Legal

Privacy Policy

Last updated: 2 October 2026

1. Who we are

Fynmerge Ltd (“Fynmerge”, “we”, “us”) is a company registered in England and Wales. We operate the Fynmerge financial management platform available at www.fynmerge.com.

2. What data we collect

We collect the following categories of personal data:

  • Account data — name, email address, and password (stored hashed).
  • Business data — company name, VAT number, UTR, and fiscal year settings you provide during onboarding.
  • Financial data — invoices, contacts, and cash flow figures you enter or that are synced from your connected accounting tools.
  • Bank data — read-only account, balance and transaction data retrieved via Open Banking (regulated under the Payment Services Regulations 2017). We never see or store your bank login credentials.
  • Technical data — technical data (such as IP address, browser type and error logs) generated by our hosting providers.

3. Where your data comes from

  • You — when you sign up, use the platform, or contact us.
  • Your bank — via TrueLayer, when you choose to connect a bank account.
  • Your accounting software — via Apideck, when you choose to connect Xero, QuickBooks, FreeAgent or Sage.
  • Other services you connect — for example HMRC, Codat or GoCardless, if you choose to connect them (see section 9).

4. How we use your data

We use your data to:

  • Provide and improve the Fynmerge platform.
  • Calculate cash flow projections, tax pot recommendations, and deadline alerts.
  • Send transactional emails (invoice reminders, payment alerts, tax deadline notifications).
  • Comply with our legal obligations under UK data protection law.

We do not sell your data or use it for advertising.

5. Legal basis for processing

We process your data on the basis of contract performance (delivering the service you signed up for), legitimate interests (improving the product and preventing fraud), and legal obligation (complying with UK tax and financial regulations).

6. Your customers' data

When you add details of your own customers to Fynmerge (for example on invoices and payment reminders), we process that data on your behalf as your processor. You remain responsible for having a lawful basis to share it with us.

7. Automated decision-making

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

8. Data retention

We retain your account data for the duration of your subscription and for 90 days after cancellation. It is then deleted, except records we must keep to meet our own legal obligations (for example billing records). You are responsible for keeping your own business records for as long as HMRC requires — please export them before closing your account.

9. Who we share data with

We use the following providers to deliver the service:

  • Supabase — authentication and database hosting (London region).
  • Vercel — hosting of our website and web application.
  • Render — hosting of our API servers.
  • Resend — delivery of transactional emails, including invoice reminders sent to your customers on your behalf.
  • Stripe — creating payment links on your invoices. When your customer pays, Stripe processes the payment under its own terms and privacy policy.
  • Apideck — retrieving data from your accounting software when you connect Xero, QuickBooks, FreeAgent or Sage.
  • Codat — if you use Codat to connect your accounting software, retrieving your accounting data.
  • GoCardless — if you connect your GoCardless account, retrieving read-only payment, payout, mandate and customer data.
  • Google Fonts — our pages load fonts from Google's servers, so your browser shares your IP address with Google when you visit.

TrueLayer is an independent FCA-authorised provider that retrieves your bank data with your consent. TrueLayer's own privacy policy applies to its processing.

HMRC — if you connect your HMRC account through Making Tax Digital, we retrieve your VAT obligations and deadlines from HMRC and send HMRC any VAT return you choose to submit through Fynmerge.

10. International transfers

Some of our providers (for example Vercel, Resend, Stripe and Google) process data in the United States. Where data is transferred outside the UK we rely on appropriate safeguards such as the UK–US data bridge or the UK International Data Transfer Addendum.

11. Cookies

We use only strictly necessary cookies and browser storage (to keep you signed in and to remember whether you are viewing demo data), and no analytics, advertising or marketing cookies. See our Cookie Policy for details.

12. Your rights

Under UK GDPR you have the right to:

  • Access a copy of your personal data.
  • Correct inaccurate data.
  • Delete your data (“right to be forgotten”), subject to legal retention obligations.
  • Restrict or object to processing.
  • Data portability — export your data in a machine-readable format.

To exercise any of these rights, email us at contact@fynmerge.com.

You also have the right to complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113). We'd appreciate the chance to deal with your concerns first.

13. Contact

For privacy questions, contact us at contact@fynmerge.com.