Privacy Policy

1. Who We Are and What This Policy Is

This is the organizational privacy policy of 403 Finance, Inc., a Delaware corporation with offices at 1111B S Governors Ave, Ste 92573, Dover, DE 19904, USA ("403 Finance," "we," "us," or "our"). You can reach our privacy team at privacy@403fin.io.

403 Finance operates its products and websites under product-specific privacy policies (Section 2). This organizational policy exists so that there is one permanent, entity-level statement of who we are, the commitments that apply across everything we operate, and our appointed EU and UK data protection representatives. It supplements the product policies; it does not replace or amend them.

2. Which Privacy Policy Applies to You

Each of our products has its own privacy policy that describes, in full, the personal data processed for that product, the purposes and legal bases, retention, recipients, and your rights:

• Forbidden Finance Privacy Policy — our personal finance application.
• Transmute Privacy Policy — our business-to-business financial message conversion API.

Precedence. If you use one of our products, that product's privacy policy governs the processing of your personal data in connection with that product. This organizational policy applies to 403 Finance as a whole and controls only for matters that a product policy does not address.

3. Commitments Across 403 Finance

The following apply to every product and website we operate:

• We do not sell personal data, and we do not share personal data for cross-context behavioral advertising.
• We protect personal data with technical and organizational measures appropriate to the risk, including encryption in transit, and as described in more detail in each product's privacy policy and security documentation.
• Analytics on our websites are consent-gated and managed through the cookie banner presented on the site.
• We honor the data protection rights granted to you by applicable law, through the mechanisms described in the applicable product policy and the contacts below.

4. EU/EEA and UK GDPR Representatives (Article 27)

If you are located in the EU/EEA or the UK and have questions or concerns regarding your personal data, you may contact our appointed GDPR representatives:

EU Representative
Euverify Ltd (Ireland)
Unit 3D North Point House
North Point Business Park
New Mallow Road
Cork, T23 AT2P, Ireland
Email: gdpr@euverify.com

UK Representative
Euverify Ltd (UK)
3rd Floor, 86–90 Paul Street
London, EC2A 4NE, United Kingdom
Email: gdpr@euverify.com

To submit a Data Subject Access Request (DSAR), a deletion request, or any other GDPR-related inquiry, you may use our representatives' secure verification and request portal. This link allows you to verify our appointed representatives and submit GDPR requests directly; requests submitted through the portal are logged and tracked to ensure timely response. You may always also contact us directly at privacy@403fin.io.

5. Our Community Server

We run a community server on Discord. It is a place for our users and anyone interested in what we build to talk to each other and to us. Joining is entirely voluntary and entirely your choice — you have to go and join it yourself, we have no way to add anyone to it, and you never need it to use Forbidden Finance or Transmute. If you never join, nothing in this section applies to you.

It is a community, not a channel of record. We do not conduct official business on the community server. Nothing said there by us or to us is a formal notice, a support ticket, a contractual communication, or financial advice, and it does not change anything in our Terms of Service or in the privacy policy that governs your use of a product.

Please don't post personal or financial details there. We will never ask you, in the community server, for your account details, balances, transactions, bank connections, passwords, or any document containing them — and you should never post them, in a channel or in a direct message, whether to us or to anyone else. General questions and small issues are welcome in the community. Anything else belongs on a private channel: report bugs through the in-app feedback portal, and take anything account-specific to in-app live chat or to email, where it reaches us privately and where the protections described in your product's privacy policy apply.

If something sensitive is posted anyway, tell us and we will remove it from our server. Please understand the limit of that: deleting a message removes it from our server, but we cannot unsend it from Discord's systems, from anyone who already read it, or from any copy they made. That is why the rule above is a rule and not a suggestion.

Discord's role. The community server runs on Discord, and Discord is an independent data controller — not our processor and not our sub-processor. Discord Netherlands BV is the controller for people in the European Economic Area, and Discord Inc. for everyone else. Your Discord account, your profile, the content you post, and the technical data Discord collects when you use it are governed by Discord's own privacy policy, under Discord's own terms, for Discord's own purposes. We do not control that processing and cannot change it. Discord states that it participates in the EU-U.S. Data Privacy Framework, its UK Extension, and the Swiss-U.S. Data Privacy Framework; that is Discord's own transfer arrangement, not ours.

Our role. We are the data controller for a much smaller set of information: what we can see as the operator of the server — your Discord username, user ID, avatar, and what you post in our channels — and any moderation records we create, such as a warning, timeout, or ban and the reason for it. We do not build profiles from any of it, we do not connect it to your product account, and our applications send Discord nothing about you. Our lawful basis is our legitimate interests in running a safe, on-topic community and protecting our users from spam, scams, and abuse (Article 6(1)(f) of the UK and EU GDPR); we have carried out and documented a Legitimate Interests Assessment for it.

Automated moderation. We use a third-party security tool called Wick to help keep the server safe. Unlike Discord, Wick works for us, on our instructions. It does three things: it checks links posted in messages against known malicious, scam and adult-content lists, and flags invite links to other servers; it watches for spam behaviour such as message flooding and mass mentions; and it asks each new member to complete a captcha inside the server when they join. It does not screen your messages for words or topics, and it does not open or follow the links you post — both features exist in the product and we have deliberately turned them off. Wick's own handling of what it sees is governed by its terms and privacy policy, and it does not publish a fixed retention period.

How long we keep it. We keep routine moderation records for 12 months. We keep records of bans indefinitely, because the record is what allows a ban to be enforced. Discord's own audit log is Discord's record, kept for as long as Discord keeps it under its policy, not ours.

Your choices and their limits. You can leave the community server at any time, and you can delete your own messages using Discord's controls. On request, we will delete the moderation records we hold about you and remove content we posted, except where we need to keep a record of a serious breach of our rules. What we cannot do is reach into Discord's systems: we cannot delete your Discord account, your profile, or the content Discord holds. For that, use Discord's in-app privacy controls or contact Discord directly — its data protection officer is reachable at dpo@discord.com.

Rules, moderation, and complaints. The rules of the community, what moderation we may take and in what order, and how to appeal a decision are set out in our Community Guidelines. If you are unhappy with how we have handled your personal data in connection with the community server, you can complain to us directly at privacy@403fin.io and we will acknowledge and respond; that route is in addition to, and does not replace, your right to complain to a supervisory authority or to contact our representatives in Section 4.

6. Your Rights and How to Reach Us

Depending on where you live, you may have rights to access, correct, export, delete, or restrict the processing of your personal data, and to object to certain processing. The product privacy policies describe how to exercise these rights for each product, including in-product tools where available. For anything else, or if you are unsure which policy applies to you, contact us:

• Email: privacy@403fin.io
• Mail: 403 Finance, Inc., 1111B S Governors Ave, Ste 92573, Dover, DE 19904, USA
• EU/UK: the representatives listed in Section 4.

7. Changes

This organizational policy is published permanently at https://403fin.io/legal/privacy/; that address will not change. We may update this policy from time to time; each released version carries a version number, an effective date, and a row in the change history below. Product policies change on their own schedules, as described in each of them.

Change History