At FinFlow, we believe your financial data belongs to you. This Privacy Policy explains what information we collect, how we use it, and the rights you have over your data.

Statutory Framework & Key Definitions

This Privacy Policy is framed in compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act) of India. For the purposes of this Policy:

Data Principal: Refers to you, the individual user accessing FinFlow and sharing personal data.

Data Fiduciary: Refers to FinFlow (operated by Sadab Munshi), which determines the purpose and means of processing your personal data.

Data Processor: Refers to trusted third-party service providers (e.g., cloud hosts, AI processors, communication gateways) who process personal data strictly on behalf of FinFlow.

What We Collect

Account Information: When you create an account, we collect your email address and authentication credentials. This is necessary to provide secure access to your account across devices.

Financial Data: The transactions, budgets, and financial information you enter into FinFlow are stored securely on our cloud infrastructure using industry-standard encryption. Your data is protected both in transit (TLS/SSL) and at rest.

Usage Data: We collect anonymous, aggregated information about how you interact with FinFlow — such as feature usage frequency — to help us improve the product. This data never includes your personal financial details.

AI Features

When you use AI-powered features such as receipt scanning, voice transcription, or financial insights, certain data is processed by our AI service providers acting as Data Processors. This may include receipt images, voice recordings, or transaction descriptions. We transmit only the minimum data necessary, and we partner exclusively with providers who maintain strict confidentiality and data-protection standards. Your data is never used to train third-party AI models without your explicit consent.

How We Use Your Data

To Provide Services: We use your data to operate FinFlow, process your transactions, generate reports, deliver budget alerts, and power the features you request.

To Improve Our Services: We analyse anonymous usage patterns to understand how our platform is used and to make meaningful improvements.

To Communicate With You: We may send you service-related notifications, security alerts, monthly reports, and occasional updates about new features. You can opt out of non-essential communications at any time from Settings.

Data Security

We take the security of your data seriously. All information is encrypted in transit using TLS/SSL and encrypted at rest on our secure cloud infrastructure. Access controls, regular security audits, and monitoring help ensure that your data remains protected at all times.

While we implement robust safeguards, no security system is completely impenetrable. We encourage you to use a strong, unique password and to keep your devices secure.

Data Sharing & Third Parties

We do not sell, rent, or share your personal financial data with any third party for marketing or advertising purposes. Data may be shared only with Data Processors that are strictly necessary to operate FinFlow (e.g., AI processing, email delivery), and only under binding confidentiality agreements.

Your Statutory Rights as a Data Principal

Under the DPDP Act, 2023, you hold specific statutory rights regarding your personal financial data:

Right to Access & Information (Sec 11): You can request a summary of the personal data being processed by FinFlow, the processing activities undertaken, and the identities of all Data Processors with whom your data has been shared. You can also access and export your data at any time through the web app.

Right to Correction & Erasure (Sec 12): You can edit or correct inaccurate data directly within the app. You also have the right to request complete erasure of your personal data when the processing purpose is completed or upon withdrawal of consent. Account deletion permanently removes associated data from our systems.

Right to Withdraw Consent (Sec 6(4)): You may withdraw your consent for data processing at any time through Account Settings. The ease of withdrawing consent is equivalent to giving consent. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

Right to Nominate (Sec 14): You have the right to nominate another individual who shall, in the event of your death or incapacity, exercise your rights as a Data Principal.

Right to Grievance Redressal (Sec 13): You have the right to seek redressal of any grievances regarding your personal data directly through our Grievance Officer and subsequently appeal to the Data Protection Board of India (DPBI).

Personal Data Breach Protocol

In the event of a personal data breach affecting your information, FinFlow will notify the Data Protection Board of India (DPBI) and each affected Data Principal without undue delay, detailing the nature of the breach, potential impact, and remedial measures undertaken (Sec 8(6)).

Multilingual Consent Notice

In accordance with Section 5(1) of the DPDP Act, this Privacy Policy and consent notices are available in English. You may request a copy of this notice or consent options in any of the 22 languages specified in the Eighth Schedule to the Constitution of India by contacting our Grievance Officer.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal compliance. If we make significant changes, we will notify you through the app or by email. The updated policy will always be available on this page with the effective date clearly displayed.

Grievance Redressal & Data Protection Officer

In compliance with Section 8(10) and Section 13 of the DPDP Act, 2023, FinFlow has appointed a Grievance Officer to handle all data protection inquiries, requests, and grievances.

Designation: Data Protection & Grievance Officer

Email: contact@sadabmunshi.me

Response Timeline: All grievances will be acknowledged within 48 hours and resolved within 30 days of receipt.

Appeal to the Data Protection Board of India (DPBI)

If you do not receive a response within 30 days or are dissatisfied with the resolution provided by our Grievance Officer, you have the statutory right to register a complaint with the Data Protection Board of India (DPBI) in accordance with the provisions of the DPDP Act.

Contact

If you have any questions about this Privacy Policy or how we handle your data, please contact us at contact@sadabmunshi.me. We are committed to addressing your concerns promptly.