Your privacy, in plain terms.

Finkitaabh (“Finkitaabh”, “we”, “us” or “our”) provides cloud accounting, GST compliance and related business software. We respect your privacy and are committed to protecting the personal and business information you entrust to us. This Privacy Policy describes how we handle that information in connection with our website at finkitaabh.com and our application.

We aim to align our practices with India's Digital Personal Data Protection Act, 2023 and other applicable laws. By using our website or application, you agree to the practices described here.

Finkitaabh is a business software platform for Indian businesses. For the business data you and your team enter into the application — your invoices, ledgers, GST records, inventory, payroll and similar — you are the owner and controller of that data, and we act as a processor, handling it on your instructions to provide the service. For the limited personal information we collect to run our website and accounts (described below), we act as the controller.

This policy covers our marketing website and our application. It does not cover third-party websites or services that may be linked from ours; those are governed by their own privacy policies.

We collect the following categories of information:

• Account and identity information — such as your name, email address, phone number, business name, GSTIN and role, provided when you sign up, are onboarded or contact us.
• Authentication information — credentials and multi-factor authentication data used to secure your account. Where you choose “Continue with Google”, we receive basic profile information from Google to verify your identity.
• Business data you enter — the accounting, GST, invoicing, inventory, payroll and related records you and your team create in the application. This is your data; see “Your Business Data” below.
• Billing information — plan, subscription status and billing details needed to manage your account. Card or bank payment details, where applicable, are handled by payment providers; we do not store full card numbers.
• Usage and device information — such as IP address, browser and device type, pages viewed and actions taken, collected to operate, secure and improve the service.
• Communications — messages you send us by email, WhatsApp or through the product, and our replies.

The business records you enter belong to you. We use them only to provide and support the service you have asked for. We do not sell your business data, and we do not use it for advertising. Each company's data is isolated from other customers using tenant-level access controls and database row-level security, as described on our Security & Privacy page.

We use the information above to:

• provide, maintain and secure the application and website;
• authenticate users and enforce role-based and company-level access;
• process your transactions and generate the reports and returns you request;
• provide customer support and respond to your requests;
• manage subscriptions, billing and account administration;
• understand usage and improve the product and website;
• detect, prevent and address security, fraud or technical issues; and
• comply with legal, tax and regulatory obligations.

Depending on the situation, we process information on the basis of your consent, the performance of our contract with you, our legitimate business interests (such as securing and improving the service), and compliance with legal obligations. Where we rely on consent, you may withdraw it at any time by contacting us, though this will not affect processing already carried out.

Our website uses cookies and similar technologies. Some are necessary for the site to function; others help us understand how the site is used so we can improve it.

• Analytics — we use Google Analytics to understand aggregate website usage. It may set cookies and collect information such as your IP address, device and the pages you visit. This helps us see which content is useful; it is not used to identify you personally to us. You can opt out using Google's browser add-on or your browser's cookie controls.
• Essential — within the application, cookies and tokens are used to keep you signed in and to protect your session.

You can control cookies through your browser settings. Blocking some cookies may affect how parts of the site or application work.

We do not sell your information. We share it only in these limited situations:

• Service providers — trusted vendors who help us run the service (for example, cloud hosting, and, where you enable it, the AI document-scanning provider). They may process information only to provide services to us and under appropriate obligations.
• Within your organisation — business data is visible to the users your account owner authorises, according to their assigned roles and permissions.
• Legal and safety — where required by law, regulation or valid legal process, or to protect the rights, safety and security of our users, the public or Finkitaabh.
• Business transfers — in connection with a merger, acquisition or sale of assets, information may be transferred, subject to this policy.

We protect information using multiple layers of security — encrypted connections (HTTPS/TLS) in transit, protected storage on managed infrastructure, authentication and multi-factor authentication, role-based access, per-company tenant isolation and an immutable audit trail. No method of transmission or storage is completely secure, so while we work continuously to protect your information, we cannot guarantee absolute security. Full detail is on our Security & Privacy page.

We retain your information for as long as your account is active and as needed to provide the service. When a subscription or trial ends, your account moves to read-only — you are not locked out, and it can be extended or converted — and your data remains available to view and export during that period.

After that, we retain business records for the period required to meet legal, tax and accounting obligations (for example, records required under GST and the Companies Act), after which they are deleted or anonymised in line with our retention schedule. You may request earlier deletion as described below, subject to these legal obligations.

Subject to applicable law, you have rights over your personal information, including to:

• access the information we hold about you;
• correct information that is inaccurate or incomplete;
• export your business data — every return, register, ledger and report exports to Excel and PDF from within the application;
• request deletion of your information, subject to legal retention obligations;
• withdraw consent where processing is based on consent; and
• raise a grievance with us and, where applicable, with the Data Protection Board of India.

To exercise any of these, contact us using the details below. We may need to verify your identity before acting on a request.

Your data is hosted on managed cloud infrastructure, with data kept in India. If any processing involves a transfer outside India, we will carry it out in accordance with applicable law and with appropriate safeguards in place.

Our service is intended for businesses and is not directed to children. We do not knowingly collect personal information from children. If you believe a child has provided us information, please contact us and we will take appropriate steps.

We may update this policy from time to time. When we do, we will revise the “Last updated” date above and, where changes are significant, provide a more prominent notice. Your continued use of the service after an update means you accept the revised policy.

If you have questions about this policy, wish to exercise your rights, or want to raise a concern about how your information is handled, please contact us. In line with India's DPDP Act, you can reach our privacy team and Grievance Officer at:

We aim to acknowledge grievances promptly and resolve them within the timelines required by applicable law.