Privacy Policy

This Privacy Policy (the “Policy”) governs how personal data of users of the Finaim platform, available at app.finaim.org (the “Platform”, the “Service”), is obtained, stored, used and disclosed.

The operator of personal data is Limited Liability Company FINAIM (OOO «ФИНЭЙМ»), INN 5300000811, KPP 530001001, OGRN 1215300004842, registered at 8 Pionersky St., Staraya Russa, Novgorod Region, 175204, Russia (the “Operator”), acting in accordance with Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” (“152-FZ”) and other applicable legislation of the Russian Federation.

Legal grounds for processing: the data subject’s consent (art. 6(1)(1) of 152-FZ), performance of a contract to which the data subject is a party (art. 6(1)(5)), and compliance with the Operator’s statutory obligations (art. 6(1)(2)). Databases holding the personal data of Russian citizens are located in the Russian Federation (art. 18(5) of 152-FZ).

Using the Service constitutes unconditional acceptance of this Policy. If you do not agree with its terms, please refrain from using the Service.

While you use the Service, the Operator may collect the following categories of data:

2.1. Data you provide voluntarily

• Email address — used as the account identifier and for correspondence.
• Name — the display name shown on your profile and in the community feed.
• Public handle — a unique profile name in the @username format.
• Portfolios and investment preferences — portfolio holdings, asset weights, privacy settings and your answers to the risk-profiling questionnaire.

2.2. Technical data

• IP address and technical browser parameters — for security and diagnostics.
• Session cookies — to maintain your authenticated session (see section 7).
• Usage data — pages visited and actions taken in the interface (stored in anonymised form).

Personal data is retained for as long as the user's account exists and for 3 years after the account is deleted or after the last activity — unless applicable legislation provides otherwise.

Technical logs are retained for no more than 90 days. Anonymised statistical data may be retained without a time limit.

Once the retention period expires, the data is destroyed or anonymised in the manner set out in the Operator's internal procedures.

To make the Service work, some requests technically pass through external services. All such requests are made without transferring any personal data of users:

• Yahoo Finance (yfinance) — retrieval of equity quotes and company fundamentals. The requests contain no personal data.
• MOEX ISS API (Moscow Exchange) — quotes and price history for Russian securities. The requests are anonymous.
• Clearbit — logos of publicly traded companies, looked up by domain name. The requests contain no personal data.
• Yandex Metrica (YANDEX LLC) — web analytics. It receives the data about a visit listed in section 7.
• Google Fonts — loading of typefaces (Poppins, Raleway, IBM Plex Mono) from Google's CDN. Please refer to the Google privacy policy.

The Operator may disclose data to authorised state bodies upon their request in the cases provided for by the legislation of the Russian Federation.

Under Articles 14–17 of 152-FZ you have the right to:

• Obtain confirmation that your personal data is being processed.
• Access the personal data about you held by the Operator.
• Require that personal data be corrected, blocked or destroyed in the cases provided for by law.
• Withdraw consent to the processing of personal data previously given.
• Appeal against the Operator's actions to the authority responsible for protecting the rights of data subjects (Roskomnadzor).

To exercise rights relating to your personal data, send a request to support@finaim.org. We will consider it within 30 days of receipt.

The Platform uses session cookies required to maintain your authenticated session; they are deleted when you close your browser.

To count visits the Platform uses the web analytics service Yandex Metrica (YANDEX LLC). The service stores persistent cookies in your browser and receives data about a visit: the addresses of the pages viewed, the referring page, information about the browser and the device, and the IP address. This data is used in aggregate, for traffic statistics. We do not use marketing or advertising cookies, and no data is passed to advertising networks.

You can opt out of being counted by installing the Yandex Metrica opt-out add-on.

You can configure cookie settings in your browser. Disabling cookies will make the features that require authentication unusable.

The Operator takes the organisational and technical measures necessary to protect personal data against unauthorised access, alteration, disclosure or destruction. In particular:

• Data is transmitted between the browser and the server over HTTPS.
• Data is stored on secured servers with restricted access.
• Passwords and sensitive identifiers are stored in hashed form.

The Operator may amend this Policy. A new version takes effect from the moment it is published on the Platform. The date of the latest version is stated at the top of this document. Continuing to use the Service after changes are published constitutes acceptance of the new version of the Policy.