Privacy policy
Updated: 6 October 2026
Apple purchases
To verify and maintain Pro, we link Apple product and transaction identifiers, status, renewal and expiry to your account. Apple processes payment; FetchDue does not receive your card. We retain the minimum subscription records needed for restoration, support and applicable obligations. They are not used for advertising or tracking across apps.
Who handles the data
Juan Manuel Fernández, Canary Islands, Spain, operates FetchDue. Contact: info@myfinreport.com. Account, support and billing data are handled to administer the service. Business data you provide about clients is processed under your instructions; you determine the purposes of that customer relationship.
Data used
Email and authentication records; settings; client contacts; work and CSV imports; invoice amounts, dates, statuses and links; quote content, terms, revisions and responses; and message history. Acceptance records the stated name, response, date and version. Integration credentials remain server-side and are excluded from visible metadata and exports. Stripe processes cards; FetchDue does not store card numbers.
Purpose and basis
Account and billing data are used to perform the service and meet legal obligations. Operational records support security and reliability. Client data is processed under your instructions to organize work, share quotes, record responses and follow up on invoices. You need a lawful basis to provide that data and make communications. Contact support about processing terms for your business.
AI and providers
The configured AI provider may process reply text and necessary invoice context to classify intent and propose wording. AI does not verify payments or approve outbound replies. FetchDue does not sell data or use customer content to train its own models. Providers include Vercel (hosting, AI Gateway and analytics), Supabase (database and authentication), Stripe, Resend, the configured AI provider and, when enabled, Twilio, QuickBooks and Xero.
AI assistants you connect
If you connect FetchDue to an AI assistant or provider you choose through MCP, that provider receives the account, invoice, client and follow-up data returned by the tools used within the permissions you authorize. That provider processes the data under its own terms and privacy policy. You can revoke the connection in Settings → AI connections; this blocks new access but does not delete data already shared with the provider.
Location and private links
The database is hosted in Supabase’s EU region. Other providers may process data in other locations; request current provider and transfer-safeguard information from support. An EU database does not imply exclusively European processing. Anyone holding a private quote link can view and respond. Share it only with its intended recipient. Revising or archiving a quote withdraws the earlier link.
Analytics
Vercel Analytics measures site traffic. Private quote pages do not load this analytics and are marked against indexing. Service records allow measurement of accounts completing setup, creating documents and subscribing. Message text, client names and financial details are not sent as marketing analytics events.
Retention and deletion
Account and workspace data—contacts, work, invoices, quotes and their revisions and responses, branding, reminder drafts and message history—are kept until you delete the records, where supported, or complete account deletion; they have no inactivity expiry. Confirm deletion from Settings or Account in the mobile app after verifying your identity again. New reminders stop, Web Pro renewal and open web checkout links are cancelled, integrations are disconnected and the workspace is deleted. Accounting integration credentials are deleted when disconnection or account closure completes; if disconnection fails, the request remains pending and is retried. Apple subscriptions must be cancelled separately in your Apple account: deleting FetchDue does not cancel them. Cancelling renewal alone does not delete your account. AI connection access tokens expire after 10 minutes. Each refresh token rotates on use and expires after at most 30 days, or earlier when the connection expires or is revoked. Revoking an AI connection disables it immediately and blocks new access. Authorizations expire after 90 days. Revoked or expired connection records are deleted through cleanup triggered by OAuth requests, once at least seven days have passed after authorization expiry, or when account deletion completes; there is no guaranteed cleanup deadline. Connector activity logs contain the tool name, outcome, duration, technical identifiers and timestamp, without tool inputs or customer content. They are kept until the related authorization is cleaned up or account deletion completes. Subscription billing records are subject to a six-year legal retention period from the last accounting entry under Spain’s Código de Comercio, with access limited to legal obligations or claims. Account closure does not erase Stripe billing records, and the application does not schedule their deletion at the end of those six years. The internal billing ledger, trial history and subscription events are kept throughout the account’s lifetime, including after subscription cancellation, and are deleted on account deletion. Account-email content, queues, delivery records, preferences and sending suppressions stored in FetchDue have no separate deletion deadline and are deleted on account deletion. Retention of email content and logs at Resend, support correspondence and external hosting, authentication and analytics logs remains unconfirmed. Minimum Apple subscription identifiers and general webhook delivery records can remain after closure without a defined deletion deadline; closure removes personal content from those webhooks. Browser-stored calculator drafts and letters expire seven days after saving or editing; unchanged saves do not extend that period, and expired data is removed when next accessed. Calculator source attribution also expires after seven days, and the analytics consent preference expires after 180 days. Supabase database backups are taken daily and kept for up to 7 days; deleted data disappears from those backups once that retention period ends. Point-in-time recovery is not enabled.
Choices and rights
Download your data from Settings or request an export by email. Request access, correction, deletion, restriction, portability or objection where applicable from your account email to info@myfinreport.com. We verify identity proportionately and respond within the applicable legal period, normally one month; any permitted extension will be explained. You may complain to AEPD. If you are a client of a FetchDue user, identify the business that contacted you so the request reaches the appropriate controller. Material changes will be reflected here and communicated where appropriate.