, not a cookie, so a conversation can continue; it lasts 24 hours and identifies the conversation, not the person. We do not use advertising or analytics cookies.
Security
Data is encrypted in transit and at rest. API keys and access tokens are encrypted with a separate key. Access to production systems is limited to named staff with two-factor authentication. Tell us at once at support@finchley.ai if you think an account has been compromised.
Changes and contact
We will post changes here and email account owners about material ones. Questions: Rendella Media Ltd, 86-90 Paul Street, London, EC2A 4NE, support@finchley.ai.