₹
finna
DPDP Act 2023 & RBI AA Compliant

Privacy Policy

Last Updated: October 2026 · Effective Date: October 2026

Your Privacy at a Glance

FINNA is built for Indian gig workers, freelancers, and everyday earners. We believe your financial data belongs exclusively to you. We access your banking information solely with your explicit consent via the RBI-regulated Account Aggregator (AA) framework, never sell your personal information to loan sharks or marketers, and enable you to revoke consent or purge your data at any time.

100% Read-OnlyNo debit, transfer, or money withdrawal capability ever.
End-to-End EncryptedData is encrypted in transit and protected by Supabase RLS.
Unconditional RevocationStop scheduled background data syncs whenever you want.

1. Who We Are & Regulatory Scope

This Privacy Policy explains how [Company Name] (“FINNA”, “we”, “us”, or “our”) collects, uses, stores, and protects your personal and financial data when you use https://www.finnastudio.me and associated applications.

Under India's Digital Personal Data Protection Act, 2023 (DPDP Act 2023), FINNA operates as a Data Fiduciary, and you are the Data Principal. Under the Reserve Bank of India's Account Aggregator framework, FINNA acts as a registered Financial Information User (FIU).

2. Information We Collect

We only collect data strictly necessary to deliver personalized financial health insights:

A. Identity & Registration Data

Your name, email address, password hash (salted and encrypted via Supabase Auth), optional phone number, operating city/state (e.g. Chennai, Tamil Nadu), and gig platforms worked (e.g. Swiggy, Zomato, Uber, Zepto).

B. Consented Account Aggregator (AA) Banking Data

Retrieved exclusively with your permission through the Setu AA Gateway (an RBI-regulated NBFC-AA):

  • Profile & Account Information: Account holder name, account type (savings/current), masked account number, and bank IFSC/identifier.
  • Deposit Account Summary: Current balance and periodic balances.
  • Transaction History: Line-item credits (gig company weekly settlements) and debits (fuel, EMI, living expenses) over your selected period (e.g. 30, 90, or 180 days).

C. Device & Technical Information

Browser type, operating system, IP address, and cookie consent preferences. In our Android WebView wrapper, no device hardware identifiers (such as IMEI or MAC address) are gathered.

3. Why We Collect This Data (Purpose of Processing)

We process your data strictly for legitimate, user-requested services:

  • Safe-to-Spend Calculation: Computing real-time daily discretionary spending allowances after reserving for rent, loan EMIs, and vehicle petrol expenses.
  • Predictive Cashflow Calendar: Modeling future cash balances based on gig earnings cycles and upcoming recurring debits.
  • Government Welfare & Scheme Matching: Evaluating eligibility for state and central government gig worker programs (such as the Tamil Nadu Gig Welfare Board, PM-SYM pension, e-Shram, and PMJJBY).
  • Financial Health Score: Providing an objective 0–100 financial health benchmark.
  • FINNA Copilot Advisory: Powering our AI co-pilot to answer your specific financial queries grounded in your verified figures.

4. Data Retention & Purging Schedule

Your banking records obtained via Account Aggregator are retained for a maximum duration corresponding to your consent artefact (default 90 days to 1 year in your encrypted client vault). If you delete your account or revoke consent, your decrypted banking transactions and statements are marked for immediate purging and permanently expunged within 30 days, except where retention is strictly mandated under Indian law.

5. Data Principal Rights under India's DPDP Act, 2023

Under the DPDP Act 2023, you enjoy the following statutory rights:

  • Right to Access Information: Request a summary of your personal data being processed and third parties with whom it has been shared.
  • Right to Correction & Updating: Rectify inaccurate, misleading, or outdated personal information.
  • Right to Erasure & Withdrawal of Consent: Withdraw your consent at any time and request erasure of your data without detriment.
  • Right to Grievance Redressal: Submit a grievance to our Data Protection Officer regarding data handling.
  • Right to Nominate: Nominate an individual who shall exercise your rights in the event of death or incapacity.

To exercise any of these rights, email us at [Contact Email] with the subject line “DPDP Data Principal Request”.

6. Third-Party Service Providers

We work with trusted infrastructure providers that adhere to high cybersecurity standards:

  • Setu (Pine Labs Group): RBI-licensed Account Aggregator gateway provider for fetching bank statements securely.
  • Supabase: Database and authentication infrastructure hosted in secure cloud regions with PostgreSQL Row-Level Security.
  • Vercel: Web hosting and edge network with optional privacy-first analytics (only loaded with your explicit cookie consent).

7. Security Measures

We implement comprehensive technical and organizational safeguards including AES-256 encryption at rest, TLS 1.3 encryption in transit, strict database row-level security (RLS) guaranteeing that no user can access another user's data, and regular security vulnerability scanning.

8. Grievance Redressal & Contact Details

For privacy queries, complaints, or exercising your statutory rights, please contact our designated Grievance Officer:

Data Fiduciary: [Company Name]

Grievance / Privacy Officer: [Grievance Officer Name / Data Protection Officer]

Email: [Contact Email] (e.g. privacy@finnastudio.me)

Postal Address: [Address, e.g., FINNA Technologies Pvt Ltd, Chennai, Tamil Nadu, PIN 600001, India]