Plain English summary: FinLytTech connects to your accounting software (Zoho Books or Tally Prime) to generate financial reports. We store your account credentials securely but do not store your financial data — it is fetched live each time you request a report and never saved to our servers.
1. Who We Are
FinLytTech ("FinLytTech", "we", "us", "our") is an AI-powered financial intelligence platform for Indian startups and small and medium enterprises. We are based in India and operate under the laws of India.
Data Fiduciary: ACETRILLYTICS FINLYTTECH LLP
Contact: Contact Us | finlyt.net
2. Data We Collect
| Category | What exactly | When collected | Stored? |
|---|---|---|---|
| Account data | Name, company name, email address, password (hashed) | On signup | Yes — encrypted |
| Business identifiers | Entity type and PAN (mandatory). GSTIN, CIN or LLPIN (conditional on entity type) | On signup | Yes — encrypted |
| Network metadata | IP address of every signup and sign-in | On signup and every login | Yes — server logs |
| Authentication tokens | Zoho Books OAuth access and refresh tokens | When you connect Zoho Books | Yes — encrypted |
| Financial data | P&L, Balance Sheet, Cash Flow, Chart of Accounts from your Zoho Books or Tally | When you generate a report | Snapshots only — see Section 4 |
| Usage data | Pages visited, features used, error logs | During product use | Yes — anonymised |
| Payment data | Subscription status, payment confirmation (not card details) | On payment | Yes — via Razorpay |
Why we collect business identifiers: Indian government IDs (PAN, GSTIN, CIN, LLPIN) are the only reliable way to ensure one account per legal entity — company names collide and email addresses don't. We use PAN as the unique key to prevent duplicate signups, and we use GSTIN to issue GST-compliant tax invoices on your subscription as required by Indian tax law. We never share these with third parties or use them for any purpose other than identity and billing.
Why we collect IP addresses: Logged for security (account-takeover detection), abuse prevention, and statutory record-keeping under Section 67C of the Information Technology Act, 2000. IP logs are retained for 12 months and then deleted.
We do not collect: Aadhaar, bank account details, biometrics, or any data beyond what is listed above.
3. How We Use Your Data
- To create and manage your FinLytTech account
- To connect to your Zoho Books account via OAuth on your behalf
- To fetch your financial data and generate reports and analysis when you request them
- To send you product updates, trial expiry reminders, and payment receipts
- To improve the product based on anonymised usage patterns
- To comply with legal obligations under Indian law
We do not use your data for advertising, sell it to third parties, or use your financial data to train AI models.
4. Your Financial Data — Special Section
This is the most important section for business users. Your company's financial data — P&L, Balance Sheet, Cash Flow, ledger entries — is never stored on FinLytTech's servers.
When you request a report, FinLytTech:
- Uses your stored OAuth token to make a secure API call to Zoho Books (or parses your uploaded Tally XML)
- Processes the data in memory on our server to calculate ratios, variances, and generate AI narrative
- Returns the report to your browser
- Discards the raw financial data from server memory
For Tally XML uploads: the uploaded XML file is processed and immediately deleted from our servers. It is not retained.
The AI narrative is generated by Anthropic's Claude API. Financial data is sent to Anthropic's API for this purpose under their data processing agreement. Anthropic does not use your data to train models (see their privacy policy at anthropic.com).
4.1 AI Processing — What Is Sent
The following AI-powered features process data via Anthropic's Claude API: AI narrative generation, AI risk insights on ageing analysis, AI-drafted debtor and creditor follow-up emails, scenario analysis runs, and loan-readiness CMA generation.
What is sent to Anthropic:
- Aggregated financial figures relevant to the requested generation (e.g. revenue totals, expense category sums, key ratios, summarised ageing buckets, summarised cash projection figures).
- For debtor / creditor follow-up email drafts: the relevant party's outstanding balance summary and overdue ageing — sufficient context for the AI to draft a coherent reminder. The party's name appears in the draft (you control whether to send it).
What is NOT sent to Anthropic:
- Individual voucher / ledger line entries.
- Bank account numbers, GST numbers, PAN numbers, or other regulated identifiers of your customers and vendors.
- Login credentials, OAuth tokens, or payment instrument data.
- Data from other customers' accounts (isolated per company).
Consent and control. Every AI generation is triggered by you (or your invited team member) — there is no automatic background AI processing. The system displays a one-time per-session confirmation ("This will use 1 credit. Continue?") before each generation, which you may opt to skip for the rest of the session. There is no automatic regeneration: existing AI output is refreshed only when you click Regenerate or load new books / press F5.
Retention by Anthropic. Per Anthropic's API terms (anthropic.com/legal), inputs and outputs are retained only for abuse-monitoring purposes for up to 30 days and are not used to train models. FinLytTech itself retains the generated AI output text inside your account so you can view it without re-spending a credit; you may delete it from inside the dashboard at any time.
Right to opt out of AI. You may operate the platform without using any AI-credit-consuming feature. All deterministic functions (statements, ratios, ageing totals, exports, predictive alerts) work without any AI processing.
5. Where Data Is Stored
| Data | Service | Location | Security standard |
|---|---|---|---|
| Account data + OAuth tokens | Supabase | US (AWS us-east-1) | SOC 2 Type II, encrypted at rest (AES-256) |
| API processing | Render | Singapore (Southeast Asia) | TLS in transit, isolated containers |
| Frontend | Vercel | Global CDN | TLS, no personal data stored |
| AI narrative generation | Anthropic API | US | Enterprise data processing agreement |
| Payments | Razorpay | India | PCI-DSS compliant |
Data residency note: Account data is currently stored in US-based Supabase servers. The Digital Personal Data Protection Act 2023 (DPDP Act) has data localisation provisions that are not yet fully notified. We will migrate to India-region storage as and when required by law or Supabase India region becomes available.
6. Third-Party Services
- Supabase — database and authentication. Privacy policy: supabase.com/privacy
- Zoho Corporation — your accounting data source. Their privacy policy governs your Zoho Books data. Privacy policy: zoho.com/privacy.html
- Anthropic — AI narrative generation. Privacy policy: anthropic.com/privacy
- Razorpay — payment processing. Privacy policy: razorpay.com/privacy
- Vercel — frontend hosting. Privacy policy: vercel.com/legal/privacy-policy
- Render — backend hosting. Privacy policy: render.com/privacy
We do not share your personal data with any other third parties. We do not use Google Analytics or any advertising trackers.
7. Your Rights Under DPDP Act 2023
Under the Digital Personal Data Protection Act 2023, you have the following rights as a Data Principal:
- Right to access — request a copy of personal data we hold about you
- Right to correction — request correction of inaccurate personal data
- Right to erasure — request deletion of your personal data (subject to legal retention requirements)
- Right to grievance redressal — raise a complaint with us and receive a response within 30 days
- Right to nominate — nominate another individual to exercise rights on your behalf
To exercise any of these rights, send us a Data Rights Request via Contact Us. We will respond within 30 days.
Account deletion: To delete your FinLytTech account and all associated data, submit a Contact Us request. We will delete your account within 7 business days. This will revoke your Zoho Books connection and delete all stored tokens.
8. Data Retention
| Data type | Retention period | Reason |
|---|---|---|
| Account data (name, email, company) | Duration of account + 90 days after deletion | Account management |
| Zoho OAuth tokens | Until revoked or account deleted | Service continuity |
| Financial data (P&L, BS, CF) | Not stored — processed in memory only | Privacy by design |
| Payment records | 7 years | GST and accounting compliance under Indian law |
| Usage logs | 90 days | Security and debugging |
9. Service Telemetry and Error Logging
To operate the FinLytTech platform reliably and to diagnose issues you may encounter, we automatically record a limited set of service-operation events when you use the platform. We rely on legitimate interest as our legal basis under the Digital Personal Data Protection Act, 2023.
What we record:
- Sync events between your accounting software and the dashboard (success, failure, error class)
- Report generation events (PDF / Excel exports)
- Connection events (Tally pairing, Zoho authorization)
- Authentication events (sign-in, sign-out, password reset, idle timeout, two-factor enablement)
- Application errors encountered in your browser or on our servers
What we deliberately do NOT record:
- Your financial data (P&L figures, balances, transaction details)
- Your customers' or vendors' names or amounts
- The contents of any file you upload
- Mouse movements, scrolling behaviour, or click-stream
- Page-view analytics
Each record contains: the event name, a sanitised metadata payload, your account identifier, your IP address, and your browser identifier. The payload is automatically scrubbed of any pattern that resembles a JWT token, API key, PAN, GSTIN, or Aadhaar number, and any string longer than 500 characters is truncated.
Retention: These records are stored for 90 days and then automatically purged.
How we use these records:
- Diagnose and resolve errors you report to support
- Identify systemic issues affecting multiple customers
- Demonstrate the integrity of the platform if asked by a regulator or auditor
We do not use these records for marketing, profiling, ad targeting, or any purpose other than the ones listed above. We do not share these records with third parties.
Your rights specific to this section:
- You may request a copy of your telemetry records at any time via the Contact Us form, or by signing in and pulling them yourself from the dashboard.
- You may request deletion of your telemetry records at any time (we will action this within 7 working days). This does not affect your right to continue using the service.
These rights are in addition to the data subject rights set out in Section 7 above.
10. Support Tickets and Communications
When you open a support ticket from inside the dashboard (the green "?" button bottom-right of every page), we process and store the information needed to track, resolve, and follow up on your request. Our legal basis is contractual necessity under the Digital Personal Data Protection Act, 2023 — the support relationship is part of the service you've signed up for.
What we collect when you open a ticket:
- The title and description you write
- The category you select (Sync issue / Data accuracy / Account / Feature request / Other)
- The severity you select (Low / Normal / High)
- Optional page context — the page URL you were on and your browser identifier. You see this in a preview before submitting and can uncheck the box to omit it.
- The email address tied to your account, so we can reply
What we deliberately do NOT collect on a ticket:
- Screenshots (this is a v1 limitation by design — when we add screenshot upload, we will update this section first)
- Form-field contents from other pages
- Financial data from your dashboard, reports, or Tally export files
- Any data outside the title, description, category, severity, and the optional page-context block
How we use ticket data:
- To respond to your specific request and resolve the issue
- To trace the issue if it affects other customers (we may reference the situation in internal notes without disclosing your identity to other customers)
- To inform improvements to the platform
Internal notes: Our support team may add internal notes against your ticket that you do not see (for example, technical investigation notes). These never leave the ticket record and are visible only to FinLytTech operators.
Email notifications: When you open a ticket, when our team replies, and when you reply back, we may send email notifications using the Zoho Mail service to your account email address. You can stop receiving these by closing the ticket (the "Resolved" state stops further notifications).
Retention:
- Tickets in the Resolved or Closed state are retained for 2 years from the date of resolution, then deleted, in line with our general account-data retention policy.
- Tickets in Open states (New, In Progress, Awaiting Customer Reply) are retained until they are resolved or closed.
- If you delete your account, all your tickets are deleted as part of the cascade. You can request retention of a specific ticket for your records via the Contact Us form before requesting account deletion.
We do not share ticket data with third parties, and we do not use the contents of your tickets for marketing, profiling, or model training of any kind.
Your rights specific to support tickets:
- You may view every ticket you've opened, and the full conversation on each, at any time at dashboard.finlyt.net/tickets.
- You may request export or deletion of your support history at any time via the Contact Us form (action within 7 working days).
- You may correct factual inaccuracies in a ticket you've opened by replying on the thread with the correction.
11. Security Measures
- All data transmitted over TLS 1.2 or higher (HTTPS everywhere)
- Passwords hashed using bcrypt — never stored in plain text
- OAuth tokens encrypted at rest using AES-256
- API keys stored as environment variables — never in code
- GitHub repository does not contain any secrets or credentials
- Supabase Row Level Security (RLS) — users can only access their own data
- Regular dependency updates and security patches
In the event of a data breach affecting your personal data, we will notify you within 72 hours of becoming aware of it, as required under the DPDP Act 2023.
12. Children's Privacy
FinLytTech is a B2B financial intelligence platform intended for use by businesses and professionals. We do not knowingly collect data from anyone under the age of 18. If you believe a minor has created an account, please contact us and we will delete it immediately.
13. Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page and notify registered users by email if changes are material. Continued use of FinLytTech after changes take effect constitutes acceptance of the updated policy.
14. Contact Us
For any privacy-related questions, data rights requests, or grievances:
FinLytTech — Data Fiduciary
Contact: Open the Contact Us form on finlyt.net
Website: finlyt.net
Response time: Within 30 days of receiving your request
This Privacy Policy is governed by the laws of India. Any disputes shall be subject to the exclusive jurisdiction of courts in India.