Fynca Privacy Policy
Version 1.0 · Last updated: June 14, 2026
Controller: Brainhood Ltd., an Israeli company, company no. 517324679, of 97 Rokach Bv., Tel Aviv, Israel ("Brainhood", "we", "us")
Privacy contact: support@fynca.io.
Representative (GDPR/UK GDPR Art. 27): We have appointed Prighter Group as our privacy representative and point of contact for the European Union and the United Kingdom (full details in Section 12).
1. Introduction and scope
This Privacy Policy explains how Brainhood Ltd. processes personal data when you use Fynca - the market research and analytics platform at fynca.io and app.fynca.io, including its AI features and collaboration tools (the "Service") - and when you communicate with us. Brainhood Ltd. is the data controller (in Israeli law, the database controller). Fynca US, Inc., our wholly owned Delaware subsidiary, participates in subscription billing and processes billing-related data for that purpose under this Policy.
Israeli law notice (PPL §11). You are not under a legal obligation to provide us personal data. Providing the data marked as required at signup and checkout is necessary to create an account and provide the Service under our Terms of Service; if you do not provide it, we cannot provide the Service or the relevant feature. The purposes of the processing, the third parties to whom data may be disclosed, and your rights of access, correction and deletion are described in Sections 3–8.
2. Personal data we collect
| Category | Examples | Source |
|---|---|---|
| Account data | Name, email, password hash or sign-in provider identifiers, profile settings, plan and seat information | You; your sign-in provider |
| Billing data | Plan, transaction history, partial card details (last 4 digits), billing country, tax status. Full card data is processed by our payment processor, not stored by us | You; payment processor |
| User content | Canvases, nodes, notes, annotations, uploads, templates, sharing and collaboration records | You; collaborators |
| AI interaction data | Prompts and queries to AI features, AI outputs, generated audio, feature settings | You; generated |
| Watchlist and usage selections | Symbols, screeners, filters, alerts and preferences you configure | You |
| Usage and device data | Log data, IP address, device/browser type, pages and features used, session identifiers, approximate location from IP, crash and performance data, product analytics events, and session recordings/replays (with form inputs masked) | Automatic (analytics subject to consent where required) |
| Cookies and similar | See the Cookie Policy | Automatic; with consent where required |
| Communications | Support requests, feedback, survey responses, email engagement | You |
We do not intentionally collect special categories of data (e.g., health, biometrics) and ask that you not put them in the Service. The Service is not directed to anyone under 18.
3. Purposes and legal bases
| Purpose | Legal basis (GDPR/UK GDPR; IL consent/legitimate purpose) |
|---|---|
| Provide the Service: accounts, canvases, data feeds, collaboration, support | Contract performance |
| Operate AI features you invoke (processing your prompts and canvas context to generate outputs) | Contract performance |
| Billing, subscriptions, taxes, fraud prevention (via Fynca US, Inc. and our payment processor) | Contract performance; legal obligation; legitimate interests |
| Service communications (receipts, renewal reminders, security and legal notices) | Contract performance; legal obligation |
| Marketing emails and newsletters | Consent (opt-in; unsubscribe any time; Israeli Communications Law §30A respected) |
| Product analytics and improvement | Consent where required (analytics cookies/SDKs); otherwise legitimate interests in improving the Service |
| Security, abuse prevention, enforcement of terms | Legitimate interests; legal obligation |
| Compliance with law, requests of authorities, legal claims | Legal obligation; legitimate interests |
| Corporate transactions (financing, M&A) under confidentiality | Legitimate interests |
Automated decision-making. We do not make decisions producing legal or similarly significant effects about you based solely on automated processing. AI features generate informational content at your request; they do not make decisions about you. Product analytics involve limited profiling for usage statistics, which you can restrict via cookie controls.
4. AI features and your data
When you use Chatsight, the Agent or Narrator, your prompts and relevant canvas context are processed by us and transmitted to third-party AI model providers (currently accessed via an AI gateway) and a speech-synthesis provider, to generate the output. We contractually require these providers to use such data only to provide the service to us and not to use your prompts or content to train their models. Do not include sensitive personal data in prompts. AI interaction history is stored with your account so you can revisit it, and is deleted as described in Section 7.
5. Who receives personal data
We do not sell personal data for money. We share personal data with:
- Processors/service providers acting on our instructions, in the following categories: hosting and infrastructure (cloud hosting, database, storage and content-delivery providers), authentication and account management, payment processing, AI model and speech-synthesis providers (accessed via our AI gateway), market and social data providers, product analytics and session replay (subject to consent where required), email delivery, and customer-support tooling. We engage each provider under a data-processing agreement that limits their use of personal data to providing services to us. A current list of our sub-processors is available on request, and we give notice of material changes.
- Fynca US, Inc. for billing operations, under intra-group arrangements.
- Other users, when you collaborate or share: collaborators and link-holders see shared content and associated display name.
- Market data and social data vendors receive the symbols/queries necessary to return data; we do not send them your name, account identifiers or other personal data, and these vendors may use those queries as their own usage data.
- Authorities, courts and advisers where required by law or to establish or defend legal claims.
- Successors in a merger, acquisition, financing or asset sale, under confidentiality and subject to this Policy.
US state law note: we do not "sell" personal data for money; analytics may constitute "sharing"/targeted-advertising processing in some states - you can opt out via cookie controls and the Global Privacy Control (GPC) signal, which we honor.
6. International transfers
We operate from Israel and use providers in the United States and elsewhere. Israel benefits from an EU adequacy decision; transfers from the EU/EEA/UK to countries without adequacy rely on appropriate safeguards, principally the EU Standard Contractual Clauses (and UK IDTA/Addendum), plus supplementary measures where needed. Transfers from Israel comply with the Privacy Protection (Transfer of Data Abroad) Regulations, 5761-2001. Contact support@fynca.io for transfer documentation.
7. Retention
| Data | Retention |
|---|---|
| Account and user content | Life of the account; deleted or anonymized within 90 days after account deletion |
| AI interaction history | Until you delete it or your account is deleted |
| Billing and tax records | 7 years |
| Analytics | 12–24 months, then aggregated or deleted |
| Support communications | 24 months after closure |
| Consent and disclosure records | As long as needed to demonstrate compliance |
Content you shared with others may persist in their accounts after you delete yours.
8. Your rights
Israel (PPL, including Amendment 13). You may request access to data held about you in our databases, and correction or deletion of data that is inaccurate, incomplete or unlawfully processed; we will respond within the statutory periods. You may also complain to the Privacy Protection Authority. Direct-marketing objections are honored at any time.
EU/EEA and UK (GDPR). Rights of access, rectification, erasure, restriction, portability, objection (including to direct marketing and to legitimate-interest processing), and withdrawal of consent at any time without affecting prior processing. We respond within one month (extendable as the law allows). You may complain to your supervisory authority (in the UK, the ICO). We have appointed Prighter Group as our representative and point of contact for the EU and the UK; you can exercise your data subject rights easily via our Trust Center: https://app.prighter.com/portal/fynca.
United States (state laws). Depending on your state: rights to know/access, correct, delete, portability, and to opt out of "sale", "sharing"/targeted advertising and certain profiling, without discrimination. Submit requests as below or via cookie controls/GPC. If we deny a request you may appeal by replying to our decision; unresolved appeals may be referred to your state Attorney General.
Other countries. We honor applicable local rights on verified request.
How to exercise. Email support@fynca.io from your account email (or with information sufficient to verify you). An authorized agent may act for you where the law allows. We do not charge for first requests unless manifestly unfounded or excessive.
9. Security
We apply technical and organizational measures appropriate to the risk: encryption in transit, encrypted storage with reputable cloud providers, role-based access controls on collaboration, server-side key management (no client-side data-vendor keys), least-privilege internal access, logging, and vendor due diligence. No system is perfectly secure; we will notify you and the competent authorities of data breaches where the law requires (including under Israeli PPL regulations and GDPR Arts. 33–34).
10. Children
The Service is for adults 18+. We do not knowingly process children's data; if you believe a minor has provided data, contact support@fynca.io and we will delete it.
11. Changes
We may update this Policy. Material changes will be notified by email or in-app at least 14 days before taking effect; the date above reflects the current version. Archived versions are available on request.
12. Contact
Brainhood Ltd. (controller), company no. 517324679, 97 Rokach Bv., Tel Aviv, Israel · support@fynca.io
Privacy queries: support@fynca.io. Representative (GDPR/UK GDPR Art. 27): Prighter Group - EU: iuro Rechtsanwälte GmbH t/a Prighter, Schellinggasse 3, 1010 Vienna, Austria; UK: Prighter Ltd, United Kingdom. Exercise your data subject rights under GDPR: we provide you with an easy way to submit privacy-related requests, such as a request to access or erase your personal data. To make use of your data subject rights, please visit our Trust Center: https://app.prighter.com/portal/fynca.
Billing entity: Fynca US, Inc., 2810 N Church St, #88013, Wilmington, DE 19802, USA