Data we collect
Authorised business information needed for the plan: GST status and optional UEN, systems and versions, invoice workflows, Peppol and provider-route status, implementation owner and preferences, readiness answers, order and payment status, and basic product analytics.
Data we do not request
Do not submit invoice files, customer-level transaction data, bank details, tax returns, identity documents, personal IDs or payment-card details. Card data is handled by the payment provider.
How we use data
To calculate and save the requested deterministic facts, build the V2 implementation plan, send requested emails, process report orders, provide route guidance, secure the service and understand funnel performance. The plan does not verify actual UAT, whole-stack provider compatibility or grant eligibility. The planned decision-pack delivery is not yet available. If it is enabled later, only locked deterministic facts and authorised business context will be sent to OpenRouter as a gateway to a restricted OpenAI upstream; the context is classified A (statutory and workflow facts), B (planning and system context) or C (unverified readiness and provider-fit statements). Email addresses, company names, payment data, authentication or admin data, and uploaded documents will not be sent to the model provider.
Retention
Unpaid assessments and provider requests are retained for up to 12 months. Paid order records are retained for up to 7 years where reasonably required for accounting, dispute and legal obligations. Analytics may be retained in aggregated form. We may delete data sooner when no longer needed. We do not make a blanket zero-retention claim for OpenRouter or its upstream provider; retention follows the active configuration and applicable provider terms.
AI provider routing
Decision-pack requests are restricted to the standard OpenAI upstream through OpenRouter, with provider fallback disabled and data_collection=deny requested. Locked facts and authorised business context are labelled A, B or C; actual UAT, whole-stack provider compatibility, grant eligibility and official endorsement remain unverified. Zero Data Retention is not enabled or claimed for this route. These routing controls are not a promise that every processor retains no operational data.
Deletion requests
Email privacy@finwaypoint.com from the relevant business email to request access or deletion. Some paid-order information may need to be retained for legal or accounting obligations.
Processors and transfers
We may use Vercel or other hosting, Supabase or another database, Zoho Mail SMTP for transactional email, Waffo as payment provider and Merchant of Record, and OpenRouter as an AI gateway when AI report delivery is enabled. Each processor receives limited data needed for its service under its own security and contractual controls.
Security and changes
We use access controls, signed payment webhooks and data minimisation. No system is risk-free. Material policy changes will be dated on this page.