FingripGroup Reporting
Integrity Platform

Privacy statement

Last updated 29 September 2026

Who we are

Fingrip is a trade name of Qubico Group B.V., Dupondiusstraat 26, 3541 HL Utrecht, the Netherlands (KvK 56511108, VAT NL852162327B01). Qubico Group B.V. is the controller for the personal data described here. Write to info@fingrip.ai with any question about your data.

This statement covers fingrip.ai, preview.fingrip.ai, the preview app at app.fingrip.ai and email to info@fingrip.ai. When Fingrip later processes data on behalf of a customer, the customer's agreement and data processing agreement apply to that data instead.

In short

  • Our websites use no cookies, analytics, advertising or tracking.
  • We use what you send us only to answer you.
  • Cloudflare hosts our websites and the preview app. Microsoft 365 hosts our email.
  • The preview app sends no email, except a test notification you ask for yourself, to your own address.
  • You can ask us at any time to see, correct or delete your data.

1. When you visit fingrip.ai or preview.fingrip.ai

What: your IP address, browser details and the address of the page you request. Every web request carries these.

Why: to deliver the pages and protect them against abuse.

Who: Cloudflare, our hosting provider, processes these details for us. Cloudflare answers each request from the data centre nearest to you, which can be outside the EU. We keep no visitor logs ourselves. The sites load no third-party scripts, and their fonts come from our own domain.

How long: we keep no copy. Cloudflare keeps these details only as long as it needs to deliver and protect the sites, under its data processing agreement.

Legal basis: our legitimate interest in running a secure website (Article 6(1)(f) GDPR).

2. When you email us

What: your name, your email address and whatever you write to us, for example your company and role.

Why: to answer your question, give you early access or discuss a pilot.

Who: Microsoft hosts our email (Microsoft 365).

How long: up to 24 months after our last contact. If we sign an agreement with you, we keep what that agreement and Dutch tax law require, which is usually seven years for business records.

Legal basis: steps you ask us to take before an agreement, or our legitimate interest in answering you (Article 6(1)(b) and (f) GDPR).

3. When you use the preview app at app.fingrip.ai

The preview is open by invitation only and holds synthetic demonstration data. Please do not upload real company data to it.

What: your name, your email address, your password in hashed form (we never store it readably), your sign-in sessions and sign-in attempts with the IP address and browser details they came from, and the actions you take, which the audit trail records with your name and email address. If someone invites you, we receive your name and email address from them. You need to give your name, email address and a password to use the preview; without them we cannot create your account.

Cookie: one strictly necessary cookie, __Host-fg, keeps you signed in. It lasts 12 hours from your last activity and at most 7 days, and serves no other purpose. The app also remembers two display choices in your browser's local storage: the reporting cycle you last opened and the role view you picked. None of this needs consent.

Where: Cloudflare stores the preview's database in its EU jurisdiction. Cloudflare also keeps technical request logs for the app for up to seven days, so that we can find and fix errors; these logs are not limited to the EU.

AI: the preview's assistant works from fixed rules and sends nothing to an AI provider.

Test emails: an administrator can ask the preview to send one test notification to their own address, at most five a day, to see how notifications from their organisation's domain will look. Amazon Web Services EMEA SARL sends it through Amazon Simple Email Service (SES) in its Frankfurt region, and receives your email address, the sender's name and address and the sample text, which is made up and holds no real figures. To check the sender's domain, the preview looks up its DNS records through Cloudflare's DNS resolver; those lookups carry the domain name only. The preview sends no other email: every other notification is only recorded in its log.

How long: we keep your account, your sign-in records, the audit entries that name you and the log of test emails sent to you until the preview closes, and then delete them; we delete them sooner if you ask. Cloudflare's database backups hold deleted data for up to 30 more days.

Legal basis: our legitimate interest in showing the product to the people we invite and in keeping the preview secure, for example by limiting repeated failed sign-ins (Article 6(1)(f) GDPR).

4. Who receives your data

Only these providers, as processors that act on our instructions under a data processing agreement:

  • Cloudflare, Inc. for hosting and network services. Cloudflare is based in the United States; the EU–US Data Privacy Framework and the standard contractual clauses in its data processing agreement cover transfers there.
  • Microsoft Ireland Operations Limited for email (Microsoft 365). Microsoft can involve its US parent and other sub-processors; its data processing agreement uses the EU standard contractual clauses for that.
  • Amazon Web Services EMEA SARL for the test emails of the preview, sent through Amazon SES in the Frankfurt region. Amazon can involve its US parent; the EU–US Data Privacy Framework and the standard contractual clauses in its data processing agreement cover transfers there.

We do not sell your data and share it with no one else, unless the law requires us to.

5. How we protect it

HTTPS on every page, strict browser security headers, no third-party scripts, hashed passwords, and access for our own team only.

6. Your rights

Right to object: where we rely on our legitimate interest, you can object at any time. We then stop, unless we have compelling reasons that outweigh your interests.

You can ask to see, correct or delete your personal data, to restrict or object to its use, and to receive it in a portable format. Email info@fingrip.ai; we answer within one month. You can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.

7. Automated decisions

We take no decisions about you by automated means alone, and we do not profile visitors.

8. Changes

When this statement changes, we update the date at the top of this page.