Finch ("Finch", "we", "us", "our") respects your right to privacy and is committed to protecting the personal data we hold about you. This Privacy Policy explains how we collect, use, store and share information that relates to an identifiable individual ("Personal Data"), and how you can exercise your rights under applicable data protection law.
Finch operates in and from the United Arab Emirates. This Policy is governed by UAE law, including Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data ("PDPL"), and does not incorporate obligations from any other jurisdiction's data protection regime (including the EU GDPR) unless we are separately required to comply with them.
By creating an account or using the Finch application (the "App"), you acknowledge that you have read and understood this Privacy Policy.
Finch is a compliance readiness product operated by Sundeck Studio FZE LLC, a company established in the United Arab Emirates ("Finch", "we", "us", "our"). For the purposes of the PDPL, Finch acts as the data controller in respect of the Personal Data described in this Policy, unless stated otherwise.
We collect the following categories of Personal Data:
Account information. Name, email address, and password (stored as a secure hash, never in plain text), provided when you sign up.
Business and assessment information. Information you provide about your business during the assessment, including entity type, incorporation details, revenue, licence type, sector, business activity, and your responses to compliance questions. This information relates to your business but may also constitute Personal Data where you operate as a natural person conducting business in your own name.
Assessment results. The outcome of your compliance assessment, including which rules apply to you and which registration gaps, if any, were identified.
Billing information. If you subscribe to a paid plan, payment is processed by Stripe, our third-party payment processor. Finch does not directly collect or store your full card details; Stripe processes and stores this information subject to its own privacy policy and PCI-DSS obligations.
Technical information. IP address, browser type, device information, and usage data collected automatically when you use the App, for security and product-improvement purposes.
Communications. Any information you provide when you contact us for support or feedback.
We use your Personal Data to:
We do not sell your Personal Data. We do not use your business or assessment data to train third-party AI models without your consent.
We process your Personal Data on the following bases, consistent with Article 4 and Article 6 of the PDPL:
We do not share your Personal Data with third parties except:
We do not currently support inviting other users or team members to your account. Each account and its associated data relates to a single individual or single-entity user. If Finch introduces multi-user or organisational accounts in future, this Policy will be updated to reflect the resulting data-sharing arrangements between account members.
We retain your Personal Data for as long as your account remains active, and for a reasonable period afterward to comply with legal obligations, resolve disputes, and enforce our agreements. Previous (superseded) assessments are retained, not deleted, so that we can notify you if a change in compliance rules affects a result you previously received. You may request deletion of your account and associated data at any time, subject to Section 8 below.
We implement reasonable technical and organisational measures to protect your Personal Data against unauthorised access, alteration, disclosure, or destruction, including encrypted password storage, access controls, and secure infrastructure. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
Under the PDPL, you have the right to:
To exercise any of these rights, contact us at hello@finchhq.ae. We will respond within a reasonable timeframe in accordance with the PDPL.
The App is intended for business owners and individuals conducting business, and is not directed at children. We do not knowingly collect Personal Data from children. If you believe a child has provided us with Personal Data, please contact us so we can address it in line with applicable UAE law on the protection of children's data.
Where we transfer Personal Data outside the UAE (for example, to a hosting provider or service provider located abroad), we will do so in accordance with the cross-border transfer requirements of the PDPL.
We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the App or by email. Continued use of the App after a change takes effect constitutes acceptance of the updated Policy.
If you have questions about this Privacy Policy or how we handle your Personal Data, contact us at:
Email: hello@finchhq.ae