Privacy Policy

This Privacy Policy describes how Finch ("Finch", "we", "us", or "our") collects, uses, and shares information when you use our customer engagement platform, websites, and related services (collectively, the "Services").

By using the Services, you agree to the terms of this Privacy Policy. If you do not agree, please discontinue use of the Services.

We collect information you provide directly, information we receive from your use of the Services, and information from third-party integrations you choose to connect.

We use the information we collect to:

• Provide, maintain, secure, and improve the Services.
• Authenticate users, process transactions, and send account and billing communications.
• Route conversations to the right person or AI agent based on your configuration.
• Train and operate the AI features you enable, as further described in Section 4.
• Detect and prevent fraud, abuse, security incidents, and violations of our Terms.
• Respond to support requests and communicate with you about the Services.
• Comply with legal obligations and enforce our agreements.

Finch uses artificial intelligence, including large language models, to power features such as conversation summarization, suggested replies, automated routing, and AI agents that resolve conversations on your behalf.

Customer content is processed by our AI systems only to deliver the feature you have configured. We do not use your customer content to train shared or third-party models. AI agents operate within the permissions, channels, and guardrails you define for your workspace.

You can disable AI features at any time from your workspace settings. When disabled, AI processing stops immediately for new conversations, and previously generated outputs remain visible as part of your conversation history.

We do not sell personal information. We share information only in the following limited circumstances:

• Service providers. Vendors that help us operate the Services, such as cloud hosting, email delivery, payment processing, and customer support tooling. These providers are bound by confidentiality and data protection obligations.
• Your instructions. When you configure the Services to send data to a third-party integration (for example, a CRM, helpdesk, or messaging channel), we share data as instructed by you.
• Legal and safety. Where we believe in good faith that disclosure is necessary to comply with a law, valid legal process, or government request, or to protect the safety, rights, or property of Finch, our users, or others.
• Business transfers. In connection with a merger, acquisition, financing, or sale of assets, in which case we will notify you of any change in control or this Privacy Policy.
• With your consent. In any other case where you have given us permission to share information.

We protect your information with administrative, technical, and physical safeguards designed for cloud-native SaaS, including encryption in transit (TLS 1.2+) and at rest (AES-256), logical access controls, network isolation, and continuous monitoring.

Each customer workspace is logically isolated. Only authorized members of your organization and the small set of Finch personnel with a documented business need may access customer content, and such access is logged and audited.

No system is perfectly secure. If we become aware of a security incident affecting your information, we will notify you without undue delay in accordance with applicable law.

We retain customer content for as long as your account is active or as needed to provide the Services. You can delete messages, conversations, or entire workspaces at any time.

When you delete customer content, we remove it from active systems within 30 days and from backups within a further 90 days, except where retention is required to comply with legal, tax, or audit obligations.

Depending on your location, you may have rights to access, correct, port, or delete your personal information, or to object to or restrict certain processing. You can exercise many of these rights directly from your workspace settings.

If you are an end customer of a Finch customer (for example, a person who sent a message to a team using Finch), please contact that organization directly to exercise your rights. We will assist the organization in responding to verified requests as required by law.

You may also contact us using the details in Section 13 to make a request. We respond to verified requests within the timeframes required by applicable law.

Finch is headquartered in the United States and uses cloud infrastructure in multiple regions. When we transfer personal information across borders, we rely on appropriate safeguards such as Standard Contractual Clauses, data processing agreements, and equivalent legal mechanisms.

You can request a copy of the transfer safeguards applicable to your data by contacting us at the address below.

The Services may contain links to or integrations with third-party products that we do not control. This Privacy Policy does not apply to those third parties. We encourage you to read the privacy notices of any third-party services you connect to Finch.

The Services are intended for use by businesses and are not directed to children under 16. We do not knowingly collect personal information from children under 16. If you believe we have collected such information, please contact us so we can delete it.

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. If the changes are material, we will provide additional notice, such as an email or an in-product notification, before the changes take effect.

If you have questions about this Privacy Policy or our data practices, please contact us at [email protected] or via our contact page.