Your data, on your terms.
Last updated: February 2026
1. What we collect
We collect only what is needed to operate your wallet: your name, email, password (hashed), account type (personal/business), business name (if applicable), wallet activity, and card metadata (brand, holder, last 4 digits). We do not store full card numbers or CVVs.
2. Why we collect it
To create and secure your account, send verification codes, process deposits/withdrawals/transfers, prevent fraud, and meet legal obligations.
3. Email & verification
We use Resend to deliver one-time verification codes to your email at registration and at every login. Emails contain only your code, the purpose, and standard branding.
4. Payments via PayPal
Live-mode deposits are processed by PayPal. When you pay with a card, you interact directly with PayPal's checkout. We receive only an order confirmation — never your card data.
5. Cookies & sessions
We set two HTTP-only, signed cookies (access & refresh tokens) to maintain your session. They cannot be read by JavaScript and are scoped to the FinVault domain.
6. Security measures
Passwords are hashed with bcrypt. Sessions use signed JWTs with short access lifetimes and rotating refresh tokens. We enforce brute-force lockouts after repeated failed logins. Two-factor authentication is available via TOTP.
7. Data retention
Account data is kept while your account is active. Verification codes expire after 10 minutes. Password reset tokens expire after 1 hour. Login attempt counters reset after 15 minutes of inactivity.
8. Your rights
You may request export or deletion of your account data at any time by emailing privacy@finvault.capital. We respond within 30 days.
9. Changes
Material changes to this policy will be communicated via email at least 14 days before they take effect.
10. Contact
For privacy questions, email privacy@finvault.capital.