Privacy Policy

Eterna Finance CRM (the “Service”) is operated by Eterna Financial (“Eterna”, “we”, “us”). Eterna is the controller of personal data relating to users of the Service, and acts as a processor for personal data that our business customers upload about their own leads, applicants and merchants.

Privacy questions, data subject requests and complaints: privacy@eternafinance.com.

• Account data: name, display name, email address, phone number, job title, profile photo, authentication provider identifiers (Google account ID, Telegram user ID and username).
• Authorization data: assigned roles, permissions, approval status and administrative actions taken on your account.
• Customer content: lead, applicant, merchant and deal records that our business customers enter into the Service, which may include contact details, business details and financial information.
• Technical data: IP address, device and browser information, timestamps and security/audit logs.
• Communications: messages you send to us for support or legal requests.

We do not knowingly collect data from children under 16, and the Service is intended solely for business use by authorised personnel.

• To create, authenticate and secure user accounts.
• To operate role-based access control and approve or suspend access.
• To provide, maintain, support and improve the Service.
• To detect, investigate and prevent fraud, abuse and security incidents.
• To comply with legal, regulatory, tax and record-keeping obligations.

EU/UK legal bases (GDPR Art. 6): performance of a contract (Art. 6(1)(b)) for providing the Service; legitimate interests (Art. 6(1)(f)) for security, abuse prevention and service improvement; legal obligation (Art. 6(1)(c)) for compliance; and consent (Art. 6(1)(a)) where we ask for it, which you may withdraw at any time.

We do not sell personal data, and we do not share personal data for cross-context behavioural advertising.

We share personal data only with processors and partners that need it to run the Service: cloud hosting and managed database/authentication infrastructure, identity providers you choose to sign in with (Google, Telegram), error monitoring, and email delivery. Each processor is bound by a written data processing agreement with confidentiality and security obligations.

We may also disclose data to comply with law, respond to lawful requests from public authorities, enforce our Terms of Service, or in connection with a merger, acquisition or sale of assets (subject to this Policy).

Personal data may be processed in the United States and other countries outside the EEA/UK. Where we transfer personal data out of the EEA, UK or Switzerland, we rely on the European Commission’s Standard Contractual Clauses (and the UK Addendum where relevant), together with supplementary technical and organisational safeguards such as encryption in transit and at rest and strict access controls.

We keep account data for as long as your account is active and for up to 24 months after deactivation, unless a longer period is required by law or to resolve disputes. Security and audit logs are typically retained for up to 12 months. Customer content is retained according to our customer’s instructions and deleted or returned on termination of their subscription.

We apply row-level access control at the database layer, encrypted transport (TLS), encryption at rest, least-privilege administrative access, permission-scoped application roles, and monitoring. No system can be guaranteed absolutely secure; please use strong authentication on the identity provider you sign in with and report suspected incidents immediately.

EEA/UK (GDPR): you have the right to access, rectify, erase, restrict and object to processing, to data portability, to withdraw consent, and to lodge a complaint with your local supervisory authority.

United States (including CCPA/CPRA, VCDPA, CPA, CTDPA, UCPA and similar laws): you have the right to know and access the personal information we hold, to request deletion or correction, to obtain a portable copy, to opt out of sale or sharing (we do neither) and profiling for significant decisions, and not to be discriminated against for exercising your rights. You may use an authorised agent where the law permits.

To exercise any right, contact privacy@eternafinance.com. We verify requests through your registered account and respond within the statutory timeframe (generally 30 days under GDPR, 45 days under US state laws, extendable where permitted). If your data was uploaded by one of our business customers, we will refer your request to that customer as controller.

The Service uses strictly necessary cookies and local storage to keep you signed in, maintain session security and prevent cross-site request forgery. We do not use advertising or cross-site tracking cookies. Because only essential technologies are used, no consent banner is required under the ePrivacy Directive; if this changes we will request consent first.

The Service does not make automated decisions producing legal effects about you without human involvement. Underwriting and funding decisions recorded in the Service are made by our customers’ staff.

We may update this Policy from time to time. Material changes will be notified in-app or by email at least 14 days before they take effect, and the “Last updated” date above will change.