small fintech privacy compliance