Privacy Policy

Finsighty is accounting and business software for Indian small businesses. This policy explains what information we hold, why, who we share it with and the choices you have. It is written to meet the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology Act, 2000.

Who is responsible for your data

For your own account (your name, email, phone and login) Finsighty is the data fiduciary. For the records your business keeps in Finsighty (clients, vendors, invoices, expenses, employees, payroll) your business decides what is collected and why, and we process it on your business's behalf.

What we collect

• Account details: name, email address, password (stored only as a secure hash), business name.
• Business records you enter or import: clients, vendors, products, invoices, quotes, expenses, bank accounts and statements, GST details, employees, attendance and payroll.
• WhatsApp: the number you link in Settings, messages, bill photos and voice notes you send to the Finsighty number, and your clients' numbers when your business sends them invoices, reminders or statements.
• Technical data: IP address, browser type, and error reports, used to keep the service secure and working.

How we use it

• To run the service: keep your books, create invoices and reports, and send the messages you ask us to send.
• AI features: when you use the assistant, bill scanning, voice notes, HSN lookup or insights, the relevant text, image or audio is sent to an AI provider to produce the answer. Providers may not use it to train their models under the terms we use them on.
• Security: rate limiting, fraud and abuse prevention, and an activity log of changes in your business.
• We do not sell your data and we do not use your business records for advertising.

Who we share it with

Only the service providers that run parts of Finsighty for us, each bound to protect the data:

• Supabase (database and login), Vercel (hosting), Sentry (error reports).
• Google, Groq, OpenAI and Anthropic (AI features, only when you use them).
• Meta (WhatsApp messages), Resend (email), Cloudflare (sign-up protection).

Some of these providers store or process data outside India. We may also disclose data where Indian law requires it.

WhatsApp consent

Your business sends a client WhatsApp messages only after marking that client as having agreed to receive them, and the date of that consent is recorded. A client can ask the business to stop at any time.

How long we keep it

We keep your business records while your account is active. Indian tax law generally requires accounting records to be kept for at least eight years, so we recommend exporting your data before closing an account. After you ask us to delete an account, we delete or anonymise its data within 90 days, except where the law requires us to keep it.

How we protect it

Every business's data is kept separate by rules inside the database, so one business can never see another's. Connections are encrypted, passwords are hashed, access within a business follows the role the owner gives each member, and changes are recorded in an activity log.

Your rights

You can ask to see, correct, or delete your personal data, withdraw consent, and nominate someone to act for you. If your data is in a business's records (for example, you are a client of a business using Finsighty), please contact that business first; we will help them respond.

Contact and grievances

Write to our Grievance Officer at hello@finsighty.com. We will acknowledge your request within 48 hours and resolve it within 30 days. If you are not satisfied, you can complain to the Data Protection Board of India.

Changes

If we change this policy in a way that matters, we will tell you in the app or by email before it takes effect.