Privacy Policy

1. Introduction and controller

This Privacy Policy explains how Key Figures ("Key Figures", "we", "us") collects, uses, shares, and protects information in connection with the website at keyfigures.com and the financial model generation service offered through it (together, the "Service").

The controller within the meaning of Article 4(7) of Regulation (EU) 2016/679 (GDPR) for personal data processed through the Service is Key Figures GmbH i.G. (in Gründung), with registered seat in Munich, Germany, represented by its managing director Pavel Pivovarov. Full provider identification and postal address are published on our imprint page at keyfigures.com/imprint, and questions about this policy can be sent to contact@keyfigures.com.

A data protection officer (Datenschutzbeauftragter) is not designated, as the statutory thresholds of §38 of the German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG) and Article 37 GDPR are not met. Privacy-related requests are handled directly by the management.

This policy applies to visitors to the website and to people who create a Key Figures account. It does not apply to third parties we link to or to services that operate under their own policies. By using the Service you agree to the practices described here.

2. Information we collect

We collect three kinds of information.

3. How we use information

The purposes listed below apply to information collected through a given feature of the Service once that feature is live. Until account features launch, keyfigures.com does not collect information of the kinds described in Section 2.

We use the information above to:

(a) authenticate you and keep you signed in;

(b) generate the financial models you request through our service providers;

(c) store the generated Excel models so you can access them from your account;

(d) operate, secure, and improve the Service;

(e) respond to support and rights requests you send to us.

Your personal information is not used to train machine-learning models, and we do not permit service providers that process data on our behalf to use it for training.

4. Service providers and subprocessors

We rely on a small number of third-party service providers to deliver the Service. Each is selected for its privacy and security posture and is engaged under contractual terms appropriate to its role. We disclose the categories of providers we use rather than a public vendor list; a current list of named subprocessors is available to enterprise customers on request.

The categories of providers currently used are:

(a) hosting and content delivery;

(b) authentication, database, and file storage;

(c) financial data providers, used to source historical financial and market information;

(d) technology providers that support the automated analysis and generation of financial models;

(e) aggregate, cookie-less site analytics.

Web fonts are served from keyfigures.com, so your browser does not make outbound font requests to third parties during page load.

If your organisation requires the named list of our current subprocessors, email contact@keyfigures.com and we will share it under appropriate confidentiality terms.

5. Other sharing

Beyond the subprocessors listed above, we share information only in these situations:

(a) when required by law, court order, or other legal process;

(b) to protect the rights, property, or safety of Key Figures, our users, or others, including to investigate fraud or abuse;

(c) in connection with a merger, acquisition, financing, or sale of assets, in which case we will use commercially reasonable efforts to ensure the recipient honours this policy or notifies affected users.

We do not sell your personal information. We do not share it for cross-context behavioural advertising.

6. Data retention

Until account features launch, the Service does not collect or retain personal account data; the retention practices below describe the position that will apply once account features are live.

Account information will be kept for as long as the account is active, and deleted within a reasonable period after account closure.

Financial models generated for an account holder will be stored within that account and retained for as long as the account is active or as long as reasonably necessary to provide the Service. An account holder may request deletion of specific models, or of all content associated with the account, by emailing contact@keyfigures.com.

7. Your rights and choices

Depending on where you live, you may have rights to access, correct, delete, or port your personal information, to object to or restrict certain processing, and to lodge a complaint with a supervisory authority.

California residents have rights under the California Consumer Privacy Act and its amendments, including the right to know what we collect, to delete, to correct, to opt out of sale or sharing, and to be free from discrimination for exercising these rights. We do not sell personal information. You can exercise any of these rights by emailing contact@keyfigures.com.

Residents of the European Economic Area, the United Kingdom, and Switzerland have rights under the GDPR and UK GDPR, including access, rectification, erasure, restriction, portability, and objection, and the right to lodge a complaint with a supervisory authority.

To exercise any of these rights, email contact@keyfigures.com. We will respond within the period required by applicable law, and in any event within a reasonable period (typically 30 days).

If your organisation requires information about our compliance posture or a specific regulatory attestation, please contact contact@keyfigures.com before creating an account.

8. Cookies

Our Cookie Policy at keyfigures.com/cookies explains what cookies the Service sets, what it does not set, and what choices you have. In short: today the Service sets no cookies, and when signed-in features launch a strictly-necessary authentication cookie will be set. The Service does not set analytics or advertising cookies.

9. International transfers

The Service is operated from Munich, Germany. Depending on the service provider used to deliver a given function of the Service, your personal information may be processed in the European Economic Area (EEA), the United Kingdom, the United States, or other jurisdictions.

Where personal information is transferred outside the EEA or the United Kingdom to a country that has not been recognised as providing an adequate level of data protection, we rely on appropriate safeguards permitted under applicable law, such as Standard Contractual Clauses, the EU-US Data Privacy Framework, or equivalent mechanisms.

If your organisation requires a Data Processing Addendum, Standard Contractual Clauses, or equivalent cross-border transfer terms, please contact contact@keyfigures.com before processing personal data through the Service.

10. Security

All traffic to and from keyfigures.com is encrypted in transit using TLS. Stored data is encrypted at rest under our hosting provider's default security posture.

No method of transmission over the internet or electronic storage is perfectly secure. We work to protect your information but we cannot guarantee absolute security.

11. Children

The Service is intended for use by adults in business and professional contexts. It is not directed to children under the age of 13 (or 16 in jurisdictions where that is the relevant age), and we do not knowingly collect personal information from them. If you believe we may have collected information from a child, please contact contact@keyfigures.com and we will delete it.

12. Changes to this policy

We may update this policy from time to time. When we do, we will revise the "Last updated" date at the top of the page. If changes are material, we will take reasonable steps to notify account holders, for example by email.

13. Contact

Questions, requests, or complaints about this policy can be sent to contact@keyfigures.com.