Privacy Policy

Finalia is operated by Canaquest Consulting Inc., a company incorporated in British Columbia, Canada (BC1553644). For any privacy question, write to info@canaquestconsulting.com.

• Account information. Email address, and any name or profile data you choose to provide. If you sign in through Google or Microsoft, we receive the email address and basic profile fields they release for sign-in.
• Research project content. The questions, hypotheses, methodologies, draft papers, and chat exchanges you create or have with the AI mentor while using Finalia.
• Usage data. Which phases you reach, which artifacts you generate, when you log in, and basic device metadata (browser, operating system) for security and debugging.
• Payment information. If you subscribe, payment is handled by Stripe. We receive the last four digits and card brand for receipts, but Stripe stores the full card details; we never see or store them.

We use the data above only to provide and improve the Finalia service: authenticating you, generating mentor responses, saving your project artifacts, processing your subscription, and diagnosing problems. We do not sell your data. We do not share your data with third parties for their own marketing.

Finalia routes mentor conversations through Anthropic's Claude API under the standard commercial API terms, which by default exclude your inputs and outputs from being used to train Anthropic's models. We do not separately use your research content to train or fine-tune any AI model.

We rely on the following third-party services to operate Finalia. Each is contractually required to handle data on our behalf and consistent with this policy:

• Anthropic, PBC — Claude AI model API (mentor responses)
• Supabase, Inc. — database, authentication, and file storage (US-hosted, row-level-security isolated per account)
• Stripe, Inc. — payment processing (PCI-DSS Level 1 certified)
• Vercel, Inc. — application hosting and edge delivery
• Google LLC / Microsoft Corporation — only if you choose to sign in with those providers (OAuth flow only; they receive a sign-in request, we receive your email and basic profile)

We keep your account, project artifacts, and conversation history for as long as your account remains active. If you cancel your subscription, your projects remain available in read-only form for export. If you delete your account, we permanently remove your data within 30 days, except where we are required by law to retain certain records (for example, billing records for tax purposes).

Finalia is designed for high school students aged 13 and older. If you are under 18, a parent or guardian must review and agree to these terms with you. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has signed up, contact us and we will remove the account.

You can access, correct, export, or delete your data at any time from your dashboard, or by emailing info@canaquestconsulting.com. We respond within 30 days. Residents of jurisdictions with specific privacy rights (including Canada, California, the EEA and UK) have additional rights under their applicable laws, including the right to lodge a complaint with the relevant regulator.

Your data is stored in the United States on Supabase and Vercel infrastructure. We use HTTPS for all traffic, row-level-security policies in our database to ensure one student cannot access another's data, and industry-standard practices to protect credentials and secrets.

Finalia uses only the cookies strictly necessary to keep you signed in and to operate the service. We do not use advertising or tracking cookies.

If we make material changes to this policy, we will notify you by email and in your dashboard at least 30 days before they take effect. The most recent version is always at finalia.ai/privacy.

This policy is governed by the laws of the Province of British Columbia and the applicable federal laws of Canada.