Last updated: 2026-08-21
1. Who we are
Fin-Central is a trading name of Nikah AI Ltd, a company registered in England and Wales (company number 17199968), registered office Office 1216 Fitzrovia, 60 Tottenham Court Road, London, W1T 2EW. Registered with the UK Information Commissioner's Office (ICO), registration number ZC176381.
Contact: privacy@fin-central.com (data protection) · legal@fin-central.com (legal) · support@fin-central.com (support).
We provide finance-control software for UK businesses that connects to your accounting system (Xero, QuickBooks, Sage) or imported files.
2. Controller vs processor — an important distinction
Our role under UK GDPR depends on the data:
- We are the controller for the personal data of the people who register and use the service — account holders and their team (name, work email, hashed password, login/audit records, billing contact). This policy governs that data.
- We are a processor for the data you import or sync from your accounting system to run the service. That data can contain personal data belonging to your customers, suppliers and staff (e.g. names on invoices, payees, contact details). For that data your organisation is the controller and we process it only on your instructions, under the Data Processing Addendum (/legal/dpa).
3. Personal data we collect (as controller)
- Account data: name, work email, company name, hashed password, role.
- Usage & security data: log-in history, IP/device/browser metadata, audit records of actions in the app, support correspondence.
- Billing data: plan, billing contact and status. Card payments are handled by our payment processor (Stripe); we never see or store full card numbers.
4. How we use it
To create and secure your account, deliver and support the service, process billing, meet legal/accounting obligations, and improve reliability and safety. We do not sell your personal data or use it for third-party advertising.
5. Legal bases (UK GDPR Article 6)
- Contract — to provide the service you sign up for.
- Legitimate interests — security, fraud prevention, and product improvement (balanced against your rights).
- Legal obligation — accounting, tax and statutory record-keeping.
- Consent — only where separately requested (e.g. optional marketing email), which you can withdraw at any time.
6. Sharing & subprocessors
We share personal data only with vetted subprocessors that help us run the service (hosting, database, email, payments, error monitoring), the accounting connectors you authorise, and — only if you enable AI features — the AI model provider that generates commentary. The current list, with purposes and locations, is at /legal/subprocessors. Accounting connectors are accessed only with your explicit OAuth consent.
7. AI features
Where you use the AI copilot or AI commentary, the relevant figures/context are sent to our configured AI model provider to generate a response. Outputs are clearly labelled AI-generated, are decision-support only, and are not used by us to train third-party models. AI features can be disabled per organisation.
8. Security
Data is encrypted in transit (TLS). Connector credentials and 2FA secrets are encrypted at rest (AES-256-GCM); passwords and 2FA recovery codes are stored only as one-way hashes. To be precise rather than reassuring: other data, including your accounting records and the audit log, is not encrypted by the application itself — it is held in access-controlled database storage, and at-rest protection for it comes from the encryption of the hosting environment and its backups. Access is role-based across five roles, tenant-isolated and audit-logged. We support two-factor authentication and enforce a password policy. We hold no security certification. See our Security overview.
9. Retention
We state exact periods rather than "as long as necessary", and every period below is the period the deletion job actually applies: each one is set in src/lib/retention.ts, and the test suite fails the build if this table and those constants disagree — so this table cannot go on describing a period the product has stopped applying.
Data we process on your behalf, as processor. This is your ledger, and for it you are the controller. You hold your own statutory six-year records in your accounting system, which we do not replace, so we keep a shorter working copy rather than a second six-year archive of records you already have:
| What | Kept for | Why this period |
|---|---|---|
| Audit evidence files and the text extracted from them | 90 days after the engagement closes | The largest and most sensitive holding. Your audit pack is a complete, self-describing ZIP you keep, and your auditor keeps their own copy. Evidence on an open engagement is never deleted, however old |
| Audit log | 13 months | A full audit cycle plus a month of overlap for year-on-year comparison. Entries evidencing an erasure, a data export, an account deletion or a refused export are exempt and never deleted — they are the record that your rights were honoured |
| Bank transactions | 24 months | Recurring-payment detection needs twelve; twenty-four gives a year-on-year comparison |
| Supplier bills and their line items | at least 36 months | Not deleted on a shorter schedule: the three-year supplier-spend comparison depends on them |
| General ledger and trial balance | at least 27 months | Not deleted on a shorter schedule: statutory accounts need prior-year comparatives and the audit pack needs opening balances |
| Vendor lookup cache | 12 months | A cache; a twelve-month-cold entry has no value left |
Data we hold as controller. Your account and billing records: for the life of your subscription and for up to 6 years afterwards, which is the period UK tax and company law requires of us as a business. Marketing enquiries: 24 months from last contact. Password-reset requests, which record the requesting IP address: deleted as soon as the link expires.
Being exact about the 6 years. Marketing enquiries and password-reset requests are removed by the automatic sweep described above. Account and billing records are not: there is no age-based job that deletes them at the end of the six years, and removing them is an action a person performs. We would rather say that than write "then deleted" and let it imply a timer we have not built. What you do not have to wait for is your own request — you can erase your account yourself from Settings, and we delete an organisation's records in full, files included, when asked.
On termination, you may export your data for 30 days; after that we delete it, and deletion means the rows and the underlying files, followed by a storage-reclaim step so the deleted content is no longer readable in the database file.
One honest limit. Database backups taken before a deletion still contain the deleted data until those backups age out on their own schedule. No provider can make an already-written backup forget a row, and we would rather say so than imply deletion is instantaneous everywhere.
The deletion job is run on a schedule by the operator of this deployment; it is not a background timer inside the application, because in a multi-instance deployment that would mean several copies of a delete job racing one another.
10. Your rights
You have the right to access, rectification, erasure, restriction, portability and objection, and to withdraw consent. Email privacy@fin-central.com. If your request concerns data we process on a client's behalf, we will refer you to that client (the controller). You may complain to the ICO — ico.org.uk, 0303 123 1113.
11. International transfers
Where personal data is processed outside the UK/EEA (for example by a subprocessor), we rely on UK adequacy regulations or the UK International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses, with appropriate safeguards.
12. Changes
We will post updates here, increment the version, and adjust the "last updated" date. We will notify you by email of material changes.