Privacy Policy

1. What we collect

• Account data — email address, and (if you sign in with Google) your Google account email and basic profile identifier.
• Financial data you enter — income entries, expenses, investments, SIPs, EMIs, subscriptions, budgets, savings goals, credit card details you choose to record (name, bank, network, reward rules — never full card numbers), and bank account records (nickname, bank, account type, last 4 digits, IFSC, balances).
• Uploaded content — receipt images, SMS text and bank statement files you submit for parsing.
• Payment data — for Pro purchases we store only the Razorpay order ID, payment ID, amount and status. Card and UPI credentials are handled entirely by Razorpay and never reach our servers.
• Preferences — theme, country, display currency, security settings.
• Operational logs — request timestamps, error codes and coarse usage counters. Sensitive fields are redacted before logging.

We do not use advertising trackers, and we do not sell your data to anyone, ever.

2. Why we use it

• To provide the core service: storing and displaying your financial records and calculations.
• To generate AI insights, briefings, category suggestions and document parsing when you invoke those features.
• To process your one-time Pro purchase and maintain your entitlement.
• To fetch live prices and exchange rates relevant to your holdings.
• To secure accounts, prevent abuse and enforce fair-usage limits.

We rely on your consent (given at sign-up and when you use an optional feature) and on the necessity of processing to perform our contract with you.

3. AI processing

When you use an AI feature — chat, briefing, receipt scanning, statement parsing, category suggestions — the relevant slice of your data is sent to our AI gateway provider for that single request. Your data is not used to train third-party models, and AI providers act as processors under contract. If you never use an AI feature, no financial data leaves our database for AI purposes.

4. Who we share with (processors)

• Lovable Cloud / Supabase — database, authentication, file storage and serverless functions.
• Razorpay Software Private Limited — payment processing for Pro purchases.
• Google — optional Google sign-in.
• Lovable AI Gateway — AI model inference for the features listed above.
• Market data sources — AMFI, Yahoo Finance, CoinGecko and an exchange-rate provider. Only ticker symbols and scheme codes are sent; never your holdings' value or your identity.

Some processors operate servers outside India. Transfers are made only to jurisdictions permitted under the DPDP Act and under contractual safeguards.

5. Security

Data is encrypted in transit (TLS) and at rest by our infrastructure provider. Every table enforces row-level security so one account can never read another account's rows. Optional extras you control: biometric app lock, two-factor authentication, and client-side AES-GCM encryption for private notes — notes encrypted this way can only be read with your passphrase, and we cannot recover them if you lose it.

No system is perfectly secure. In the event of a personal data breach, we will notify affected users and the Data Protection Board of India, and report to CERT-In within 6 hours of becoming aware, as required by the CERT-In Directions of 28 April 2022.

6. Retention

• Records you keep stay until you delete them.
• Items you delete move to Trash and are permanently purged after 90 days.
• Audit and security logs are retained for up to 180 days.
• Payment records are retained for 8 years as required by Indian tax and accounting law, even after account deletion.
• Everything else is erased when you delete your account.

7. Your rights

Under the DPDP Act you may:

• Access a copy of your data — export it as JSON or CSV from Settings → Data Management.
• Correct or update any record directly in the App.
• Erase your account and data — Settings → Data Management → Delete Account.
• Withdraw consent for optional features by simply not using them.
• Nominate another person to exercise your rights in the event of death or incapacity — write to our Grievance Officer.
• Raise a grievance with our Grievance Officer, and escalate to the Data Protection Board of India if unresolved.

8. Children

The App is not intended for anyone under 18. We do not knowingly process the data of children. If you believe a child has created an account, contact us and we will delete it.

9. Changes

We will post any material change on this page and update the "last updated" date. Continued use after a change means you accept the revised policy.

10. Contact

Varun Chatlani, an individual trading as Prodigi AI, Maker Tower A, Cuffe Parade, Mumbai – 400005, Maharashtra, India
Support: support@prodigiai.org
Grievance Officer: Varun Chatlani — varun@prodigiai.org