India · Policy version 2026-11-12
Privacy notice
Who operates Complyra
Complyra is the public name of this service. These notices do not identify whether a separate legal entity operates it. The service operator can be contacted at the privacy and grievances address shown above. This service is intended for adults and is designed around INR-denominated financial records.
Information we process
We process your name and email address, a salted password hash (not your password), email-verification and password-reset tokens, session and security events, the version and time of your policy acceptance, account preferences, and the transaction records you choose to import. Transaction data can include dates, amounts, merchant descriptions, categories and your remarks. The service does not need your bank password, card security code, or online-banking credentials; do not upload them or records you are not authorized to share.
How information is used
We use account and transaction information to provide your private workspace, import and organize records, generate reports, authenticate users, protect the service, and send verification or password-reset emails you request. External AI assistance and statement reminder emails are off by default and have separate controls in Settings. Turning either off stops future optional processing or reminders; it cannot undo processing already completed.
Service providers and processing locations
GitHub Pages serves the static website, Render hosts the API in Singapore, Neon hosts the encrypted application database in the United States (US East), and Resend sends verification and password-reset emails. These providers may process technical request data to deliver and secure their services and are subject to their own terms and privacy notices. When you explicitly enable external AI assistance, the relevant statement summary, merchant narration, or assistant message is sent to OpenAI to produce the requested response. Long number sequences in some categorization requests are redacted, but free-text remarks and questions can still contain personal information. Do not include unnecessary sensitive details. Provider infrastructure or support may involve other locations; information may therefore be processed outside your country, subject to applicable law.
Retention and deletion
Imported transaction records and account data remain in the active service until you delete your account or deletion is otherwise required by law. A new statement import replaces the active statement. The original CSV or Excel file is processed in memory and is not retained by the application; the extracted records are saved to your workspace. Verification and reset links expire after 30 minutes. Sessions expire after 30 minutes of inactivity and no later than seven days after creation. Account deletion removes the live account and workspace, revokes sessions and pending tokens, and replaces the account email in existing security events with a deleted-account label. Provider logs and backups may persist under the providers' own retention schedules and are not immediately removed by this application.
Your choices and privacy requests
In Settings you can update your display name, export your profile and workspace data, change your password, revoke sessions, turn off optional AI or reminder email, and delete your account. You may also contact the address above to request access, correction, erasure, or help with a grievance. We may ask for information needed to verify that a request is yours and will handle it under applicable law.
Security and incidents
Passwords are processed using salted scrypt hashes. Application records are encrypted with AES-256-GCM before being stored, and production connections use HTTPS/TLS. Accounts require email verification; sessions can be revoked and workspace records are separated by account. No system can promise absolute security. If a security incident affects your information, the operator will take steps required by applicable law.
Children and notice changes
The service is for people aged 18 and over. Do not submit a child's personal information. We will update this notice when our data practices materially change and obtain any renewed consent required by law. The policy version and effective date appear above.
These notices describe current Complyra service practices and do not limit rights available under applicable law. See the official MeitY Digital Personal Data Protection Rules, and contact the operator for privacy requests or grievances.