Privacy Policy

1. Your data, and your business's data

When you create an account, sign in or contact us, we decide how your personal data is used. For that data, we are the Data Fiduciary under the DPDP Act.

Your business also uses Finvosmart to keep records about other people — customers, vendors and employees. For those records, your business is the Data Fiduciary. We process them only on your business's instructions, to provide the service, as a Data Processor. Requests about those records should go to the business that holds them, and we will help it respond.

2. Personal data we collect

• Account details: your name, email address, mobile number (if you give it) and password. Passwords are stored only as a one-way bcrypt hash, which nobody — including us — can read.
• Company details: your business name and, if you add them, your GSTIN, address and other registration details.
• If you sign up or sign in with Google: your name, email address and profile photo, after Google confirms your identity, and Google's ID for your Google account, so we recognise it next time. We never see your Google password.
• Records you add while using Finvosmart, such as invoices, customer and vendor details, and employee records.
• Security and usage data: IP address, browser type, sign-in times and server logs of requests to our service. For each signed-in device we keep its browser, IP address and when it was last used, so you can see your devices and sign any of them out.
• To give each business and person one free trial: a one-way hash (SHA-256) of the sign-up email address, mobile number and PAN — not the details themselves.
• If you subscribe: the plan, amounts and Razorpay's reference for each payment. Card, UPI and bank details are entered with Razorpay, not with us, and we never see them.
• Messages you send us, such as support requests.

3. Why we use it

• To create your account and company, and to sign you in securely.
• To provide the features you use — GST invoicing, e-invoicing, inventory, CRM, HR and the rest of Finvosmart.
• To send emails about your account: welcome messages, sign-in codes, password resets and important service updates.
• To answer your questions and give support.
• To keep the service secure: to detect abuse, prevent fraud and investigate incidents.
• To meet our legal obligations, such as keeping records required by law.

We use personal data only for these purposes. We do not sell personal data, and we do not use it for advertising.

4. Who we share it with

We share personal data only with service providers that help us run Finvosmart, only as much as each needs, and only for the purposes above:

• Our hosting provider, which runs the servers that store Finvosmart's data.
• Our email delivery provider, which sends account emails such as sign-in codes and password resets.
• Google, if you sign up or sign in with Google: the button and the sign-in window come from Google, which handles that step under its own privacy policy and then tells us who you are. We check its answer with the public keys Google publishes; we don't send your data to Google.
• Meta's WhatsApp Business service, only if your business turns on WhatsApp sending: the recipient's number and the message or invoice being sent.
• Razorpay, our payment partner, when you subscribe to a paid plan: the amount, your company name, and the name, email address and mobile number entered at checkout. Razorpay processes the payment under its own privacy policy.
• The Government of India's e-invoice (IRP) and e-way bill systems, only when you generate an e-invoice or e-way bill: the invoice details the law requires, including your customer's GSTIN.

We may also disclose personal data where the law requires it, for example to comply with a valid order from a court or government authority.

5. Cookies and tracking

We do not use advertising or analytics trackers. To keep you signed in, our server sets one cookie (finvo_rt) that holds your sign-in: it is HttpOnly (scripts in the page can't read it), sent only to our sign-in service, and never to other websites. The app keeps your name, company and preferences, such as the light or dark theme, in your browser's local storage. Signing out ends your session on our server and removes the cookie.

When you subscribe, the payment window is loaded from Razorpay, which may use its own cookies under Razorpay's privacy policy.

Where Google sign-in is offered, the sign-in and sign-up pages load Google's button from Google, which may use Google's own cookies under Google's privacy policy.

6. How we protect it

• Encrypted connections (HTTPS) between your browser and our servers.
• Passwords stored only as bcrypt hashes.
• Role-based access, so each person sees only what their role allows.
• Strict separation between companies: one company can never see another company's data.
• Rate limits on sign-in and sign-up to stop automated attacks.

No system is perfectly secure. If a breach affects your personal data, we will inform you and the Data Protection Board of India as the DPDP Act requires.

7. How long we keep it

• We keep account and company data for as long as your account is open.
• When an account is closed, we delete or anonymise its personal data unless the law requires us to keep it longer — for example, tax records — or we need it to resolve a dispute. Before deleting a company's data, we give the business a chance to export it.
• We keep security logs for at least one year, as the DPDP Rules require.

8. Your rights

Under the DPDP Act, you can:

• Ask for a summary of the personal data we hold about you and how we use it.
• Ask us to correct, complete or update it.
• Ask us to erase it, unless we must keep it by law.
• Withdraw consent you have given. This does not affect processing already done, and we may then be unable to provide some services.
• Nominate someone to exercise these rights for you if you die or become unable to.
• Raise a grievance with us.

To use any of these rights, email contact@finvosmart.com. We may need to confirm your identity first. We aim to reply quickly, and we will always respond within 90 days — the maximum the DPDP Rules allow.

For records a business keeps about you in Finvosmart (for example as its customer or employee), please contact that business; we will help it respond.

9. Grievance Officer and complaints

You can contact our Grievance Officer at contact@finvosmart.com — please put "Grievance" in the subject line. If you are not satisfied with our response, you can complain to the Data Protection Board of India.

10. Children

Finvosmart is a tool for businesses and is not meant for anyone under 18. We do not knowingly collect children's personal data. If you believe a child has given us personal data, contact us and we will delete it.

11. Where your data is stored

Your data is stored on servers operated by our hosting provider. If personal data is ever transferred outside India, we will do so only as permitted under Indian law.

12. Changes to this policy

When this policy changes, we will update the date at the top. For significant changes, we will also tell you by email or in the app.

Contact us

Navgrow Engineering Service Pvt. Ltd.

CIN: U29302WB2025PTC281015

Email: contact@finvosmart.com