Finch.Corp Privacy Policy
This policy explains what data the Finch.Corp iPhone app and the workplace portal it connects to process, why, who receives it, and how users can control it. The Russian version prevails in case of discrepancy.
1. Who processes the data
Finch.Corp is a workplace tool. A user's account is issued by their organization (employer), which decides why and to what extent its employees' data is processed. The organization is the controller (operator) of its employees' personal data.
Finch.Corp is developed by NEUROPROJECT LLC (OOO «НЕЙРОПРОЕКТ», INN 5261140192, OGRN 1265200006444; office P14, 178/1 Gagarina Ave., Nizhny Novgorod, 603107, Russia). The developer processes data on behalf of the organization only as needed to run the service and never for its own purposes.
The portal runs on the organization's own servers or, under contract, in Yandex.Cloud LLC (Russia, region ru-central1). The app connects only to its organization's portal address.
2. Data we process
| Data | Purpose |
|---|---|
| Account: login, full name, job title, work email and phone | Sign-in, message signatures, contacting colleagues |
| Content: messages, files, photos, tasks, assistant requests | Messenger, document workflow and assistant features |
| Device push notification token | Delivering notifications about new messages and tasks |
| Technical logs: sign-in time, errors, request address | Security and troubleshooting |
| Credentials for the organization's systems (1C, email) that the user saves | Assistant actions in those systems on the user's behalf |
The app does not track users across other companies' apps or websites, contains no ads or third-party analytics, and does not sell data.
Camera and photo access is requested only so the user can send a picture or save a file; notifications are requested only after sign-in and with the user's permission.
3. AI assistant and international transfers
To answer, the assistant sends the request text and the work-data fragments needed for the answer to language model providers. This happens only with the user's separate consent, requested in the app at first sign-in. Without consent the assistant is off; all other features remain available.
| Recipient | Country | What it receives |
|---|---|---|
| DeepSeek (Hangzhou DeepSeek Artificial Intelligence Co., Ltd.) | China | Assistant requests and data fragments needed for the answer |
| OpenRouter, Inc., forwarding to the model provider (Google) | USA | Images for recognition |
| Apple Inc. (Apple Push Notification service) | USA | Device token and notification text, which may include the beginning of a message |
The current list of model providers is shown on the consent screen in the app. These are transfers outside Russia, including to countries that may not ensure equivalent protection of data subjects' rights. Consent can be withdrawn at any time: More → Privacy & Account → AI data sharing. After withdrawal no new data is sent to the providers.
Providers receive data over encrypted connections and only to produce an answer.
4. Retention
Account data is kept while the account and the organization's contract with the developer are active. Technical logs are kept for no longer than 1 year. Messages and documents created in work chats are the organization's records and are kept under its rules.
5. Deleting your account
Users can delete their account in the app: More → Privacy & Account → Delete Account, confirmed with the password. Immediately:
- sign-in becomes impossible, and all sessions and access keys are revoked;
- work email and phone, saved credentials for the organization's systems, the assistant's personal memory, consents and password reset requests are erased;
- the full name and job title remain only as the signature of messages already sent, which are the organization's records.
If the user is the organization's only administrator, deletion is unavailable until admin rights are transferred to another employee.
6. Your rights
Users may request information about the processing of their data, its correction, blocking or deletion, withdraw consent, and complain to Roskomnadzor or a court. Requests about data in work systems are best sent to your organization; to the developer — at the address below, answered within 10 business days.
7. Security
Data is transmitted only over encrypted connections (HTTPS/TLS). Access is limited by permissions set by the organization. Passwords are stored as hashes.
8. Children
Finch.Corp is a workplace tool and is not intended for anyone under 18.
9. Changes
Material changes get a new version, and the app asks the user to review the policy again.
10. Contact
NEUROPROJECT LLC, support@neuro-project.pro, +7 (831) 231-02-52.