Privacy policy

Controller

KERN-IT SRL, Rue Belliard 2A, 1040 Brussels, Belgium, enterprise BE0845906217. For any question about your data: info@kern-it.be or the contact form, reason "My personal data".

What we process

Visitors without an account

• A random visit identifier, kept in your browser (localStorage), which counts your free analyses and your feedback on analyses. It does not identify you and is not a fingerprint of your device.
• Your IP address, which we only keep in hashed form (salted SHA-256), to cap free analyses per connection and prevent abuse.
• The server's technical logs (IP address, page requested, date), for security and fault diagnosis.

Account holders

• First name, last name, email address, phone if you give it, password (stored encrypted, never in clear).
• Your organisation's name, your plan, your monthly use of analyses, the companies you follow, your notes and tags.
• When registering for the beta or inviting someone: the IP address of the request, to fight abusive registrations.

People named in annual accounts

The accounts filed with the National Bank sometimes contain the names of directors, managers or auditors. These documents are public by law. FinScan does not republish them as such; they may appear in an analysis report when they shed light on the company's situation.

Messages

Messages sent through the contact form are forwarded to us by email; they are not stored in the site's database.

Why, and on what basis

Purpose	Legal basis (GDPR, art. 6)
Provide the service and manage your account	Performance of the contract
Cap free analyses, prevent abuse	Legitimate interest
Security, logs, error detection	Legitimate interest
Answer your messages	Legitimate interest or pre-contractual steps
Analyse the published accounts of companies	Legitimate interest (economic information on public data)

FinScan does no advertising, sells no data and uses no advertising tracker.

For how long

• Account data: as long as the account is active. When the account is closed, on simple request, it is deleted within one month, subject to legal accounting obligations.
• Free analysis counters (visit identifier and hashed IP): deleted after 13 months without activity.
• Feedback on analyses: kept with the analysis, the IP only in hashed form.
• Web server logs: 14 days.
• Messages received by email: the time needed to handle the request and its follow-up.

With whom

We use processors, bound by contract, who do not use your data for their own purposes:

• OVH SAS (France): hosting of the site and the database, in Europe.
• Google (Gemini API): reading of annual accounts and drafting of the analysis. Only the companies' public documents are sent, never account data.
• Twilio SendGrid (United States): sending of the service's emails (invitation, password).
• Functional Software, Sentry (United States): collection of technical errors, without IP address or personal data from forms.

Transfers outside the European Union rely on the EU-US Data Privacy Framework or on the European Commission's standard contractual clauses.

Your rights

You may request access to your data, its correction, its erasure, the restriction of processing, its portability, and object to processing based on legitimate interest. A person named in an analysis report may also ask for it to be corrected or for the mention to be removed.

Write to us through the contact form or at info@kern-it.be. We answer within one month.

If you believe your rights are not respected, you may lodge a complaint with the Belgian Data Protection Authority, rue de la Presse 35, 1000 Brussels (dataprotectionauthority.be).

Cookies

The cookies and local storage used are listed on the cookies page.