Privacy Policy

• Account data — your email address (sign-in); the name you give when you set up your account, which you can change on the Account page; and, optionally, your mobile number.
• Portfolio data you enter — investments, transactions, fixed deposits, loans, and goals. This is your data; we process it only to run the service for you.
• A statement you upload: if you choose to add holdings from the consolidated account statement your mutual-fund registrar sends you, we read that file on our server to list the holdings and transactions it contains, and we keep only the ones you then choose to add as your records. The file itself, the password you enter to open it, and the other personal details printed in it are not kept.
• Payment data — your payment is handled by our payment processor (Razorpay). We do not store your complete card, UPI or bank credentials: we do not receive or hold a full card number, CVV, expiry date, UPI PIN or banking password. We do store, verbatim and for up to 90 days, the messages Razorpay sends us when a payment succeeds or is refunded. Because we attach your account identifier to the order when checkout starts — so that the payment can be matched to your account when it succeeds — the message comes back carrying it, and the stored copy therefore holds your account identifier and a payment reference built from it, along with the email address and phone number you gave at checkout and the details of the instrument used — for a card, its last four digits, network and issuing bank; for UPI, the UPI ID (VPA) you paid from; for netbanking, the bank. After 90 days those contents are overwritten and only the record that a payment happened remains. See Retention schedule and Deleting your account.
• Security & technical data — sign-in and two-factor events (including failed sign-in attempts — the Retention schedule says what a failed attempt records), a record when your own entry adds a new instrument to the shared catalogue, and standard logs, used to secure your account.
• Usage measurement — first-party, in our own database, with no analytics company involved:
  • On public pages (home, sign-in, sign-up): a count per day of the page and how you arrived — from a search engine, YouTube, another website, a campaign link, or directly (or “other” when we cannot tell). No cookie, no identifier and no IP address is stored, and we cannot tell one visitor from another. We do not treat these aggregated counts as personal data, because they do not identify or relate to an identifiable individual in our systems.
  • When you are signed in: the calendar days on which you used Finachiva — one date per day and nothing else. The record we keep is your account and a date. Not the pages you open, not the actions you take, not your holdings, and not any amount. It is used only to understand whether people come back.
    This measurement is part of the service and is covered by the single acceptance of the Terms of Service and this Policy — there is no separate box for it at sign-up. You can switch it off at any time in Account → Privacy, which also deletes the days already recorded for you. See Consent & legal basis.
  • Milestone dates we work out from your own records: when you signed up, and when you first created a goal, first added an investment, first recorded a transaction, first linked an investment to a goal and first subscribed — together with whether you are on a paid plan today. We store nothing extra for this: each date is read back from the record you created, and we look at them only as totals across all users (how many people reached each step, and how long it took), never as a profile of you.
    These milestone dates are derived from records already created as part of your use of Finachiva. They are not maintained as a separate usage-tracking dataset, so the usage-measurement switch does not stop this processing: there is no separate record to switch off. The underlying records, and any milestone information derived from them, are removed when the relevant account data is deleted, subject to records that must lawfully be retained.
  For the two measurements above, this is what we do not do: neither stores your IP address or your browser identity, neither uses them to build an identifier, and the public-page counts hold no identifier at all. There is one place we do store them — the consent record described next — and our hosting providers keep their own standard request logs, which we do not set and cannot shorten (see Who we share it with).
• Consent records — every time you accept these documents, or switch usage measurement on or off, we write down that choice: your account, what you accepted or changed, the version of the document, whether it was a grant or a withdrawal, and when. As evidence that the choice was really made, each record also stores the IP address the request came from and the browser identity (user-agent) it was made with. Apart from our providers' own request logs, these are the only records of ours that hold your IP address. They are included in your data export, and they are deleted when you delete your account — see Retention schedule.
• Account activity timestamps — the first and most recent dates on which you open the signed-in Finachiva application. We record these dates to administer your account, identify accounts that may qualify for deletion after a period of inactivity, and cancel a pending deletion if you sign in again. These records are separate from usage measurement and are included in your account export.
• Cookies — essential session cookies to keep you signed in, and one cookie that records only that you are signed in on this browser, so that pages we serve from cache show you the right links. It holds no information about you — the same value for everyone — and it is removed when you sign out. We do not use advertising or tracking cookies.

To provide and secure the service: authenticate you, compute your portfolio's value and projections, process subscriptions, prevent abuse, and provide support. We do not use your portfolio data for advertising.

We also measure how Finachiva is used (see Data we collect) for one purpose: to see which pages and channels bring people to Finachiva, whether new users reach a working portfolio, and whether they return, so we can improve onboarding and decide where to spend effort. This measurement is never used for advertising, never combined with the contents of your portfolio (amounts, holdings, names), and never shared with an analytics company.

We process personal data on the ground applicable to each purpose. Some processing is necessary to provide and secure Finachiva, to process your transactions, and to meet our legal obligations. Where we rely on consent, we ask for it and provide a way to withdraw it, as described below. Accepting the Terms of Service and this Policy is a single acceptance covering both documents.

What that acceptance includes. It includes the signed-in usage measurement described above — one calendar date per day you use Finachiva, and nothing else — and our reading of the milestone dates already held in your own records. We describe both here, in full, rather than in the sign-up checkbox, because a checkbox is not where a processing purpose can be explained properly. These two are the only processing covered by your acceptance that is not needed to run the service for you, and only the first of them can be switched off, for the reason given below.

Switching usage measurement off. You can do this at any time, without giving a reason and without closing your account: Account → Privacy. Turning it off stops any further day being recorded and deletes the days already stored for you. Turning it back on later records days from that point; it does not bring back the deleted ones. Nothing else about your account changes either way.

What that switch does not cover. It covers the usage days, because those are a separate record we keep and can therefore stop keeping and delete. It does not cover the milestone dates described above, because those are not a separate record: they are read from your own goals, investments, transactions and subscriptions each time we look, so there is nothing there to switch off or delete short of deleting the records themselves — which happens when you delete your account.

What a new version does to this setting. Because this measurement is part of the single acceptance, accepting a new version of these documents turns it back on, and the days recorded from that point are kept as usual. It does not bring back days deleted earlier. You can switch it off again in Account → Privacy at any time, and we say so here because the re-consent screen asks you to accept the documents rather than to make this choice again.

Withdrawing the rest. Some processing is necessary to provide Finachiva and cannot simply be withdrawn while you continue to use the service — holding your portfolio is what the service is. Where applicable law gives you a right to object to, restrict, or withdraw consent for a particular purpose, we provide the applicable mechanism. If you choose to stop using Finachiva entirely, you can delete your account (see Deleting your account). An account on the Free plan that is not used for twelve months is deleted by us after notice, as section 7 describes. The public-page counts relate to no identifiable individual and need no consent.

We never sell your data. We disclose personal data to service providers where reasonably necessary to provide, secure, maintain, or support Finachiva, subject to applicable law and appropriate contractual or other safeguards:

• Supabase — database, authentication, and hosting (region: ap-south-1 (Mumbai)).
• Razorpay — payment processing.
• Supabase Auth and Zoho Mail — Supabase Auth and we create our account emails (sign-up confirmation, password resets, and security alerts such as a password change or a change to two-step verification), and Zoho Mail delivers them from noreply@finachiva.com. Zoho also delivers reminders before a Pro period ends, a message when a Pro period starts and when it ends, one welcome message when you set up your account, the three notices sent before an unused Free account is deleted (see Deleting your account), and the confirmation sent when an account is deleted, which states the reason when the deletion was under the inactive-account rule, and hosts our support, privacy and grievance mailboxes — so it holds your email address and anything you write to us.
• Vercel — application hosting, which keeps standard request logs for security.
• Sentry — error monitoring. When a page fails to load or our server hits an error, a report goes to Sentry so we can find and fix it: the error message and where in our code it happened, the page's path (without anything after “?”), and whether it happened in your browser or on our server. We set Sentry not to store IP addresses. A report can include what an error message itself contains; we do not send your cookies, form entries, holdings, card details, bank account, phone number or email address. Sentry processes these reports outside India, in the United States.
• Cloudflare — two services. DNS: the zone is DNS-only, not proxied, so Cloudflare answers the lookup that turns finachiva.com into an address and your requests then go directly to Vercel; it does not carry, terminate, or log them. Turnstile: the security check on the sign-in, sign-up and password-reset pages. On those three pages it runs in your browser and sends Cloudflare technical signals — your IP address, your browser's user-agent, and a connection fingerprint — so that it can tell a person from an automated script; we receive only a pass or a fail. Turnstile sets no cookies. Cloudflare also uses those signals to improve its own bot detection, under its Turnstile privacy terms.

We use no third-party analytics provider; usage measurement (see Data we collect) stays in our own database.

Vercel and Supabase keep their own request logs under their own retention periods, which we do not set and cannot shorten. The schedule below covers the records we hold.

Market prices are sourced from public, third-party end-of-day market data and are not personal to you.

Data is encrypted in transit. Each user's data is isolated at the database level (row-level security), and accounts can be protected with two-factor authentication (required on paid plans). We retain your data while your account is active.

Where it is processed. The database is in Supabase's ap-south-1 (Mumbai) region and the server functions that build your pages run in Vercel's Mumbai region — both in Mumbai, India. Error reports (see Sentry in section 4) are the exception: they are processed outside India.

Backups. We take a backup copy of the whole database once a day, and again just before we change the database's structure, and keep the most recent 14. That is a count of copies, not a length of time: a copy is deleted only when a new one has been taken successfully, so fourteen copies normally reach back about two weeks, but if a day's backup fails or does not run, nothing is deleted that day and the oldest copies stay a while longer. A backup holds everything the database held at the moment it was taken, including account records, and is used only to restore the service after a failure.

This has a consequence we would rather state than let you assume: something you delete disappears from the live service straight away, but a copy of it can still exist inside a backup until that backup is overwritten. If we ever had to restore from one, records you had deleted could reappear in the restored copy — in which case we would delete them again.

Each kind of record is kept for as long as the table says and then removed. These are not intentions: every period below is enforced by a job that runs weekly against the live database, or — for backups — by the daily backup itself. Eight rows work differently, and the table says so where they appear:

• a payment-processor message whose processing never completed is not reached by the weekly job until we settle it by hand;
• your consent records have no expiry job at all — they last as long as your account and are deleted with it;
• the record that we sent you a welcome email is the same: it lasts as long as your account, because it is what stops a second welcome, and it is deleted with it;
• your account activity timestamps are the same: no job expires them — they last as long as your account and are deleted with it;
• the inactive-account rule is enforced by a job that runs every day, not every week, and what it removes is the whole account (see Deleting your account);
• the inactive-account notice records are kept only while a deletion is pending: they go when you sign in or with the account, never by the weekly job;
• an unconfirmed sign-up is removed by a job that runs every day, 30 days after the sign-up, after one reminder; it is a registration that was never verified, not an account in use;
• backups are pruned by count rather than by age, so the period they reach back over varies (see Storage, security & backups).

Where the law requires a longer retention period for specific records, we keep only those records for the required period.

You can delete your account at any time: Account → Your data → Delete account. Your data is removed from the live service immediately. That word is accurate about the live service, and we do not want it read more widely than it should be, so here is the complete picture — including the records that survive and why.

• Removed from the live service at once — your portfolio data (investments, transactions, fixed deposits, loans, goals, manual valuations), your profile, your subscription and credit records, and your usage days.
• Kept, without the link to your account — payment and order records, including refunds and any coupon redemptions, which we are required to keep for tax and accounting. Your account identifier is removed from them, so they can no longer be traced back to you through the app.
• One confirmation email is sent to the account's address after the deletion, stating when it happened and what this section describes. Sending it is itself one further use of that address, which is why it is named here.
• Kept, and not de-identified — one record deliberately holds your email address. Deleting an account writes a single entry in our security log recording that the deletion happened, and that entry stores the email address of the account and, when the deletion was under the inactive-account rule, the reason and the dates the notices were sent. We retain this limited record for security, accountability, and to maintain evidence that the account-deletion request was processed. It is kept for 12 months like the rest of the security log, and is then deleted with it. Your other sign-in and security events survive the deletion with the account link removed; this one entry is the exception and keeps the email address until it is deleted with the rest of the security log. We do not use retained security records after account deletion to recreate your deleted portfolio or to continue providing services to you.
  It is also the only entry in the security log that holds an email address: no other kind of event we record — sign-ins, failed sign-ins, two-factor events, password changes, a new instrument your entry adds to the shared catalogue (which holds only that instrument's identifiers and name) — stores one.
• Kept for up to 90 days, and still carrying your account identifier — the messages our payment processor sent us about your payments. We attach your account identifier to the order when checkout starts, so that a successful payment can be matched to your account; the processor sends it back to us, and we store each message word for word, identifier and all. These messages sit outside the account structure, so deleting your account does not reach them: it neither removes them nor strips the identifier out of them.
  What ends the link is the overwrite. Their contents — the account identifier and the payment reference built from it, the email address and phone number given at checkout, and the details of the instrument used (card last four digits, network and issuing bank; UPI ID; or bank) — are overwritten 90 days after the message arrived, unless processing of that message never completed, in which case they are overwritten once we settle it by hand. After that the message keeps only its own identifier, its type, when it arrived and how it was handled: an accounting record with nothing in it that points back to you.
• Present in backups until they are superseded — we keep the most recent 14 copies, which is a count of copies rather than a fixed period; see Storage, security & backups.

When we delete an inactive Free account. If your account is on the Free plan and you have not opened Finachiva for twelve months, counted from the latest of the date you last opened it, the date the account was created and 2 November 2026, the day this rule took effect, we send a notice to your account's email address and a notice period starts: sixty days, or ninety days if your account has ever had a paid Pro period. A second notice follows thirty days before the end and a final one seven days before. Signing in at any point during that period cancels the pending deletion and starts the twelve months again; nothing else is needed, and you can export your data at any time before the end. If you do not sign in, the account is deleted after the period, once all three notices have been sent to that address, no delivery failure has been reported to us, at least seven days have passed since the final notice, and the account still qualifies at the moment of deletion. The deletion has the same effect as one you make yourself (above), with one difference: the security-log entry described there also records the reason and the dates the three notices were sent. The confirmation described there is sent, stating that the account was deleted for inactivity.

An account with an active paid or complimentary Pro period is never deleted under this rule; an account whose paid period has ended is on the Free plan and the rule applies to it. A sign-up whose email address was never confirmed is handled by the shorter rule in section 6 (an unconfirmed sign-up), not by this one. Records the law requires us to keep remain for their required period, and copies in our backups disappear as section 5 describes, not at once.

Subject to applicable law, you can do each of the following. We may need to verify your identity before completing a request involving access, correction, deletion, export, or the exercise of rights on your behalf.

• Access and correct your personal data (edit it in your account, or ask us).
• Export all your data (Account → Your data → Export your data, as JSON, including your usage days and your consent records). This export is available on every plan.
  Your day-by-day portfolio value history is a separate thing, and we would rather be exact about it than tidy: it is not one of your transactions but a figure we calculate for each day from your holdings and that day's market prices. It is not part of the JSON export, and we have kept it out on purpose — it is one line per holding per day, which would run to tens of thousands of lines and bury the records most people open the file to read. You can download it as a CSV from Transactions → Export CSV, which is a paid feature. Your right of access does not depend on paying for it: ask us at privacy@finachiva.com and we will send you that history, whatever plan you are on.
• Switch usage measurement off, and delete the usage days already recorded for you, without closing your account (Account → Privacy).
• Delete your account (Account → Your data → Delete account). What this removes, and the few records that survive it, are set out in Deleting your account.
• Raise a grievance with our Grievance Officer (see Grievances & escalation).
• Nominate another individual, where and in the manner permitted by applicable data-protection law, to exercise applicable rights on your behalf.

To exercise these, email privacy@finachiva.com.

You do not need a Finachiva account to make a request. If we hold personal data about you without an account — for example, a record of a sign-in attempt made with your email address — you can make any request that applies to you, or raise a grievance, at privacy@finachiva.com or with our Grievance Officer (see Grievances & escalation).

Finachiva is intended only for users who are 18 or older. We do not knowingly permit individuals under 18 to create accounts or use the service. If we learn that personal data relating to a person under 18 has been collected in circumstances where it should not have been, we will take appropriate steps in accordance with applicable law.

Two different regimes ask for a grievance route, and they are not the same thing. At Finachiva the same person holds both roles, which we say here rather than leave you to infer.

• Data-protection grievances (Digital Personal Data Protection Act, 2023) — anything about how we handle your personal data: what we collect, how we use it, access, correction, erasure, usage measurement, or nominating another person to exercise your rights.
• Consumer grievances (Consumer Protection (E-Commerce) Rules, 2020) — anything about the service as a purchase: billing, access to a paid plan, or something the product did not do.

Both are handled by Rajesh P, Grievance Officer · Email: grievance@finachiva.com · Address: Subramani Street, Keelkattalai, Chennai 600117.

Finachiva will endeavour to acknowledge support requests within 48 hours and will use reasonable efforts to investigate and address substantiated issues within a reasonable period, having regard to their nature and complexity.

You may exercise your rights and pursue available remedies under applicable data-protection law, including approaching the Data Protection Board of India where permitted under the DPDP Act and applicable rules.

We may update this policy. Each version carries a version number, shown at the top of this page; when we change it materially we ask you to read and accept the new version the next time you open the app, and we summarise what changed before you do.

privacy@finachiva.com · Finachiva Enterprise, Subramani Street, Keelkattalai, Chennai 600117.