Privacy Policy

Who controls your data

Wadalyon Ltd (company number 16734023), which operates Finalit, is the data controller for the personal data described here. Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ. Contact: privacy@finalit.ai.

What we collect

• Account data. Your name and email address, from Google sign-in or a six-digit code sent to your email.
• Your work. The content you put into Finalit, saved to your account as you write it, whether or not you ever ask for a prediction; the context you add to it (details you type, text you paste, the text read from files you upload or import from a connected account, and links); earlier versions of your work so you can go back to them; and the predictions and suggested changes Finalit produces. It is kept because Finalit is where the work lives: your work, desks and the versions you can go back to are the product. Nobody reads your work and nothing learns from it. Not us, not a model, not now and not later, and not “anonymised” either. Three exceptions, and they are the ones you would want: you asked us for help with something you submitted, someone reported it, or the law compelled it. Never as a matter of course.
• Your desks. The context you give Finalit so it can predict properly: what the work is, who it is for, the constraints that always apply. Desks are yours to write, so please keep what you put in them proportionate, particularly where it describes someone else.
• Your Lenses. The Lenses you create: the person, or people, a prediction is made through. If you publish a Lens, its name, description and your display name and photo are shown publicly. Its instructions stay private to you.
• The record of Finalit’s predictions. Every prediction is logged as a call: when it was made, which Lens it was made through, the state it reached, and the sentence Finalit gave you about what your reader would do. Later, whether you accepted or overruled it, anything you tell us about how your work actually landed, and any rating or note you leave on a prediction to tell us it got something wrong. These records hold Finalit’s words about your work, never your work itself.
• Building a Lens from your documents. If you give Finalit documents you have written so it can build a Lens from them, they are read once, in memory, to write that Lens, and never stored: not in a database, not in a file, not in a log. To help Finalit get better at predicting outcomes for that kind of content, we keep only its shape, as a handful of short category labels: the kind of document (“cover letter”), the kind of reader (“hiring manager”), what was at stake, and the problems that recur. No sentence, name, company, figure or date from your documents is ever kept, and nothing kept can reconstruct a word you wrote. Every label is checked on our servers before it is saved, and anything that could identify a person or a document is thrown away. This is switched on by default, and you can switch it off at any time in Settings, under “Improve Finalit with anonymised writing patterns”. With it off, nothing at all is kept.
• Connected accounts. If you connect Google Drive or Notion, we store an access token so Finalit can fetch the documents you choose. We read what you select, not your whole drive.
• Usage data. Product analytics events (for example, that a prediction was run), plus basic device, browser and log information.
• Billing data. Your plan status and the identifiers our payment processor gives us. Card details are handled entirely by the processor; we never see or store your full card number.

Why we use it, and our lawful basis

• To provide the service you asked for: performance of our contract with you.
• To keep a record of the predictions we give you, so both of us can see whether Finalit was right: performance of our contract, and our legitimate interest in a service that can be held to what it says.
• To keep Finalit secure, working and free from abuse: our legitimate interests.
• To take payment and keep financial records: contract and legal obligation.
• To understand and improve the product through analytics, and through the anonymised pattern categories described below, which you can switch off at any time: our legitimate interests, and your consent where the law requires it.

Where we rely on consent, you can withdraw it at any time.

We do not train on your content

Your work is processed to give you a result, and that is all. We do not use your content to train AI models, we do not sell your personal data or your content, and we do not share your work with anyone except the providers listed below who process them on our behalf to produce your result. Our infrastructure providers are contractually prohibited from training on anything sent through them.

Google user data

If you connect Google Drive, Finalit asks for the narrowest access that does the job: the drive.filescope, which reads only the documents you pick yourself in Google’s own file picker. Finalit cannot list, search or open anything else in your Drive, and it never sees a file you did not choose.

Finalit’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In plain terms: what Finalit reads from a document you chose is used to give you the result you asked for, and nothing else. It is not sold, not used for advertising, not used to train AI models, and not read by a person except in the three cases named above.

You can withdraw Finalit’s access to your Google account whenever you like: in Settings under Connections, or from Google directly at myaccount.google.com/permissions. Revoking access stops Finalit reading anything further; it does not delete work you already imported, which you delete in Finalit like anything else you have submitted.

How Finalit gets better, and what that uses

Finalit does improve with use, and it is worth being exact about what that means, because the honest answer is narrower than people expect. What improves it is the record described above: what it predicted, what you did about it, and how your work landed. That record holds predictions, categories and outcomes. It does not hold your prose, so your prose is not what makes Finalit better.

The one exception is narrow and in your control. When you build a Lens from documents you have written, the category labels described above are used to improve how Finalit predicts outcomes for that kind of content, for everyone. They never include your words, they are kept apart from your work and deleted with your account, and they are never sold or shared. It is on by default, and one switch in Settings (“Improve Finalit with anonymised writing patterns”) turns it off for good, for every future import. Your work is never part of it, on or off.

Teams

On a team plan, a desk and a Lens can be shared, so colleagues get predictions on their work with the same context and through the same Lens. Your work is never shared by a team plan. An administrator cannot read a colleague’s content, their predictions or their record through Finalit. Anything a team sees about how the team is doing is aggregated, and never traces back to one person’s work.

Who processes your data

We use a small number of trusted providers to run Finalit: hosting, database and authentication, email, payments, analytics, and the model infrastructure our predictions are computed on. The current list, including what each one does and where it processes data, is on the Subprocessors page. Some process data outside the UK; where they do, we rely on appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

How long we keep it

We keep your account, your work, your desks and your Lenses while your account is active, so your work is there when you come back. You can delete any of them at any time.

One exception is worth stating plainly. Deleting a piece of work does not delete the record of the prediction Finalit made about it. That record contains no part of your content, and it is what lets us tell whether Finalit was right rather than quietly forgetting the times it was wrong. Deleting your account deletes those records along with everything else. We keep limited data we are legally required to retain, such as billing records for tax purposes, and backups are cleared on a rolling basis.

Your rights

Under UK GDPR you can access, correct, delete, export or restrict processing of your personal data, and object to processing we base on legitimate interests. Email privacy@finalit.ai and we’ll respond within one month. You can also complain to the UK Information Commissioner’s Office at ico.org.uk, though we’d rather you gave us the chance to put it right first.

Security

Your data is encrypted in transit and at rest, and your work is private to your account unless you choose to share them. Our team does not browse your content: we access it only when needed to provide support you’ve asked for, to investigate abuse or enforce our terms, or where the law requires it. No service can promise perfect security, and we don’t.

Children

Finalit isn’t intended for children under 16, and we don’t knowingly collect their personal data. If you believe a child has given us data, tell us and we’ll delete it.

Changes

We’ll post updates here with a new date, and tell you directly about material changes.