Privacy policy

Last updated October 21, 2026

Finance HQ is a private, internal bookkeeping tool operated by Myndy for the companies in its group. It is not offered to the public. This policy explains what Finance HQ collects, how it is used, and how it can be removed.

What Finance HQ keeps

• Bank and card statements that a company uploads, and the transactions in them. Only the last 4 digits of an account or card are kept.
• Invoices, receipts and bills that are uploaded or found in a connected company mailbox, and what they say (vendor, date, total, tax, currency, invoice number).
• The books built from these: entries, month-end, and amounts owed between people and companies in the group.
• For each connected mailbox: its address and an encrypted permission token from Google.

Google account data (Gmail)

A company can connect its own Google Workspace mailbox. Finance HQ then asks Google for one permission only: read-only access to Gmail (https://www.googleapis.com/auth/gmail.readonly). It never sends, deletes, moves or labels email, and asks for nothing else in the Google account.

• What is read: messages received from January 1, 2025, to find bills, invoices and receipts sent to that company.
• What is kept: for a bill, invoice or receipt: the attached PDF or image (or the email text when there is no attachment), the sender, the subject and the date, and what the bill says. For every other message: only Gmail's internal message number, so it is not looked at twice. The content of other messages is not kept.
• How it is used: only to keep that company's books: to attach each bill to the matching charge on the company's statements, and to show it to the company's finance staff and accountant.
• Who it is shared with: nobody, except to read a bill automatically: the bill is sent to Anthropic's API, which reads it and returns the vendor, date and amounts. Anthropic acts as a service provider and does not use this data to train its models. Gmail data is never sold, never used for advertising, and never used to train AI or machine-learning models.
• Who can see it: only the group's signed-in finance staff. No person reads mail other than the bills found.

Finance HQ's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How it is protected

• All screens need sign-in. Stored files open only through links that expire after 5 minutes.
• Mailbox permission tokens are encrypted (AES-256-GCM). Traffic is encrypted in transit (HTTPS).
• The database is not reachable from the public internet without credentials, and every table has row-level security.

How long it is kept, and how to remove it

• Bills, invoices, receipts and statements are financial records and are kept for 7 years.
• Disconnecting a mailbox (Finance HQ → Email bills → Disconnect) deletes its permission token at once; reading stops.
• Access can also be removed from the Google side at any time: myaccount.google.com/permissions, or by the company's Google Workspace admin.
• To ask for data to be removed sooner (for example a message kept by mistake), contact us below.

Contact

Questions about this policy or your data: write to the contact email shown on Finance HQ's Google sign-in screen.

Changes to this policy are posted on this page with a new date. Finance HQ home