Finlume Privacy Policy

Last Updated: August 18, 2026

Table of Contents

Important Privacy Information

This Privacy Policy should be read together with our Terms and Conditions and Cookie Policy. By using the Service, you agree to the above three documents.

This Privacy Policy is incorporated by reference into the Terms and Conditions of Finlume™ ("Finlume" or "we"), and is part of the agreement between you (i.e., the user of the website https://finlumeapp.com (the "Website" or "Service")) and Finlume.

To use the services on the Website, we may ask you to fill in information about your age, gender, email address, name, and current financial situation, and to answer other onboarding questions, including a questionnaire about your financial mindset and goals. We also automatically collect from your device: language settings, IP address, time zone, device type and model, device settings, and operating system. We need this data to provide the Service, analyze how customers use the Service, and measure advertising effectiveness.

To improve our Service and deliver advertising, we use third-party solutions. Therefore, we may process data using solutions developed by our service providers, which may include the infrastructure providers and regions we select, analytics providers, advertising and marketing partners, customer support providers, and PayPal. The specific providers we choose within each category may change from time to time. Therefore, some data will be stored and processed on the servers of the aforementioned third parties. This enables us to: (1) analyze different interactions (how often users subscribe, the most popular learning goals, the average time users spend on the Service); (2) deliver advertising (and be able to show it only to specific user groups, e.g., to subscribers). In this way, we especially better understand which features and content you value most, and can focus on improving your experience and the quality of our products.

This Policy describes the features currently available in the Service (questionnaire assessment, question bank for practice, and your personalized report). As we launch new features, we will update this Privacy Policy.

Please read our Privacy Policy below to further understand how we process data (Section 3), what data privacy rights you have (Section 5), and who will be the data controller (Section 1). Depending on the region from which you access our Service and the product you select, we strive to provide you with various privacy controls and rights. For example:

  • Influence online tracking through the e-Privacy settings on our Website.
  • Opt out of the sale/sharing of data (as defined under certain U.S. laws).
  • Request deletion of data and account.
  • Exercise other privacy rights.

When these features are available to you, we will prominently display them in the product footer, menu, or profile area. We are committed to providing most of these rights as privacy features that you can access yourself through simple, user-experience-friendly interactions with the Service (when you have difficulty finding these features, or they are not yet provided as features, please submit a request to us).

If you still have questions, please contact us at [email protected].

Non-Investment-Advice Disclaimer.

Finlume is an investment education product. The questionnaire-based report provided through the Service is generated for educational and informational purposes only, and does not constitute investment advice, a recommendation, or an offer to buy or sell any security. We do not connect with any real broker or financial account, and no feature of the Service uses your funds for real transactions. You should not rely on the Service as a basis for any real-world investment decision.

This Privacy Policy explains what personal data we collect and how that personal data is processed when you use the Finlume website located at https://finlumeapp.com (the "Website") and the services and digital products provided through the Website (the "Service").

By using the Service, you promise us that: (I) you have read, understood, and agree to this Privacy Policy; and (II) you are at least 18 years old (or have had your parent or guardian read and agree to this Privacy Policy on your behalf). If you do not agree, or cannot make the foregoing promises, you may not use the Service. In this case, you must (a) contact us and request deletion of your data; (b) use the features provided in the Website instructions to cancel any subscription; (c) leave the Website and no longer access or use it.

Key Definitions

  • "GDPR" means the General Data Protection Regulation (EU) 2016/679 of the European Parliament and Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.
  • "EEA" includes all current member states of the European Union and the European Economic Area. For the purposes of this Policy, the EEA shall include the United Kingdom of Great Britain and Northern Ireland.
  • With respect to personal data, "processing" includes collection, storage, and disclosure to others.
  • "Personal data" means any information relating to an identified or identifiable natural person (the "data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person (Article 4(1) of the GDPR). (Full text of the EU General Data Protection Regulation (GDPR) at https://eur-lex.europa.eu/eli/reg/2016/679/oj)

1. Personal Data Controller

Hong Kong Xingyue Network Technology Limited, a company registered under the laws of Hong Kong, with its registered office at Room 511, 5/F, Ming Sang Industrial Building, 19-21 Hing Yip Street, Kwun Tong, Hong Kong, will be the controller of your personal data.

2. Categories of Personal Data We Collect

We process the following data:

  • Data you provide to us (for example, when you fill in your gender, financial status, or email address),
  • Data collected automatically when you use the Service (for example, your IP address obtained through Cookie or SDK technology).

2.1 Data You Provide to Us

1. Identity and Onboarding Data

You provide us with information about yourself when you register for and/or use the Service. For example: age, gender, name, financial status data (including your answers to the questionnaire and question bank exercises regarding your financial mindset and goals), and email address.

2. Commercial Information

When you make a payment through the Service, you are required to provide financial account data, such as your credit card number, to a third-party service provider acting as a data and payment processor. We do not collect, store, or have access to full credit card number data, but we may receive some limited information, including credit-card-related data (including a security token reflecting your payment method), data about the product or service purchased, the date, time, and amount of the purchase, the type of payment method used, and partial digits of the card number.

3. Your Comments

You may provide personal information to us through our "Contact Us" form or by sending an email to our email address (including through the data processor of the communication service provider referred to in Section 4). This information may include any comments you fill in when submitting an inquiry.

2.2 Data We Collect Automatically

1. Data on How You Found Us

We collect data about your referral URL (i.e., the web location where you clicked on our advertisement).

2. Device and Location Data

We collect data from your device. Examples of such data include: language settings, IP address, time zone, device type and model, device settings, and operating system and its version.

3. Usage Data

We record how you interact with the Service. For example, we record your clicks/taps in specific areas of the interface, the features and content you interact with, how often you use the Service, how long you stay in the Service, your subscription orders, and your questionnaire, question bank, and report activities (e.g., completing the assessment and viewing your report). We also record your interactions with advertisements in the Website (and the internet links those advertisements point to).

4. Transaction Data

When you make a payment through the Service, you are required to provide financial account data, such as your credit card number, to a third-party service provider. We do not collect or store full credit card number data, but we may receive credit-card-related data and data about the transaction, including: the date, time, and amount of the transaction, and the type of payment method used.

5. Cookies and Similar Tracking Technologies

Our products use related technologies (Cookies and similar technologies) to process your data, in order to improve user experience and analyze traffic. These technologies are activated when you interact with the Service or visit our Website. Disabling these technologies may affect the use of certain features, but our products remain usable.

A Cookie is a small text file stored on a user's computer to record usage. Cookies can be session cookies or persistent cookies. Session cookies expire when you close your browser and are used to make it easier for you to navigate our Service. Persistent cookies remain on your hard drive for a longer period. We also use tracking pixels that set Cookies to assist in delivering online advertising.

Cookies are classified by origin:

  • First-party Cookies are set by our Website under its domain and subdomains;
  • Third-party Cookies are Cookies used within our Service and set by other organizations. These include Cookies from external services that help protect our Website and provide additional services (customer support portals, online web chat, etc.).

Cookies are especially used to automatically identify you on your next visit to our Website. Therefore, information you previously entered in certain fields of the Website may automatically appear the next time you use the Service. Cookie data will be stored on your device, in most cases only for a limited period of time.

We respect your privacy and provide you with a choice, not allowing data processing that is not necessary to provide the service you requested.

We process your personal data for the following purposes:

| Purpose of Processing | Description and Examples | Categories of Personal Data | Legal Basis | | Provide our Service and exercise contractual rights and obligations | This includes enabling you to use the Service seamlessly, and preventing or addressing Service errors and technical issues, including generating your personalized report based on the questionnaire you complete. To host personal data and enable our Website to operate and be distributed, we use the infrastructure providers and regions we select, i.e., hosting and backend services. | Identity and contact data, commercial information (for paid Services), Service usage data | Performance of our contract with you and our legitimate interests — including safeguarding our rights after termination of the Service. After we cease providing the Service to you, we may continue to process your personal information for a limited time. We do this to perform our contract with you and protect our legal rights. | | Communicate with you about your use of the Service | We communicate with you via email and other means (using the details you provide, including your name). These may include information about the Service, certain important changes, and special offers. To unsubscribe from emails, you should click the unsubscribe link in the footer of our emails. The services we use for these purposes may collect data about the date and time users view messages and their interactions with messages (such as clicking links contained in messages). | Identity and contact data | Our legitimate interests (customer interaction) or your express consent | | Personalize advertising for you | We and our partners use your personal data to customize advertising and may show it to you at relevant moments. | Onboarding information, device and geolocation data, advertising identifiers; Cookies and similar tracking technologies | Consent or legitimate interests (unless consent is required, e.g., where subject to specific e-Privacy regulations) | | Manage your account and provide customer support | We process your personal data to respond to your technical support, Service information, or any other communication requests you initiate. This includes accessing your account to handle technical support requests. For this purpose, we may send you notifications regarding Service performance, security, payment transactions, and matters involving our Terms and Conditions or this Privacy Policy. Our customer support providers provide messaging and customer service tools that enable us to communicate with you within the Service. | Identity data, contact data, Service usage data, and other data | Performance of our contract with you and our legitimate interests — ensuring effective customer support and satisfaction | | Research and analyze your use of the Service | This helps us better understand our business, analyze operations, maintain, improve, innovate, plan, design, and develop the Service and our new products. We also use this data for statistical analysis purposes to test and improve our programs. This allows us to better understand which features and learning plans users prefer in the Service. | Identity and contact data, device-related data, website usage data, Service usage data | Legitimate interests — enhancing platform performance and security | | Analyze how visitors use the Service and measure the effectiveness of some advertising | We use analytics services (e.g., web analytics platforms) that set Cookies on your device to provide us with aggregated information about user interactions within the Service, helping us decide which features to focus on. | Device-related data, website usage data, Service usage data | Legitimate interests (unless consent is required, e.g., involving special-category personal data, or where the processing method is subject to specific e-Privacy regulations) | | Send you marketing communications | Where we have obtained consent or otherwise established a legal basis, we process your personal data for marketing activities. You will receive information about our products, such as special offers. If you do not wish to receive our marketing emails, you may unsubscribe following the instructions in the marketing email footer. We use marketing and email service providers to communicate with you. The specific providers we select may change from time to time. | Identity and contact data | Our legitimate interests (customer interaction) or your express consent (in jurisdictions permitting exceptions to consent requirements) | | Process your payments | We provide paid features and/or Services within the Service (including access to your personalized report). For this purpose, we use third-party payment processing services (e.g., PayPal). We do not store or collect your payment card details ourselves. That information is provided directly to our third-party payment processor. | Identity data, commercial information, device and geolocation data | Performance of our contract with you | | Enforce our Terms and Conditions and prevent and combat fraud | We use personal data to enforce our agreements and contractual commitments, and to detect, prevent, and combat fraud. As a result of such processing, we may share your information with others (including law enforcement authorities, especially when a dispute arises regarding our Terms and Conditions). | All categories | Performance of our contract with you and our legitimate interests |

Comply with legal obligations When required by law, we may process, use, or share your data, especially when law enforcement authorities request your data through available legal means. All categories Compliance with legal obligations

4. Who We Share Your Personal Data With

We share information with third parties that help us operate, provide, improve, integrate, customize, support, and market the Service. We may share certain personal data sets, in particular for the purposes described in Section 3 of this Privacy Policy.

The types of third parties with whom we share information include in particular:

4.1 Service Providers

We share personal data with third parties we engage to perform services or business functions on our behalf or on our account, including cloud hosting/infrastructure providers (the infrastructure providers and regions we select). We share your personal information with the following types of service providers:

  • Data analytics providers
  • Marketing and advertising partners
  • Payment processing providers (PayPal)
  • Communication / customer support providers

We require each service provider to use your personal data only for the purpose for which we engaged them and to comply with applicable laws and regulations.

4.2 Law Enforcement and Other Public Authorities

We may use and disclose personal data to enforce our Terms and Conditions, to protect the rights, privacy, safety, or property of us and our affiliates, you, or others, and in response to requests from courts, law enforcement agencies, regulatory agencies, and other public and governmental authorities, or in other circumstances required by law.

4.3 Third Parties in Mergers or Acquisitions

As our business develops, we may buy or sell assets or businesses. Customer information is often one of the business assets transferred in such transactions. We may also share such information with any affiliated entity (such as a parent or subsidiary company) and may transfer such information in connection with a corporate transaction (such as the sale of our business, divestiture, merger, consolidation, or sale of assets), or in the rare event of bankruptcy.

5. How to Exercise Your Privacy Rights

To control your personal data, you have the following rights:

  • Access / review / update / correct your personal data. You may request a copy of your personal data and request that we update/correct the personal data collected during your use of the Service via [email protected].
  • Delete your personal data. You may request deletion of your personal data by sending an email to [email protected]. When you request deletion of personal data, we will use reasonable efforts to fulfill your request. In some cases, law may require us to retain certain data for a period of time; in such cases, we will fulfill your request after we have met the relevant obligations.
  • Object to or restrict the use of your personal data. You may ask us to stop using your personal data or to restrict our use. For example: Email marketing: We provide you with the ability to unsubscribe from email marketing communications via the unsubscribe link in each email or by contacting our support team. e-Privacy settings: We also bring EU privacy features to global customers, allowing you to influence tracking decisions at a granular level by purpose (this is typically achieved by interacting with the e-Privacy settings area, which is usually located in the footer, menu, or profile area of our product).

5.1 How to Opt Out of or Influence Personalized Advertising

  • iOS: On an iPhone or iPad, go to "Settings", then "Privacy", tap "Advertising" to select "Personalized Ads". In addition, you can reset your advertising identifier in the same area (this may also help reduce the personalized ads you see).
  • Android: To opt out of ads on an Android device, simply open the Google Settings app on your phone, tap "Ads" and enable "Opt out of Ads Personalization". In addition, you can reset your advertising identifier in the same area (this may also help reduce the personalized ads you see).
  • macOS: On a MacBook, you can disable personalized ads: go to "System Preferences" > "Security & Privacy" > "Privacy", select Apple Advertising, and uncheck "Personalized Ads".
  • Windows: On a laptop running Windows 10, you should select "Start" > "Settings" > "Privacy", then turn off the setting "Let apps use advertising ID to make ads more interesting to you based on your app activity". If you use another version of Windows, please follow the steps here.

*To learn more about how to influence advertising choices on various devices, please see the materials provided here. Advertising/analytics partners: We use advertising and marketing partners and analytics providers to measure and customize advertising. Each provider offers its own opt-out mechanism; please refer to their respective privacy policies for how to control it.

  • Meta / Google / TikTok (where applicable): If we use these platforms to deliver advertising, you can control personalized advertising through each platform's advertising settings. We will note the specific platforms we use in the relevant product's e-Privacy settings or footer.

If you are located in the EEA, you have the right to complain to a supervisory authority. We very much prefer that you contact us directly so that we can address your concerns. Nevertheless, you still have the right to complain to the competent data protection supervisory authority, in particular the authority of the EU member state where you reside, work, or where the alleged infringement occurred.

  • Right to data portability. If you wish to receive your personal data in a machine-readable format, you may send a corresponding request to [email protected].

To exercise any privacy right available to you, please send a request to [email protected].

To contact us, you may send an email directly to [email protected].

EU and UK Representative:

We are established outside the EU and the UK and currently do not serve users in these regions. Therefore, we have not currently appointed a Article 27 GDPR / UK GDPR representative. If we begin serving EU or UK users, this section will be updated.

6. Age Restriction

We do not knowingly process personal data of persons under 18 years of age. If you become aware that any person under 18 has provided us with personal data, please contact us at [email protected].

7. International Data Transfers

To provide the services specified in the Terms and Conditions and for the purposes described in this Privacy Policy, we may transfer personal data to countries other than the country where it was initially collected. If those countries do not have data protection laws identical to those of the country where you initially provided the information, we will take special safeguards.

In particular, if we transfer personal data originating from the EEA to a country with inadequate data protection, we will use one of the following legal bases: (i) Standard Contractual Clauses approved by the European Commission (details here); or (ii) an adequacy decision of the European Commission regarding certain countries (details here).

8. Changes to this Privacy Policy

We may modify this Privacy Policy from time to time. If we decide to make a material change to this Privacy Policy, we will notify you through our Service or other available means, and you will have the opportunity to review the revised Privacy Policy. Continuing to access or use the Service after the change takes effect means you agree to be bound by the revised Privacy Policy. If we launch new features, we will update this Privacy Policy to explain the personal data involved.

9. California Privacy Rights

This section provides supplemental information about how we handle the personal data of California consumers and their rights under the California Consumer Privacy Act ("CCPA") and California's "Shine the Light" law. Therefore, this section applies only to residents of California, United States.

Under the "Shine the Light" law, residents may ask a business once a year what personal information it has shared with third parties for those third parties' own direct marketing purposes. Learn more about what is considered personal information under this law. We do not share your personal information with third parties for their own direct marketing purposes within the meaning of this law.

In addition, the CCPA provides you with the right to opt out of the sale or sharing of, and to limit the use of, personal information. We may share certain information with partners for targeted advertising or data analytics purposes, which in some cases may be characterized as "sale," "sharing," or "targeted advertising" under California law. You have the right to opt out of such sale/sharing of personal information.

Depending on the product you use, we will strive to provide a prominent link called "Your Privacy Choices" that enables you to exercise this right. In most cases, it will be available to you in the footer, menu, profile, or a similar location (depending on the product and device you use).

We will also strive to identify and process your opt-out preference signal as soon as possible after we receive it.

10. Data Retention

We will store your personal data for the period reasonably necessary to achieve the purposes set out in this Privacy Policy (including providing you with the Service), which period includes (but is not limited to) the period during which you have an account with the Service. We will also retain and use your personal data to the extent necessary to comply with legal obligations, resolve disputes, and enforce our agreements. For example, under certain accounting and tax laws, we are required to store commercial information for a long period to comply with the laws applicable to us. Therefore, even if you submit a data deletion request, a small portion of data related to our compliance obligations will still be stored after your request is fulfilled.

11. Handling of "Do Not Track" Requests

Except as otherwise provided in this Privacy Policy, this Website does not support "Do Not Track" requests. To determine whether any third-party service it uses complies with "Do Not Track" requests, please read its privacy policy.

12. Contact Us

Company: Hong Kong Xingyue Network Technology Limited

Address: Room 511, 5/F, Ming Sang Industrial Building, 19-21 Hing Yip Street, Kwun Tong, Hong Kong

Email: [email protected]