Privacy Notice

This notice explains how personal data is handled when you use Zeno FinLab at zeno-fin.com. Zeno FinLab is an independent financial education, planning and analytical toolkit operated by its proprietor. Zeno FinLab is a trading/project name and does not constitute a separate legal entity.

For support, privacy requests and service enquiries: support@zeno-fin.com.

What happens to the figures you enter

If you are not signed in: income, spending, asset, liability and personal-financial-statement details you type into the toolkit stay in your browser. They are not written to the hosted database, and clearing your browser storage removes them.

If you are signed in: so that your figures follow you between devices, the toolkit saves your latest healthcheck figures and savings goal to your account in our hosted database. Access is restricted to your own signed-in account. You can clear them by removing the figures in the tool, and you can ask us to delete your account and its data at any time.

AI analysis: nothing is sent to our AI provider until you explicitly request an AI feature. At that point only the figures needed for that analysis are transmitted. Property-estimate requests can include country, city, area, property details and figures. Your account name and contact address are not included. Google Gemini processes Healthcheck, Plus and property-estimate requests through Lovable’s AI gateway; Panorama intelligence uses an OpenAI model through that gateway and can include your question. AI usage records include account ID, feature, time, outcome and usage units—not prompts, responses or financial values.

Advertising: your financial figures are never shared with advertising or analytics providers, and are not used to build an advertising profile.

Categories of personal data and purposes

• Financial figures you enter (and optional holder name, address, city, country and statement purpose) — to compute your assessment and generate the PDF report or personal financial statement. Legal basis: performance of a contract / your request.
• Purchase data (name, email, billing address, tax identifiers, payment method details) — collected and processed by Paddle as Merchant of Record to complete your purchase, issue invoices and handle tax. Legal basis: contract performance and legal obligation.
• Technical and usage data (IP address, device and browser type, pages viewed, error diagnostics) — to operate, secure and improve the Service and to prevent fraud and abuse. Legal basis: legitimate interests.
• Support messages you send us — to answer your query. Legal basis: legitimate interests.

Who we share data with

• Paddle.com Market Ltd — our Merchant of Record and reseller, for the sale of the report, payment processing, invoicing, tax compliance and buyer support.
• Service providers / subprocessors — hosting, content delivery, error monitoring and the AI provider used to produce insights and indicative property estimates.
• Professional advisers — legal and accounting advisers where necessary.
• Authorities — where disclosure is required by law.

International transfers

Some providers process data outside the EEA/UK. Where that happens we rely on adequacy decisions or on Standard Contractual Clauses with appropriate supplementary measures.

Children

This Service is not intended for users under 18.

Retention

Figures held in your browser remain until you clear them or clear your browser storage. Figures saved to an account remain until you overwrite or clear them, or until account deletion completes. A deletion request currently has a 30-day cancellation period; the request itself does not prove final deletion has completed. Paddle retains purchase and invoicing records as required for payment, tax and accounting duties. Other data should be deleted or anonymised when no longer needed for its stated purpose.

Your rights

Subject to applicable law (including the GDPR), you may request access, rectification, erasure, restriction of processing, portability, and object to processing based on legitimate interests; where processing rests on consent you may withdraw it at any time. We respond within one month. You may also lodge a complaint with your local supervisory authority (in Cyprus, the Office of the Commissioner for Personal Data Protection).

Security

We apply appropriate technical and organisational measures, including encryption in transit (HTTPS), access controls and least-privilege handling of credentials. Figures saved to an account are stored in a hosted database with access rules restricting each record to the account that created it.

Cookies and advertising

Essential storage: your cookie choice, your sign-in session, a local record of purchases made on this device, and cookies set by Paddle during checkout to process your payment securely. AdSense is disabled in every region: no script loads or advertising requests are made until a Google-certified CMP and required TCF integration have been verified. This custom consent control is not a certified CMP. Neither acceptance nor “Only essential” enables ads. Your financial figures are never passed to advertising providers. You can change, withdraw or reset optional analytics consent on the cookies page.

Google Analytics: If you choose “Accept all”, Google Analytics may set analytics cookies to help us understand aggregate website usage and improve Zeno Fin. We do not send financial figures, tax inputs, uploaded-file contents, AI prompts or report contents to Google Analytics. Google processes sanitized page URLs and referrers, permitted UTM campaign labels, event/tool names, its analytics identifiers and technical request data such as IP address and browser details for usage measurement, not enabled advertising optimization. Arbitrary URL queries and hashes are removed; referrer queries and hashes are removed. Google advertising storage, ad-user-data and ad-personalisation signals stay denied. If you choose “Only essential”, Google Analytics does not load and analytics cookies are not set.

First-party activity measurement: We record which Zeno pages and tools are opened or used, and an estimate of active time on tool pages, in our hosted service only after analytics acceptance, including for signed-in users. This never includes figures, form values, uploaded files, AI prompts or report contents. If you choose “Accept all”, your browser stores a randomly generated visitor ID (no name, email or other personal details) so we can recognise repeat visits. If you choose “Only essential”, no visitor ID is created and any existing one is removed. While you are signed in, activity is linked to your account. If you later sign up or sign in on a browser with a visitor ID, earlier activity from that browser is linked to your account, which makes it personal data. Zeno does not use IP addresses or device fingerprinting for this purpose, and this first-party activity data and the visitor ID are not sent to Google or other third parties other than our hosting service for processing. Sign-in alone does not grant analytics consent.

Consent records retain a device reference, decision times, the notice version/text and separate purpose choices; withdrawal preserves prior acceptance evidence. Withdrawal stops new optional measurement across open tabs, disables Google measurement and removes accessible consent-dependent cookies and the visitor ID where technically possible, without deleting essential session or tool data. Third-party and HttpOnly cookies require browser controls. Withdrawal does not recall previously sent data or delete earlier linked activity; contact us for deletion requests. This technical fallback is not a legal-compliance or Google-approval certification.

Contact

Service enquiries, privacy requests, technical support and other questions relating to the website: support@zeno-fin.com. Billing, invoice and refund questions can also be handled by Paddle at paddle.net.