India · Policy version 2026-11-04
Privacy notice
Draft for operator and legal review. Business identity, contact, provider details and retention arrangements are not yet finalized. Production registration remains closed until the operator completes and approves these policies.
Operator: Not yet specified
Privacy and grievances: Contact to be published before launch
Who this notice covers
Complyra is a financial record organization and review service intended for adults in India. The service operator’s identity and privacy contact appear below. This notice describes the implemented product controls; it is a draft until the operator completes and approves it.
Information we process
We process your name, verified email, a salted password hash, session metadata, policy acceptance version, preferences, and the financial records you choose to upload. These records may contain merchant descriptions, transaction dates, amounts and your remarks. Security events record account activity and account identifiers. Never upload passwords, card security codes, or records you are not authorized to share.
Purpose and choices
We use these records to operate your private workspace, classify and review transactions, provide reports, verify access, prevent abuse, and send requested operational emails. External AI and statement reminder emails are off by default and can be enabled or withdrawn separately in Settings. Withdrawal stops future requests; it does not undo processing that has already occurred.
Processors and international processing
The deployed service may use Oracle Cloud for storage and an SMTP provider for email. When you enable external AI, summaries, merchant narrations, and your assistant questions can be sent to OpenAI. Long number sequences in categorization requests are redacted, but free text can still contain personal information. Provider location, cross-border safeguards, processor terms and applicable retention settings must be documented by the operator before launch. Do not include unnecessary sensitive information in remarks or questions.
Retention and deletion
Active account records remain until you delete the account or the operator applies a documented lawful retention requirement. New statement imports replace the active statement. Original uploaded files are processed in memory and are not retained by this application. Workspace audit history is capped at 300 entries, security history at 500 events, and expired verification/reset tokens are pruned during security updates. Account deletion removes the live workspace and account, revokes sessions, and anonymizes the account identity in the retained security event history. Hosting logs, processor copies and backups follow operator-managed retention, which must be published before launch.
Your controls and requests
You can edit your display name, download your profile and workspace data, change your password, revoke sessions, withdraw optional AI/email choices, and delete your account in Settings. Contact the published privacy contact for email corrections, access, erasure, grievances, or other rights available under applicable Indian law. The operator must verify the requester’s identity and respond within the applicable statutory period.
Security and incidents
The application uses verified email activation, memory-hard password hashing, revocable server-side sessions, account access rules and isolated workspace records. Production storage requires authenticated encryption and Oracle. No system can promise absolute security. The operator is responsible for access reviews, backups, incident response and legally required notifications.
Children and changes
This service is intended for users aged 18 and over. Do not provide children’s records without appropriate legal authority. Material changes to processing require an updated notice and any legally required renewed consent; the operator must maintain this notice as the service changes.
Indian data protection obligations have phased effective dates. The operator must confirm which provisions apply to its deployment and processing activities. Official MeitY DPDP Rules.