This policy explains what Fincharter collects about you, why, who gets to see it and what you can require of us. It describes the service as it actually works today.
Fincharter AS, Norwegian company registration number 837 716 772, Waldemar Thranes gate 5, 0171 Oslo, Norway, is the data controller for personal data processed through fincharter.no and the app.
For privacy questions, or to exercise your rights, write to personvern@fincharter.no. We reply within 30 days, which is the deadline set by the GDPR.
We have not appointed a data protection officer. We do not carry out large-scale monitoring and we do not process special categories of personal data, so the requirement in Article 37 does not apply to us.
We collect only what the service needs. Below is each category, what it actually contains, and where it comes from.
All processing needs a legal basis. Here is ours, purpose by purpose.
| Purpose | Legal basis |
|---|---|
| Creating and running your account | Contract, Article 6(1)(b) |
| Showing your portfolio, calculating value and performance | Contract, Article 6(1)(b) |
| Running your agents and alerting you to matches | Contract, Article 6(1)(b) |
| Answering questions you ask in Analyse, and interpreting what you write to the agent builder, with a language model | Consent, Article 6(1)(a) |
| Taking payment, managing subscriptions and trials | Contract, Article 6(1)(b) |
| Sending email you asked for | Consent, Article 6(1)(a) |
| Newsletter and marketing | Consent, Article 6(1)(a) |
| Replying when you contact us | Legitimate interests, Article 6(1)(f) |
| Preventing abuse and securing the service | Legitimate interests, Article 6(1)(f) |
| Improving the service using aggregated usage statistics | Legitimate interests, Article 6(1)(f) |
| Retaining accounting records | Legal obligation, Article 6(1)(c) |
Three of the purposes above rest on legitimate interests. That requires us to have balanced our interest against yours, and we should say what we concluded.
We consider the interest legitimate because the processing is limited to what the purpose requires, because you can reasonably expect it when using a paid service, and because it is not used to profile you for other purposes. The statistics we produce to improve the service are aggregated, and individuals cannot be read out of them.
You may object to processing based on legitimate interests. See section 9.
Fincharter uses language models to answer questions and explain numbers. It is worth saying precisely what that involves.
When you ask a question in Analyse or Ask, the question and the conversation are sent to Anthropic, who run the model. If you ask something that concerns your portfolio, your holdings are sent too. The same applies when you describe an agent in your own words, ask for Fincharter's assessment in Compare, or add holdings from a screenshot: the text or the image is sent. Some searches additionally go to Perplexity. We do not attach the name or email address on your account. Both act as our processors and are not permitted to use the content to train models.
None of this is sent until you have said yes. The first time you use one of these features, or right after you sign in, we ask you in the app and on the website, and we say who receives what. You can say no, and you can withdraw a yes at any time under Settings, AI assistant. After that, nothing more is sent. The rest of the service works without it.
The agents and the Health check are rules and calculations, not judgement. They rank companies by figures from public sources against thresholds we have set. They make no decision about you, and the output is general information, never personal investment advice. There is therefore no automated decision-making under Article 22.
You are talking to a machine when you use Analyse, not to a person. We say so here because we think you should know, and because Article 50 of the EU AI Act requires anyone who builds a system that converses with people to make clear that it is artificial intelligence.
A language model can be wrong, including when it sounds certain. Check figures that matter against the source, which is always listed beneath the answer.
We never sell personal data. We share it with the suppliers who run the service, and with no one else unless the law requires it.
| Supplier and role | Where, and basis for transfer |
|---|---|
| Supabase, database and authentication | United Kingdom. Commission adequacy decision, renewed 19 December 2025 |
| Vercel, hosting | United States. Standard Contractual Clauses, or the EU-US Data Privacy Framework where the supplier is certified |
| Stripe, card payments | Ireland and United States. Standard Contractual Clauses, or the EU-US Data Privacy Framework |
| Vipps MobilePay, payment and sign-in | Norway. No transfer outside the EEA |
| Resend, sending email | United States. Standard Contractual Clauses, or the EU-US Data Privacy Framework where certified |
| Anthropic, the language model behind Analyse, Ask and the agent builder | United States. Standard Contractual Clauses, or the EU-US Data Privacy Framework where certified |
| Perplexity, web search in Analyse and the agent builder | United States. Standard Contractual Clauses, or the EU-US Data Privacy Framework where certified |
| Meta, advertising measurement on the website (not in the app) | United States. Standard Contractual Clauses, or the EU-US Data Privacy Framework where certified |
| Apple, sign-in and notifications in the iOS app | United States. Standard Contractual Clauses, or the EU-US Data Privacy Framework where certified |
| RevenueCat, subscriptions bought in the iOS app | United States. Standard Contractual Clauses, or the EU-US Data Privacy Framework where certified |
| SnapTrade (Passiv Inc.), read-only access to broker accounts in the iOS app | Canada. EU adequacy decision, or Standard Contractual Clauses |
We do not keep data longer than the purpose requires. If you delete your account, we delete what belongs to it within 30 days, with one exception: under the Norwegian Bookkeeping Act we must retain accounting records for five years after the end of the financial year. Those contain a name, an amount and a date, and nothing more.
We use cookies to keep you signed in and to remember choices you have made, such as dark mode and how far you got in onboarding. They are necessary for the service to work, and they cannot be switched off without it breaking.
We additionally use the Meta pixel to measure the effect of our advertising. It is not necessary for the service, and it requires consent under section 2-7 b of the Norwegian Electronic Communications Act.
You can delete cookies in your browser at any time. If you delete the necessary ones, you will be signed out.
You have the following rights, and you exercise them by writing to personvern@fincharter.no. It is free, and we reply within 30 days.
All traffic is encrypted over HTTPS, and data is stored encrypted at our suppliers. Access to production data is limited to those who need it to run the service. Passwords are stored as irreversible hashes, never in plain text.
If a breach occurs that poses a risk to you, we notify the Norwegian Data Protection Authority within 72 hours, and you directly if the risk is high.
If we change this policy, we update the date at the top. If the change is material, for example a new purpose or a new supplier who gets to see your data, we tell you by email or in the app before it takes effect.
If you believe we process data about you in breach of the rules, we would like to hear it first so we can put it right. You are in any case entitled to complain to Datatilsynet, the Norwegian Data Protection Authority, Postboks 458 Sentrum, 0105 Oslo, postkasse@datatilsynet.no.