Privacy policy

1. Two kinds of data, two roles

Your account. When you register, we collect the details needed to run your account. For this data we are the Data Fiduciary.

Your clients' and your business's records. Bills, bank statements, Tally books and similar records that you upload or connect are processed by us on your behalf. For these, you (the firm or business) are the Data Fiduciary and we are your Data Processor, under our data processing terms. We use them only to provide FinCom to you.

2. What we collect

• Account details: name, email, phone number (if given), firm name, role, and your password (stored only as a one-way hash by our sign-in provider).
• Records you process: documents and data you upload or read from Tally, such as supplier and customer names, GSTIN, PAN, invoice details, bank transactions and salary figures.
• Usage and security records: sign-in times, the browser and device used, IP addresses in our server logs, and the actions recorded in the audit trail.
• Payments: amounts, dates and invoice details. We do not collect or store card numbers.
• Support: what you write to us and any files you attach to a ticket.

3. Why we use it

• To provide FinCom: read documents, work out tax, prepare returns and reports, and post to Tally at your instruction.
• To keep accounts secure, detect misuse and investigate incidents.
• To bill you and meet tax and accounting law.
• To answer your questions and tell you about changes to the service. We do not send marketing without your consent.

We process account data on the basis of your consent given when you register and for the legitimate uses the law allows, such as meeting legal obligations. You may withdraw consent at any time; the service then stops for that account.

4. Cookies and browser storage

FinCom does not use advertising or tracking cookies, and the website has no third-party analytics. The app keeps a working copy of your firm's data in your browser's own storage so that work continues if the internet drops; you can remove it at sign-out on a shared computer. This storage is needed for the service and is never read by anyone else.

5. Who we share it with

We do not sell personal data. We share it only with service providers who process it for us under contract, listed on our security page: data hosting in India, and, only when your firm chooses AI reading, Anthropic or Google to read a bill image. We may also disclose data when required by law, a court or a government authority.

6. Data outside India

Account and firm data are stored in India. When AI reading is chosen, the bill image is processed by the provider, which may be outside India, and is not kept by them for training. Transfers are made only to countries not restricted under the DPDP Act.

7. How long we keep it

We keep data while your account is active. When an account is closed, firm data is deleted within 90 days, and backups age out within a further 14 days. Our own billing records are kept for the period tax law requires (currently eight years). Audit trail entries are kept for at least 180 days as CERT-In requires.

8. How we protect it

Firm data is isolated by the database, encrypted in storage and in transit, and changes are recorded in an audit trail that cannot be edited. Details are on our security page. If a breach affects your data, we tell your firm without delay and report to CERT-In and the Data Protection Board as the law requires.

9. Your rights

You may ask to see, correct or erase your personal data, withdraw consent, and nominate a person to act for you. For records processed on behalf of a firm, please ask the firm first; we help them respond. Write to [privacy email]. We reply within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India.

10. Children

FinCom is for businesses and professionals. It is not meant for anyone under 18, and we do not knowingly collect their data.

11. Grievance Officer

[name of the Grievance Officer], Grievance Officer, Yuvnav Services Private Limited, [registered office address, Noida, Uttar Pradesh, PIN]. Email [privacy email]. We acknowledge complaints within 48 hours and aim to resolve them within 30 days.

12. Changes to this policy

If we change this policy in a way that matters, we tell account owners by email or in the app at least 15 days before the change takes effect.