Privacy Policy

1. What we collect

When you create an account, we collect your name, email address, workspace name, and password (stored securely by our authentication provider; we never see or store your password in plain text). We also record your subscription tier and, if you joined during a beta period, the invite code used to sign up.

When you use the tool, we store the financial inputs and saved organizations you choose to keep in your workspace, so that work persists between sessions.

When you buy a subscription, classification credits, or an Archetype Workbook, our payment processor collects your payment card details directly. Those details go to the processor and never reach our servers, so we never see or store your full card number. What we receive back and keep is your name, email address, the last four digits of the card, the billing country, and a record of what you bought and when.

We record a limited log of product events, such as signing in, running a classification, spending a credit, and changing tier. We use these to operate entitlements, to see which parts of the tool actually get used, and to answer your support questions accurately. This log is tied to your account, and it does not record the financial figures you enter. Each classification you run is also logged with the EIN you looked up, its outcome, and how long it took, so we can meter usage against your credits and diagnose failures.

When you submit feedback through the in-app feedback button or the in-depth feedback form, we store what you write. Free-text answers are yours to write however you choose, and may incidentally include details about your own work, such as client organization names or figures you mention by way of example. We treat this content with the same confidentiality as your workspace data.

2. How we use it

We use the information above to:

• Operate your account and authenticate your sign-ins
• Save and retrieve your workspace data between sessions
• Send account-related email, such as password resets and confirmations
• Take payment, and send you a receipt and the thing you purchased
• Enforce the access tier associated with your account
• Understand which parts of the tool are used, so we know what to improve
• Respond to support requests you send us directly

We do not sell your data. We do not use the financial inputs or organization data you enter to train any AI model, and we never share your actual figures with other users.

We may use combined, de-identified information, meaning your individual organization names, EINs, and financial figures are stripped out entirely, to maintain and improve the benchmark research the tool is built on. Nothing in that use can be traced back to your workspace or your clients.

We read feedback you submit to improve the product. If the in-depth feedback form asks whether we may quote something you said as a testimonial and you say yes, we may use that quote, attributed exactly as you specify in your answer. We will not quote you without that explicit permission, and you can decline or skip that question entirely.

3. Third parties that process data on our behalf

We rely on a small number of service providers to operate this tool. Each processes data only as needed to provide their service to us, and none is permitted to use your data for their own purposes. We name them so you can see exactly where your information goes:

• Supabase hosts our database, authentication, and file storage. Your account, workspace, saved organizations, and financial inputs live here.
• Netlify serves the application and, like any web host, keeps standard server logs including IP addresses.
• Stripe processes payments. Your card details go to Stripe directly and never pass through our servers. Stripe is an independent controller of the payment data it collects, under its own privacy policy.
• Resend delivers our email: sign-in confirmations, password resets, and purchase receipts. It receives your email address and the contents of those messages.
• Render hosts two processing services we call from the application. One receives an EIN when you run a classification, returns the archetype result, and writes a record of the run back into our own database. The other receives the contents of a benchmark report, including the organization name and the figures shown on it, when you export a PDF, and returns the finished file. Neither service keeps its own copy of what it receives once the request finishes.
• Google Fonts serves the typefaces used in the interface, which means your browser requests those files from Google and Google receives your IP address in the process.

Our public website at thefinancialforest.com additionally uses Google Analytics to measure traffic, Cloudflare Turnstile to keep automated submissions out of our forms, Google Sheets to receive contact and download form entries, and Mailchimp to send the Field Notes newsletter to people who ask for it. Those are separate from your Bearings account and do not receive your workspace data.

Aside from the providers named above, we do not share your data with any third party. The de-identified, aggregate benchmark research described above is conducted by The Financial Forest using these same providers and no others. Your individual organization names, EINs, and financial figures are never part of anything shared outside The Financial Forest. Aggregate, de-identified findings, such as sector-level benchmark statistics, may appear in research we publish or, in the future, in research we share with or license to others. Nothing shared in that form can ever be traced back to you, your workspace, or your clients.

We may also disclose information where the law requires it, such as in response to a valid subpoena or court order, or where we reasonably need to in order to protect our rights, our users, or the security of the tool.

All of these providers are located in the United States, and your data is processed there. If you use the tool from outside the United States, you are sending your information to a country whose data protection laws may differ from your own.

4. Cookies and browser storage

We do not use advertising cookies and we do not track you across other websites. The application stores a sign-in session in your browser so you stay logged in between visits, and it keeps a small amount of local state, such as your most recent workspace, so the tool opens where you left off. Clearing your browser storage signs you out and clears that state; it does not affect anything saved in your workspace.

Our public website uses Google Analytics, which sets its own cookies to measure visits. You can opt out of Google Analytics using Google’s browser add-on, or by using your browser’s tracking protection.

5. Your choices and your rights

Wherever you live, you may ask us to show you the information we hold about you, correct it, or delete it, and we will do that. Depending on where you live, you may also have the right to receive a copy of your data in a portable format, to object to or restrict certain processing, and to be free from discrimination for exercising any of these rights.

We do not sell personal information, and we do not share it for cross-context behavioral advertising, as those terms are used under California law.

To exercise any of these rights, email support@thefinancialforest.com. We will verify your request against the email address on your account and respond within the time the applicable law allows.

6. Data retention and deletion

You may delete any saved organization from your workspace at any time in account settings. To delete your account entirely, email support@thefinancialforest.com and we will remove your account and all associated data.

Two things outlive an account deletion, and we want to be straightforward about them. Records of completed transactions are kept as long as tax and accounting law requires, which we do not control. And de-identified benchmark research, from which your organization names, EINs, and figures have already been stripped, remains part of the research base, because there is nothing left in it to trace back to you.

7. Security

Data is encrypted in transit. Authentication and password handling are managed by our authentication provider using industry-standard practices; we do not implement our own password storage.

8. Data breach notification

If a security incident compromises your account information, we will notify you in accordance with the notification timeline and content requirements of the law applicable to your state of residence. We may delay notification if requested by law enforcement to avoid impeding an investigation, as permitted under applicable law.

9. Children’s privacy

This tool is intended for financial professionals and is not directed at, or knowingly used to collect information from, children under 13.

10. If our business changes hands

If The Financial Forest or the Bearings product is involved in a merger, acquisition, reorganization, or sale of assets, the information described in this policy may be transferred to the successor as part of that transaction. Any successor must honor the commitments in this policy, including the promises that your individual data is never sold, never used to train AI models, and never shared with other users, and that anything used for benchmark research is de-identified. We will notify you before your data becomes subject to a different privacy policy, and your right to request deletion of your account and data continues unchanged.

11. Changes to this policy

We may update this policy from time to time. Continued use of the tool after notice of changes constitutes acceptance of the revised policy. The version and effective date above reflect the policy in place when you created your account.

12. Contact

Questions about this policy or your data may be directed to support@thefinancialforest.com.