Our promises, in short

• We never sell your data. Not to advertisers, not to lenders, not to anyone.
• We never ask for your bank login. FinBuddy does not move money, make payments or hold funds.
• You stay in control. You can see, correct, export or delete your data at any time, including deleting your whole account from inside the app.
• We name every partner that touches your data, including the AI providers, in section 6 below.
• If something goes wrong, we tell you. We report security incidents to the authorities and to affected users within the time limits set by Indian law.

1. Who we are

FinBuddy is a personal finance app built by SaakarKaro, based in India. Under the Digital Personal Data Protection Act, 2023 (“DPDP Act”), SaakarKaro is the Data Fiduciary for your personal data, which means we decide how and why it is processed and we are responsible for protecting it. You can reach us at admin@saakarkaro.com.

2. Your consent

When you create a FinBuddy account, we show you a clear notice of what we collect and why, and ask for your consent before we process your data. Your consent is free, specific and informed, and you can withdraw it at any time from the app or by writing to us. Withdrawing consent is as easy as giving it. If you withdraw, we stop processing the data concerned, although some features may no longer work, and anything we did before you withdrew remains lawful.

We also process a limited amount of data without separate consent where the law allows it, for example to comply with a legal obligation or to respond to a security incident.

3. Information we collect

We collect only what FinBuddy needs to work for you:

• Account information: your name, email address, phone number and profile photo, and the sign-in details from the method you choose (such as email or Google).
• Financial information you enter: transactions, income, expenses, budgets, pools, goals, investment holdings and tax inputs that you choose to record.
• Documents you upload: bank or card statements, photos of handwritten notes or receipts, and tax documents such as Form 16, interest certificates and capital gains reports. We read these only to fill in the app for you.
• Conversations with Lakshaya, our in-app assistant, so you can return to a chat and so it can answer in context.
• Device and usage data: device type, operating system, app version, notification token, crash reports and server logs, used to keep the app secure and stable.
• Support messages and any attachments you send us.

Indian law treats financial information and passwords as sensitive personal data. We handle all of it with the higher level of care that requires. We never collect your bank passwords, card PINs, CVVs or UPI PINs, and we do not use your location.

4. How we use your information

• To run FinBuddy and the features you choose to use.
• To give you insights, reminders and nudges about your own money.
• To read the statements and documents you upload and turn them into entries you can review.
• To keep your account secure and prevent fraud or misuse.
• To answer your support requests.
• To improve FinBuddy using aggregated, de-identified statistics that do not identify you.
• To meet our legal obligations.

We do not sell your data, we do not use your financial data for advertising, and we do not use it to decide whether you get credit or insurance.

5. How Lakshaya and our AI features work

FinBuddy uses artificial intelligence in two places: Lakshaya, our in-app assistant, and document reading, which turns an uploaded statement or tax document into entries.

• Your totals and figures are calculated on your device by FinBuddy itself. The AI model is given finished numbers to explain; it does not do your maths.
• We send the AI provider only what is needed to answer the request in front of it, and nothing that identifies you beyond that content.
• Our AI partners process this data only to answer our request, under their business terms for paid services. We do not allow your data to be used to train public AI models.
• AI can make mistakes. Everything Lakshaya says is general information, not professional advice, and you can always check the numbers in the app.

6. Who we share data with

We share data only with trusted service providers who help us run FinBuddy. Each one acts as our Data Processor under a written contract, may use your data only to provide their service to us, and must protect it to the same standard we do.

• Google Firebase (Google LLC): account sign-in, secure database storage and push notifications.
• Cerebras (Cerebras Systems Inc.): AI provider for Lakshaya and for reading statements and tax documents.
• Google Gemini (Google LLC): AI provider for reading photos of handwritten notes and receipts.
• Google and Apple: for app delivery through their stores, and for sign-in if you choose to sign in with them.
• Cloud hosting providers that run our servers.

We may also share data in these limited cases:

• People you invite: when you use Pools, shared budgets or shared goals, the entries in that shared space are visible to its members. Your personal entries stay private.
• When the law requires it: to comply with a valid legal request from an Indian authority, or to protect our users and our service from harm.
• If our business changes hands: in a merger or acquisition, your data stays protected by this policy, and we will tell you before it becomes subject to a different one.

We will update this list before we add a new partner that processes your personal data.

7. How we protect your data

We take “reasonable security practices”, as the IT Act requires, seriously, and follow the controls of the internationally recognised ISO/IEC 27001 standard as our benchmark. In practice this means:

• Encryption of your data in transit (TLS) and at rest.
• Optional app lock with your device’s fingerprint, face or PIN, and secure on-device storage for sensitive keys.
• Strict access controls: only a small number of authorised team members can reach production systems, and every access is logged.
• Database rules that keep each user’s records visible only to that user and to the members of pools they have joined.
• Regular reviews of our security, our code and our partners.

8. If there is a security incident

No system is perfectly secure, so we have a plan for when something goes wrong. If a personal data breach occurs, we will:

• Report cyber security incidents to CERT-In, India’s national cyber security agency, within 6 hours of noticing them, as its Directions of 2022 require.
• Inform the Data Protection Board of India without delay, and send it a full report within 72 hours, as the DPDP Rules require.
• Tell affected users without delay, in plain language: what happened, what data was involved, what we are doing about it, and what you can do to protect yourself.

9. How long we keep your data

• Your account and financial data: for as long as your account is active. When you delete your account, we erase it from our live systems within 30 days, and from backups within 90 days.
• Uploaded documents: processed to create your entries and not kept as files afterwards.
• Security logs: kept for at least 180 days, and stored in India, because CERT-In requires it. They are used only for security and legal purposes.
• Records the law requires us to keep, such as billing records if you ever buy a paid plan, are kept only for the period the law sets.

10. Your rights

Under the DPDP Act, you have the right to:

• Know: get a summary of the personal data we hold about you, how we use it, and who we have shared it with.
• Correct and update inaccurate or incomplete data. Most of it you can edit directly in the app.
• Erase your data and your account.
• Withdraw consent at any time.
• Nominate someone to exercise these rights for you if you die or become unable to.
• Raise a grievance with us, and if you are not satisfied, complain to the Data Protection Board of India.

To use any of these rights, email admin@saakarkaro.com from the email address on your account. We will respond within 30 days, and we will never charge you for it.

11. How to delete your account

You can delete your FinBuddy account and data in two ways:

• In the app: open your profile, go to Settings, and choose Delete account. Deletion starts straight away.
• Without the app: email admin@saakarkaro.com with the subject “Delete my FinBuddy account”, from the email address you signed up with. We will confirm it is you and complete the deletion within 30 days.

Deleting your account removes your profile, transactions, budgets, goals, investments, tax data and Lakshaya chats. Entries you added to a shared pool are removed or made anonymous, so other members’ records stay correct. We keep only what section 9 says the law requires.

12. FinBuddy is for adults only

FinBuddy is only for people aged 18 and above. We do not knowingly collect data from children. If we learn that a child has created an account, we will delete it. If you believe this has happened, please tell us.

13. Where your data is stored

Your data is stored on secure cloud servers. Some of our partners, such as our AI providers, may process data outside India. We only transfer data to countries the Government of India has not restricted, and only to partners bound by contracts that protect your data to the standard of this policy.

14. This website

Our website does not require an account and does not use advertising or tracking cookies. If you email us from it, we use your message only to reply to you.

15. Changes to this policy

If we make a material change, we will tell you in the app or by email before it takes effect and, where the law requires, ask for your consent again. The date at the top always shows the latest version.

16. Grievance Officer and contact

As required by the IT Act and the DPDP Act, we have appointed a Grievance Officer who is responsible for your privacy questions and complaints.

• Grievance Officer, SaakarKaro: admin@saakarkaro.com
• Technical help with the app: tech.support@saakarkaro.com

We acknowledge every complaint within 24 hours and resolve it within 30 days. If you are not satisfied with our answer, you may complain to the Data Protection Board of India.