Privacy Policy

Finly is a personal wealth management platform operated by Notch AI, a technology company building privacy-first financial tools for Indian users.

Our registered contact for data enquiries is: privacy@notchai.in

We collect only what is necessary to operate Finly:

• Account data: Name, email address, and hashed password (or Google OAuth token if you sign in with Google).
• Financial data you enter: Asset values, liability balances, transaction records, investment holdings, and goals — all entered manually by you.
• Uploaded files: CAS PDFs and receipt images you upload for OCR processing. These are stored encrypted in Google Cloud Storage.
• Gmail data (optional, Pro plan): If you grant Gmail auto-sync permission, we read only financial transaction emails matching specific patterns. We never store email content beyond extracted transaction data.
• Usage logs: Basic server logs (IP address, timestamps) retained for up to 30 days for security purposes.

• We do not link to or access your bank accounts.
• We do not perform screen scraping of any financial platform.
• We do not collect broker login credentials.
• We do not sell your data to third parties, advertisers, or data brokers.
• We do not profile you for advertising purposes.

Your data is used exclusively to:

• Provide, operate, and maintain the Finly platform.
• Process uploaded CAS PDFs and receipts via OCR to populate your dashboard.
• Send essential transactional emails (account verification, password reset, MFA codes).
• Improve service reliability and fix bugs.
• Respond to support requests you initiate.

Sensitive fields — including your PAN number, folio numbers, and bank account names stored within investment records — are encrypted at rest using AES-256-GCM before being written to the database.

Uploaded files are stored in Google Cloud Storage in a private bucket with no public access. Files are encrypted at rest by GCS and in transit via TLS.

Passwords are hashed using bcrypt and are never stored in plain text.

We use a limited set of third-party services to operate Finly:

• Google Cloud (India region): Database hosting, file storage, and server infrastructure.
• Google Cloud Vision API: Receipt OCR processing. Images are sent to the API and the response is returned to your account. Google's data processing terms apply.
• Google OAuth: Optional sign-in method. We receive only your email and public profile.
• Gmail API (optional): Only accessed if you explicitly grant permission in Pro plan settings.

Your data is retained for as long as your account is active. If you delete your account, all personal data — including financial records, uploaded files, and profile information — is permanently deleted within 30 days.

Anonymised, aggregated usage statistics (containing no personal information) may be retained indefinitely for product analytics.

You have the right to:

• Access: Request a copy of all personal data we hold about you.
• Correction: Update or correct inaccurate data.
• Deletion: Request permanent deletion of your account and all associated data.
• Data portability: Export all your financial data in JSON or CSV format at any time from Settings → Export Data.
• Revoke consent: Disconnect Gmail access or Google OAuth at any time from Settings.

To exercise any right, email us at privacy@notchai.in. We respond within 7 business days.

Finly uses only essential cookies required for authentication (session tokens) and security (CSRF protection). We do not use tracking or advertising cookies. See our Cookie Policy for full details.

We may update this Privacy Policy from time to time. We will notify you by email and in-app banner at least 14 days before any material changes take effect. Continued use of Finly after the effective date constitutes acceptance of the updated policy.

For privacy questions, data requests, or concerns, contact us at privacy@notchai.in or visit our Contact page.