Privacy

This notice explains how selected transaction questions and responses are handled.

What is collected

The requester chooses the recipient email, request title, questions and approved source fields: source row number, source ID, date, description, amount and currency. Your browser parses the CSV; the original file and unmapped columns are not uploaded. Client response text, uncertainty choices, submission times and request-bound verification sessions are stored to provide this service. Request, publication and submission times support expiry and truthful response history. Account- and request-bound rate-limit counters prevent abusive collection or code guessing; they are removed after 48 hours. These records are not used for advertising, profiling or transaction content analytics.

Who can see it

The authenticated requester can see the approved rows and submitted responses. A recipient verifies the request’s chosen email before viewing transaction details. Saved client drafts are separate from submitted responses and do not count toward owner progress. A client link alone does not grant access to the data. After a submission, the owner may receive a count-only notification email; it contains no transaction descriptions, amounts, or response text.

Service providers

Firmary operates this service using AWS hosting and encrypted backups. Firmary sign-in processes requester identity and permissions under its sign-in privacy notice, including limited network-address security records. Resend receives recipient email addresses and verification codes, and requester email addresses and count-only notices, to deliver operational email. When the requester uses an AI assistant such as ChatGPT or Claude, the selected tool results are returned to that assistant; the service never sends saved client drafts through those tools.

What to leave out

Only provide information needed to explain the selected transactions. Do not include passwords, login details, one-time verification codes, API keys, government identifiers, full payment card details, or medical information.

Deletion and retention

The requester can delete a request early. Private request drafts are deleted after 7 days without changes and closed request data after 90 days. Saved client drafts are removed after 7 days without a persisted save. Client links expire within 30 days. Codes expire after 10 minutes; challenge records are removed after 24 hours, and verification sessions after expiry. Deleted records may remain in encrypted backups for up to 14 days. Minimal process-error logs rotate within a 50 MB limit per container; they do not include transaction contents or codes. Pages that show a note about Firmary count how often each version of the note is seen and clicked, as a daily total per app, page and version kept by Firmary sign-in. The count contains no cookies, network addresses or anything else that identifies you. Your browser remembers which version it last showed, so the next one differs.

Synthetic demonstration

The local demonstration uses fictional information and a test verification delivery service. It sends no email and is not evidence that a production identity, delivery, backup or retention integration is configured.

Help with your information

Contact the requester shown on the request to ask about the purpose of the questions, retention, correction or early deletion. Read support guidance.