Privacy and Personal Data Protection Policy

Fihub, referred to in this Policy, is a business entity registered in Austria and operating in accordance with the legal requirements of its jurisdiction, acting as the data controller for personal data under our stewardship.

Personal data is defined in alignment with the European Data Protection Regulation No. 2016/679 (GDPR) and relevant local laws. It encompasses any information related to an identified or identifiable individual, including but not limited to names, email addresses, phone numbers, and IP addresses.

The collection of personal data at Fihub is driven by a commitment to respect and protect the privacy of our customers and users. This commitment ensures compliance with applicable laws and regulations, including GDPR and local data protection laws, aiming to enhance our products and services.

Personal data is retained for 3 years following your last interaction with us, or for the duration of our contractual relationship, whichever is longer.

Fihub employs stringent security measures to protect personal data, including SSL encryption and regular security assessments to prevent data breaches and unauthorized access.

Personal data may be shared with service providers for operational purposes but remains within Fihub's control. We ensure that any data transferred outside the EEA is protected by adequate safeguards or specific contractual clauses that offer equivalent data protection.

In the event we receive a request for personal data from law enforcement, government agencies, or other public authorities, Fihub follows a structured process to protect your privacy:

Where permitted by law, we will notify affected users of such requests unless prohibited by legal process or where notification could compromise a legitimate law enforcement investigation.

Fihub's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

When you connect your Google Analytics or Google Ads accounts to Fihub, we access this data only with your explicit consent to provide you with financial performance insights and business analytics. The Google data we collect includes analytics metrics, advertising performance data, and related business information necessary for calculating key performance indicators.

You can revoke Fihub's access to your Google data at any time through your Google Account settings or by disconnecting the integration within your Fihub account. Upon revocation or account deletion, we will delete your Google user data in accordance with our data retention policies and applicable legal requirements.

You have the right to access, rectify, erase, restrict, or object to the processing of your personal data. You can also request data portability and lodge complaints with relevant supervisory authorities regarding our data processing practices.

Fihub is dedicated to upholding the highest standards of privacy and data protection. For further details or inquiries regarding this Policy, contact us using the details in Section 15.

1. 12.1

   What we process: When a customer connects an integration, Fihub ingests the operational and financial data needed to produce their analytics. Depending on which systems are connected, this includes orders and order line items, products and SKUs, inventory levels and movements, fulfilment and shipping costs, subscription contracts, advertising spend and campaign performance, web session and traffic metrics, post-purchase survey responses, and accounting ledger data including the chart of accounts, journal entries and financial statements.

2. 12.2

   Read access only: Fihub requests read access to connected systems. We do not modify, create or delete anything in a customer's connected systems.

3. 12.3

   What we do not process: Fihub does not ingest the personal data of our customers' end customers. We do not collect or store consumer names, postal addresses, telephone numbers or payment card details from connected commerce platforms. Where our analytics require customer-level calculations — cohort retention, lifetime value, repeat purchase behaviour — we operate on pseudonymous identifiers issued by the source platform, which let us recognise that two orders belong to the same purchaser without identifying who that purchaser is. For Amazon, the buyer identifier Amazon provides is an anonymised relay address, which we store as that pseudonymous key. Free-text survey answers are stored as the respondent wrote them.

4. 12.4

   Why we process it: Solely to deliver the contracted service: unifying data across a customer's connected systems, reconciling it against their accounting records, computing the metrics and financial statements they have configured, and answering their questions through the app, Slack or an LLM connector. We do not use customer business data to train machine learning models, and we do not use it for any purpose other than delivering and supporting the service to that customer.

5. 12.5

   AI processing by Fihub: Fihub uses third-party large language models as part of the service itself, separately from any assistant a customer chooses to connect (Section 13). There are two such uses: classifying and cleaning incoming data — for example mapping a raw traffic source, sales channel or accounting line to a standard category — and powering the assistant inside the Fihub app, where the question asked and the metric results retrieved to answer it are sent to the model. Our model providers are Anthropic and OpenAI, engaged as subprocessors under their commercial API terms with data sharing for model training disabled. We send only the data a given task requires, and we do not use customer business data to train models of our own.

6. 12.6

   Conversations with the in-app assistant: So that users can return to earlier work, the questions asked of the assistant inside the Fihub app, its answers, and any reports it produced are stored in that customer's own Fihub database, alongside the rest of their data and under the same isolation, encryption and access controls. They are visible only to users of that customer's account. A user can delete a conversation from the app at any time, and conversations are deleted with the customer's data when the relationship ends. Conversations held in a connected AI assistant are different — see Section 13.

7. 12.7

   How we store it: Each customer's data is held in a dedicated database, logically and physically separated from every other customer's data. Databases are hosted on Amazon Web Services in a region appropriate to the customer, and our application infrastructure runs within a private network that is not directly reachable from the public internet. Data is encrypted in transit and at rest. Access by Fihub personnel is restricted to those who require it to deliver the service or provide support, and is logged. Customer accounts support two-factor authentication.

8. 12.8

   How long we retain it: Customer business data is retained for the duration of the customer relationship, and deleted as follows:

   1. (a.)

      Disconnecting an integration deletes that integration's data — its stored files and its rows in the customer's database — immediately. There is no grace period and no archive copy.

   2. (b.)

      On termination, or on a deletion request from the customer, we delete the customer's data within 30 days: their file storage is wiped, their dedicated database is dropped, and the credentials held for their integrations are destroyed. We retain data beyond this only where the law requires it.

   3. (c.)

      Where an integration provider tells us a customer has revoked our access and it is not restored, we delete the data obtained through that integration on the same 30-day basis.

   4. (d.)

      Database backups are kept on a rolling basis for up to 15 days. Data deleted from live systems remains in those backups until they age out and are overwritten.

   5. (e.)

      Operational and diagnostic logs are retained for up to 30 days for security, reliability and troubleshooting. Transient caches expire within an hour.

9. 12.9

   Who we share it with: We do not sell customer business data, and we do not share it with third parties for advertising or marketing purposes. Customer business data is processed by the subprocessors listed in Section 14, each engaged under a written agreement imposing data protection obligations equivalent to our own. Where a customer chooses to use an LLM connector, data is also delivered to the AI provider they have selected — see Section 13.

10. 12.10

    Customer rights: Customers may export their data, disconnect any integration, or request deletion at any time. A Data Processing Agreement is available on request from support@fihub.ai.

Fihub offers a Model Context Protocol (MCP) connector that allows a customer to query their Fihub data from an AI assistant such as Claude. Connecting an AI assistant is entirely optional and is initiated by the customer. Setup instructions are in our documentation.

1. 13.1

   How the connection works: The connector is authorised using OAuth 2.0. The customer signs in to Fihub from within their AI assistant and grants access; no Fihub password is shared with the AI provider. Access can be revoked at any time, either from the AI assistant's connector settings or by contacting us. A connector session can only reach the data of the Fihub account that authorised it, and only within that user's existing permissions. It cannot reach any other customer's data.

2. 13.2

   What the connector can and cannot do: The great majority of connector tools are read-only: they retrieve metrics, financial statements, cohort analyses and reconciliation results that Fihub has already computed. A small number of tools write configuration within Fihub only — for example saving a cohort definition, or correcting how an account or product category is mapped in Fihub's taxonomy. These change how Fihub presents a customer's data; they never write back to a connected system. No connector tool can modify data in Shopify, Amazon, QuickBooks, Xero, an advertising platform or a fulfilment provider, and no connector tool can move money, place an order or alter an account setting in a connected system. Tools that write configuration are annotated as such, so the AI assistant requests the customer's confirmation before calling them.

3. 13.3

   Data minimisation:

   1. (a.)

      The connector exposes a curated set of tools, not general access to Fihub's internal API or database.

   2. (b.)

      Data is returned only in direct response to a prompt the customer has issued. Nothing is retrieved speculatively.

   3. (c.)

      Tools return aggregated metrics and analyses rather than raw records wherever the question can be answered that way, and every response is bounded in size.

   4. (d.)

      No end-customer personal data is available through the connector, because Fihub does not hold it (Section 12).

4. 13.4

   Third-party sharing: When a connector tool returns data, that data is delivered into the AI assistant the customer has chosen, and is then handled under that provider's terms and privacy policy, not Fihub's. A customer's decision to connect an AI assistant, and the onward processing performed by that provider, are the customer's own to assess as controller. We recommend reviewing that provider's own privacy policy, data retention and model training terms before connecting, and confirming whether the provider acts as a processor or as an independent controller for that processing.

5. 13.5

   What Fihub records: Fihub logs which connector tools were called, when, and by which account, for security and reliability. These records name the tool, the parameters it was given by name, and whether it succeeded; they do not contain the text of a prompt or the data a tool returned. Fihub does not receive or store the content of a customer's conversation with a connected AI assistant. The conversation stays with the assistant, under that provider's terms; what reaches Fihub is the individual tool calls the assistant chooses to make on the customer's behalf. Conversations with the assistant inside the Fihub app are stored in the customer's own Fihub database so users can return to them — see Section 12. Our observability provider for these records is listed in Section 14.

6. 13.6

   Revoking access: Remove the Fihub connector from the AI assistant's settings, or contact support@fihub.ai. Revocation takes effect immediately for new sessions.

We engage the following subprocessors to process customer business data. We will give customers notice of changes to this list in accordance with our Data Processing Agreement.

1. 14.1

   Amazon Web Services

   Application and database hosting, in the region appropriate to the customer — European Union and United States

   Amazon Web Services (SES)

   Transactional email — European Union

   Amazon Web Services (CloudWatch)

   Operational logging and performance monitoring — European Union

   Stripe

   Payment processing — United States

   Anthropic

   Large language model processing for the in-app assistant and analytical narratives — United States. Data sharing for model training is disabled.

   OpenAI

   Large language model processing for data classification and cleaning, and text embeddings for metric search — United States. Data sharing for model training is disabled.

   Slack

   Insight delivery, for customers who enable it — United States

   LangSmith

   Connector and assistant observability — United States. Traces record the tool called, the caller, timing and outcome; prompt text and tool results are not sent.

Fihub Technologies FlexCo, Schippergasse 12, A-1210 Vienna, Austria. Commercial register (Firmenbuch) FN 622845 z.

You may lodge a complaint with your local supervisory authority. Fihub's lead supervisory authority is the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40-42, 1030 Vienna, Austria.

This Policy was last updated in September 2026.