1. Who We Are
Finosutra ("we", "us", "our") is a finance automation SaaS platform operated from Mumbai, Maharashtra, India. We provide web-based finance tools, Excel templates, calculators and educational resources for CAs, CFOs, accountants and finance teams.
Contact: fino.sutra07@gmail.com | Mumbai, Maharashtra, India
2. Information We Collect
a) Account & Authentication Data
When you create an account or log in, we collect your email address and encrypted password via Supabase Auth (our authentication provider). We also store your subscription status (free or Pro) and the date your subscription was created or renewed.
b) Saved Tool Data (Registered Users Only)
If you are logged in and choose to save your work — such as lease schedules in the Lease Portfolio or security deposit records in the Deposit Register — that data (inputs and computed outputs) is stored in our database linked to your account. This data is protected by row-level security: only you can read or modify it. Guest users who do not log in have no data stored on our servers.
c) Contact & Enquiry Forms
When you fill out our contact form, we collect your name, email address, and message. This is used solely to respond to your enquiry.
d) Payment Information
Payments for Pro subscriptions (₹499/month or ₹3,999/year) or one-time exports are processed by Razorpay. We do not collect, store or have access to your card number, UPI ID, or any payment credentials. Razorpay's own privacy policy governs payment data.
e) Usage & Analytics Data
We use Google Analytics 4 (GA4) to collect anonymous, aggregated usage data — page views, session duration, and feature interactions. GA4 data is anonymised and cannot identify you personally. You can opt out via the Google Analytics Opt-out Browser Add-on.
3. How We Use Your Information
- To authenticate your account and maintain your session
- To store and retrieve your saved leases, security deposits, and other tool data across sessions
- To manage your Pro subscription status and grant access to premium features
- To process payments via Razorpay and issue receipts or confirmations
- To respond to contact form enquiries
- To improve our tools and user experience based on aggregated, anonymous analytics
- To comply with applicable Indian laws and regulations
We do not sell, rent or share your personal information with third parties for marketing purposes.
4. Third-Party Services
We use the following third-party services whose privacy policies govern their respective data handling:
- Supabase — authentication and database (stores account data and saved tool records). Data is hosted on AWS infrastructure in the US East (N. Virginia) region. See supabase.com/privacy
- Razorpay — payment processing. See razorpay.com/privacy
- GitHub Pages — website hosting. See GitHub Privacy Statement
- Google Analytics 4 — anonymous usage analytics. See policies.google.com/privacy
- Google Fonts — font delivery via CDN. Google may log the request IP. See policies.google.com/privacy
5. Data Retention
Account data (email, subscription status) is retained for as long as your account is active. If you request account deletion, we will delete your account and all associated saved records within 30 days.
Saved tool data (leases, security deposits) is retained until you delete it from within the tool, or until you request account deletion.
Payment records are retained by Razorpay as required by applicable law. We retain subscription transaction references (not payment credentials) for a minimum of 7 years as required under Indian accounting standards.
Analytics data (GA4) is retained for 14 months per Google's default retention policy.
Guest users who do not create an account have no personal data stored on our servers beyond what GA4 anonymously collects.
6. Data Transfers
Our database infrastructure (Supabase) is hosted on servers located in the United States. By creating an account and saving data, you consent to your data being transferred to and processed in the United States. Supabase complies with applicable data protection standards including SOC 2 Type II certification.
7. Your Rights
Under the Digital Personal Data Protection Act, 2023 (DPDP Act) and applicable Indian law, you have the right to:
- Access personal data we hold about you
- Correct inaccurate or incomplete personal data
- Erase your personal data (right to be forgotten) — we will delete your account and all saved records within 30 days of a verified request
- Nominate another individual to exercise these rights on your behalf in the event of your death or incapacity
- Withdraw consent for communications at any time by unsubscribing or emailing us
To exercise any of these rights, email us at fino.sutra07@gmail.com. We will respond within 15 business days.
8. Cookies & Local Storage
We use browser localStorage to track free export usage per month (a count only — no personal data). Supabase Auth uses browser cookies to maintain your login session. We do not use third-party tracking or advertising cookies. Google Analytics and Google Fonts may set their own cookies subject to Google's privacy policy.
9. Security
We take reasonable technical and organisational measures to protect personal data:
- All data in transit is encrypted via HTTPS/TLS
- Database records are protected by row-level security (RLS) — each user can only access their own data
- Authentication is handled by Supabase Auth using industry-standard bcrypt password hashing
- Payment processing is handled exclusively by Razorpay's PCI-DSS compliant infrastructure
10. Children's Privacy
Our services are intended for finance professionals and are not directed at persons under the age of 18. We do not knowingly collect data from minors. If you believe a minor has created an account, please contact us and we will delete it promptly.
11. Governing Law
This Privacy Policy is governed by the laws of India, including the Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000, and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. Any disputes shall be subject to the exclusive jurisdiction of courts in Mumbai, Maharashtra.
We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision. For material changes, we will notify registered users by email. Continued use of our services after any changes constitutes acceptance of the updated policy.