Finozio only collects what is useful for authentication, cloud management, and the client relationship. This page formalizes that approach.
Data controller
FINOZIO SAS, 47 rue Vivienne, 75002 Paris, France, RCS Paris 109 096 388, reachable at contact@finozio.com, is the data controller for account, billing, free scan, quote request and appointment data, and for audience measurement. For the Azure and Microsoft 365 data the platform reads in a client's tenant, including data about the users in its organization, that client remains the controller: FINOZIO SAS acts as a processor (GDPR Art. 28), on its instructions, to provide the service. See the legal notice
Data collected
Identification data: first name, last name, email address and company name, to access the platform or request a free scan or a quote; email address only, to receive the February 1, 2027 Azure deadline reminder
Technical data: IP address, stored in clear in the audit log of sensitive actions; IP address and browser identification, hashed, in the records of your cookie choices; technical logs of our hosting providers
Activity history, recommendations and exports, for client follow-up
Conversations with the AI assistant: questions asked and answers
Billing data: handled by Stripe (we do not store card numbers)
Azure usage data: costs, inventories, metrics, budgets defined in Azure (name, amount, period, spend and forecast as evaluated by Azure, scope — never the recipients of their alerts), and the FinOps indicators derived from them for dashboards, reports and alerts
Your organization's Microsoft 365 data, from Audit Spring, for each licensed user: Microsoft Entra identifier, email address and user principal name (UPN), display name, assigned licenses, account status (enabled or disabled), account creation date and last sign-in date; for Copilot license holders, Microsoft 365 Copilot activity (last use date, overall and per application: Copilot Chat, Teams, Word, Excel, PowerPoint, Outlook, OneNote, Loop), from Microsoft's activity report, which names each user unless your tenant hides user names in its reports
Additional Microsoft 365 data read with Pilot, Scale Up and Custom, per user: job title, department, account type (member or guest) and license assignment method (direct or group-based); usage of each application over 90 days from Microsoft's activity reports (Teams, Exchange, OneDrive, SharePoint, Yammer, Word, Excel, PowerPoint, Outlook, OneNote) and last activity date; shared mailboxes, with their size and whether they have an archive (Microsoft's report covers every mailbox; only licensed shared mailboxes are kept); with Custom, to track joiners, movers and leavers: creation date of each licensed account, deletion date of the accounts deleted since the previous scan, department and job title of each licensed account kept from one scan to the next to compare them (former and new position, date the change was seen), and, for an account that changes position, the name and membership rule of the groups that assign its licenses. These reports name each user, unless your tenant hides user names in its reports
Prospecting data: job title, Azure tenant and subscription IDs, declared Azure spend and message (free scans, quote requests)
Security data: Azure connection secrets (paid plans, and the free monthly report if you ask for it) and OAuth tokens, stored encrypted; two-factor authentication backup codes, stored hashed; enterprise single sign-on (SSO) sessions, in which the email address is hashed
Free scan PDF reports
Records of your cookie choices: choice made, date, version of the accepted text, hashed IP address and browser identification
History of notifications sent: recipient, subject, channel and delivery result
LinkedIn campaign measurement data (public pages, with your consent): address and title of the pages viewed, clicks on links and buttons (label and destination), IP address, device and browser characteristics, timestamp, identifier in the li_fat_id cookie that the LinkedIn tag sets on our domain
Identification data of the company visiting the website (Apollo, public pages, with your consent): address of the pages viewed, referrer and campaign parameters on arrival, IP address, browser and device characteristics, timestamp, random apolloAnonId identifier kept in your browser
Audience measurement data (public pages, with your consent): pages viewed, referrer, interactions, device type, approximate location, pseudonymous identifier in the _ga cookies
Purposes and legal bases (GDPR Art. 6)
Performance of the contract (GDPR Art. 6(1)(b)): account management and authentication; provision of the subscribed plan, including reading Azure and Microsoft 365 data, recommendations, reports, alerts and notifications, and conversations with the AI assistant; billing
Pre-contractual steps taken at your request (GDPR Art. 6(1)(b)): appointment booking (Microsoft Bookings calendar, shown at your request in our pages or opened in a new tab), running a free scan and sending its report, answering a quote request
Legitimate interest (GDPR Art. 6(1)(f)): service security, fraud prevention and audit logs; the automatic qualification score of Azure free scans, conversion statistics, sales follow-up about a free scan and sales follow-up of prospects (contact name and email, company, notes, kept 3 years without activity on the file), which you can object to at any time by writing to contact@finozio.com
Legal obligation (GDPR Art. 6(1)(c)): retention of billing data
Consent (GDPR Art. 6(1)(a)): audience measurement cookies, LinkedIn advertising campaign measurement, identification of the company visiting the website (Apollo), free monthly report (a new scan every month, with the Azure access you choose to entrust to us; consent withdrawn at any time through the stop link in each e-mail), February 1, 2027 Azure deadline reminder (a confirmation, then a reminder on January 4, 2027; consent withdrawn at any time through the link in each e-mail) and marketing communications
Automated decisions and profiling (GDPR Art. 22)
Each Azure free scan receives an automatic qualification score, calculated from the monthly Azure spend, the share of orphaned resources, the share of untagged resources and the number of Azure resources scanned. This score is used to rank requests for sales follow-up: it produces no legal effect concerning you and does not similarly significantly affect you. You can write to contact@finozio.com for an explanation of this score.
Retention periods
Account data: for as long as the account exists, including after a paid plan ends (the account reverts to the free plan); erased 7 days after a deletion request; a free-plan account that has never paid anything and has not been signed in to for 3 years is deleted with its data, after two warning e-mails sent 30 and then 7 days before (signing in is enough to keep it), then erased 7 days after its deletion; an account whose last sign-in is unknown is never deleted this way
Records of your acceptance of the terms of use and the privacy policy (accepted version, date, fingerprints of the IP address and browser): for as long as the account exists, then 5 years after its deletion (limitation period), with the email address replaced by its fingerprint
Azure data: for as long as the account exists, including after a paid plan ends; erased with it
Microsoft 365 scan results (personal data of the users in your organization: licenses, sign-ins, application usage, Copilot activity): a rolling 13 months from each scan, then deleted automatically every night; the most recent scan result of each client is kept beyond that, so that the latest audit remains available; 90 days after the client's access to an offer that includes Microsoft 365 ends (a Pilot not bought again, the end of Scale Up or Custom access, a refund), all of its scan results are deleted, unless it buys such an offer again before then — the reminders sent 30 and 7 days before access ends give the date; all are erased with the account
Audit log of sensitive actions (with IP address): 2 years, including each time a Finozio super administrator opens your account (who, when, IP address)
Conversations with the AI assistant: 1 year
Points kept by the AI assistant from your conversations: 1 year without update
Invitations to join a workspace (invitee's email address, role, dates): 90 days after they close (acceptance, revocation, refusal or expiry)
Sales follow-up of prospects by our team (contact name and email, company, notes): 3 years without activity on the file, then deleted automatically; a file linked to a client is kept for as long as that client exists, and erased with its account
Enterprise single sign-on (SSO) sessions: 30 days
History of notifications sent: 90 days
Free scan requests (Azure and Microsoft 365) — contact details, tenant ID (and subscription ID for Azure), results and PDF report: 90 days; the email address is kept for 2 years in our conversion statistics
Free monthly report, if you ask for it during the free scan — contact details, tenant, subscription and application IDs, encrypted connection secret, dates and amounts of the reports sent: while the report is active, 12 reports at most; when it stops (your stop link, purchase of a plan, deletion of the account, access refused by Azure, or the last report), the secret and application ID are deleted immediately, the rest 90 days later
February 1, 2027 Azure deadline reminder, if you ask for it — email address, language, date and version of your consent, sending date: until March 1, 2027 at the latest; an address erased through the link in each e-mail receives nothing more and is deleted 90 days later, by March 1, 2027 at the latest
Quote requests: 3 years
Records of your cookie choices: 13 months (CNIL recommendation); a record linked to an account: 3 years from collection, erased with the account when the 7-day period ends
Audience measurement (Google Analytics): cookies for up to 13 months; detailed data kept by Google for up to 14 months
LinkedIn campaign measurement: li_fat_id cookie for up to 30 days; at LinkedIn, direct identifiers removed within 7 days and pseudonymised data deleted within 180 days, according to LinkedIn
Identification of the company visiting the website (Apollo): apolloAnonId identifier kept in your browser for as long as your consent is valid (up to 13 months), and erased when you withdraw it; Apollo's answer on whether it may measure your visit: 24 hours; at Apollo, retention set by Apollo (Apollo privacy policy)
Billing data: at least 10 years (legal obligation); invoices are kept by Stripe
Technical logs of our hosting providers: retention set by those providers
Database backups: 30 days, plus one monthly copy kept for 1 year; erased data disappears from backups when these periods expire
Recipients: sub-processors and third parties
Supabase Pte. Ltd. (Singapore company, servers in Paris, France (EU)) — database and authentication; data: all data stored by the platform; transfer basis: standard contractual clauses (SCCs) of Supabase's data processing agreement, for any access from outside the EU
Railway Corporation (US company, servers in Amsterdam, Netherlands (EU)) — hosting of the website and platform (interface and application server); data: all data passing through the website and platform, technical logs; transfer basis: EU–US Data Privacy Framework, SCCs as a fallback
Cloudflare (United States) — DNS, proxy and protection of the website and the platform (www.finozio.com, app.finozio.com and api.finozio.com), CAPTCHA at sign-up, sign-in and password reset; data: IP address, request headers, technical browser signals and, because all traffic goes through its network, the content of pages and of exchanges with the platform, which Cloudflare decrypts to relay them and re-encrypts towards our servers; transfer basis: EU–US Data Privacy Framework, SCCs as a fallback
Stripe (United States) — payments, PCI DSS certified; data: email address, billing name and address, VAT number, plan purchased and internal identifier of your workspace; the card is entered on Stripe's payment page and never goes through Finozio; transfer basis: SCCs
Resend (US company, emails sent from Ireland (EU)) — transactional emails; data: recipient's email address and email content (for example cost alerts, invitations, reminders, a free scan's PDF report as an attachment); transfer basis: EU–US Data Privacy Framework, SCCs as a fallback
Microsoft (EU and international) — Azure Resource Manager and Microsoft Graph APIs for inventory, costs, and Microsoft 365 licenses and usage, Microsoft Bookings for appointment scheduling, Microsoft 365 for Finozio's email: the contact@finozio.com mailbox is hosted there, and Microsoft Azure (France Central region) for the off-site copy of the database backups; data: Azure and Microsoft 365 tenant metadata, user directory and licenses, per-user Copilot activity reports (from Audit Spring) and per-user application usage reports (from Pilot), booking contact details, emails exchanged with Finozio (requests, exports sent at your request), database backups, encrypted before upload with a key Microsoft does not hold; transfer basis: Microsoft's data processing agreement (DPA)
Anthropic Ireland, Limited (Ireland, contracting party; processing in the United States) — Aurora AI assistant, via the Claude API, from the Pilot plan: conversations, recommendation assessments, weekly summaries and the readings on the Insights and Microsoft 365 pages; data: conversation content (questions, answers and the context entered to assess a recommendation), the client's name and plan, aggregated Azure costs (total, per service, per resource group and per subscription, with its name or, failing that, its identifier), cost forecast, recommendations, name, type, resource group, region, SKU and state of unused resources, name, size and usage metrics of virtual machines, and, for Microsoft 365, aggregated counts and amounts, with no per-user data; never resource tags or connection secrets; nothing is sent for the Free and Audit Spring plans, nor for free scans; transfer basis: SCCs (Modules 2 and 3) in Anthropic's data processing agreement, which prohibits training its models on this data and deletes it within 30 days
Functional Software, Inc., publisher of Sentry (US company, servers in Frankfurt, Germany (EU)) — monitoring of the service's technical errors; data: technical error traces, cleaned before sending: request bodies, secrets, email addresses, cookies and IP addresses are removed from them, and Sentry stores no IP address; transfer basis: EU–US Data Privacy Framework, supplemented by the standard contractual clauses (SCCs) of Sentry's data processing agreement, for any access from outside the EU
Google (United States) — Google Analytics audience measurement on the public website pages and on the sign-up and plan selection pages, only with your consent; data: pages viewed (address and title), referrer, journey, interactions (scrolling, clicks to other sites, downloads, forms — without their content), device and browser type, approximate location derived from the IP address, pseudonymous identifier stored in the _ga cookies; Google advertising and Google Signals disabled; transfer basis: EU–US Data Privacy Framework, supplemented by SCCs
LinkedIn Ireland Unlimited Company (Ireland) — measurement of LinkedIn advertising campaigns through the LinkedIn Insight Tag, on the public website pages, only with your consent to the “Advertising” category; data: address and title of the pages viewed, clicks on links and buttons (label and destination), IP address, device and browser characteristics, timestamp, identifier in the li_fat_id cookie; Finozio and LinkedIn are joint controllers for the collection and transmission of this data from our site (CJEU, Fashion ID, C-40/17); LinkedIn then processes it to provide us with campaign statistics that identify no one, and for its own advertising purposes, for which it alone is responsible (LinkedIn privacy policy: linkedin.com/legal/privacy-policy (opens in a new tab)); for the latter, exercise your rights with LinkedIn, or write to us at contact@finozio.com and we will pass your request on; possible transfer to LinkedIn Corporation, in the United States; transfer basis: SCCs
ZenLeads, Inc., doing business as Apollo.io (United States) — identification of the company visiting the website, on the public website pages only, only with your consent to the “Prospecting” category; data: address of the pages viewed, referrer and campaign parameters (utm) on arrival, IP address, browser and device characteristics, timestamp, random apolloAnonId identifier kept in your browser's local storage; Apollo matches the IP address against its company database to tell Finozio which company visited the website: Finozio has configured identification at company level, and no identification of the person (email address, even hashed) is requested; Apollo acts on Finozio's behalf (Apollo's data processing agreement) and remains solely responsible for its own database (Apollo privacy policy: apollo.io/privacy-policy); transfer basis: EU–US Data Privacy Framework, supplemented by the standard contractual clauses (SCCs) of Apollo's data processing agreement
Transfers outside the European Union
Some sub-processors and third parties operate in the United States: Cloudflare, Stripe, Resend, Anthropic, Google, Apollo (ZenLeads, Inc.) and LinkedIn (LinkedIn Ireland Unlimited Company, in Ireland, may transfer the data to LinkedIn Corporation, in the United States). Railway Corporation hosts the website and platform on servers located in the EU (Amsterdam, Netherlands), but remains a US company. Functional Software, Inc. (Sentry) hosts error traces on servers located in the EU (Frankfurt, Germany), but remains a US company. Supabase Pte. Ltd. hosts the database and authentication on servers located in the EU (Paris, France), but remains a Singapore company. Microsoft operates in the EU and internationally. Transfers are governed by standard contractual clauses (SCCs) approved by the European Commission — for Supabase, Sentry and LinkedIn, those of their data processing agreement —, by Microsoft's data processing agreement (DPA) or, for Google, Sentry and Apollo, by the EU–US Data Privacy Framework supplemented by SCCs; for Railway, Cloudflare and Resend, by the same framework, with SCCs as a fallback. Anthropic Ireland, Limited, the contracting party in Ireland, has the data processed in the United States under the SCCs (Modules 2 and 3) of its data processing agreement.
Cookies
Finozio uses strictly necessary cookies (session, authentication, language and theme preferences, remembering your cookie choice, shared by www.finozio.com and app.finozio.com). With your prior consent, valid for 13 months, three categories of trackers are also used, which you accept or refuse separately. Audience measurement, on the public website pages and on the application's sign-up and plan selection pages — never the customer workspace: the Google Analytics cookies (_ga and _ga_4983395KW4, for up to 13 months), which also measure clicks on the main buttons (including “Book a call”) and the steps completed (free scan started and sent, sign-up, departure to payment, successful payment), with nothing you type. Advertising — LinkedIn campaign measurement, on the public website pages only — never the application pages: the LinkedIn Insight Tag, which sets the li_fat_id cookie (30 days) on our domain when you arrive from a LinkedIn ad, and counts a click on “Book a call” as a conversion; LinkedIn also uses cookies on its own domain, linkedin.com (including bcookie, 1 year, lidc, 1 day, and li_gc, 6 months), described in its cookie table (linkedin.com/legal/l/cookie-table (opens in a new tab)). A choice saved before October 2026 does not cover advertising: it stays disabled until you accept it. Prospecting — identification of your company, on the public website pages only — never the application pages: the Apollo tracker, which sets no cookie but keeps in your browser's local storage a random identifier (apolloAnonId, for as long as your consent is valid, up to 13 months), Apollo's answer on whether it may measure your visit (24 hours) and the queue of page views waiting to be sent; it sends Apollo the address of the pages viewed, and Apollo infers from your IP address the company from which you visit the site — never who you are. A choice saved before October 18, 2026 does not cover prospecting: it stays disabled until you accept it. The Microsoft Bookings calendar (bookings.cloud.microsoft) shows in our pages only when you ask for it, by clicking “Book a call”, “Show the calendar” (Contact page) or “Pick a time slot”; it can also open on Microsoft's site (outlook.office.com) in a new tab. Either way, the cookies Microsoft sets fall under its own policy. You can withdraw your consent at any time with the “Manage cookies” button: the cookies and identifiers set on our domain (_ga, _ga_4983395KW4, li_fat_id, apolloAnonId) are then deleted, and the page is reloaded to stop the LinkedIn script and the Apollo script, which can no longer send anything. Our site cannot delete the cookies LinkedIn has set on its own domain: you can delete them in your browser settings, and manage the advertising use of your data in your LinkedIn account settings.
Security
Access limited according to each user's role, and rights checks on the sensitive routes of the platform's application programming interface (API). In the database, row-level security (RLS) is enabled on every table, with no access for public keys: the application accesses data server-side. When you choose a password, we check with the Have I Been Pwned service (Troy Hunt, served by Cloudflare) that it does not appear in known data breaches; a password that does is refused. Only the first 5 characters of its fingerprint (SHA-1 hash) are sent — neither the password nor your email address.
Your rights
Under Articles 15 to 22 of the GDPR and the French Data Protection Act, you have the following rights:
Right of access to your personal data
Right to rectification of inaccurate data
Right to erasure (right to be forgotten)
Right to restriction of processing
Right to data portability
Right to object to processing
Right to withdraw your consent at any time
Right to set directives on what happens to your data after your death (Article 85 of the French Data Protection Act)
To exercise these rights, or for any question about the protection of your data, write to contact@finozio.com. You can also export your data and delete your account from the My Account page.
If you believe that the processing of your personal data violates the GDPR, you may lodge a complaint with the CNIL (the French data protection authority): www.cnil.fr (opens in a new tab), or with the supervisory authority of the European Union country where you live.
