This Privacy Policy (the “Policy”) describes how FynHelp (“FynHelp”, “we”, “us” or “our”) collects, uses, discloses, stores and protects personal data in connection with the website at fynhelp.com and the FynHelp platform (together, the “Service”).
This Policy is published in accordance with section 43A of the Information Technology Act, 2000 (the “IT Act”), the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (the “SPDI Rules”), and the Digital Personal Data Protection Act, 2023 together with the Digital Personal Data Protection Rules, 2025 (together, the “DPDP Law”), to the extent in force. Capitalised terms not defined in this Policy have the meanings given to them in our Terms and Conditions of Service.
1. Scope
This Policy applies to personal data relating to:
partners, employees and contractors of chartered accountant firms and other customers who hold accounts on the Service (“Users”);
visitors to our website, including persons who join a waitlist or book a demonstration; and
individuals whose personal data is contained in Customer Data uploaded by a customer, to the limited extent described in Clause 2.
2. Our role in processing personal data
As Data Fiduciary. FynHelp determines the purpose and means of processing account, billing, support and website data. This Policy applies to that data in full.
As Data Processor. Where a customer uploads its clients’ bank statements, ledgers, GST and TDS registers or other documents, the customer is the Data Fiduciary for any personal data in those documents. FynHelp processes such data solely on the customer’s behalf and in accordance with its instructions and our Terms and Conditions of Service.
An individual whose data has been uploaded by a chartered accountant firm should direct any request regarding that data to the firm in the first instance. If such a request is received by FynHelp, we shall forward it to the relevant firm, inform the individual that we have done so, and assist the firm in responding.
The Service is designed to enable chartered accountant firms to maintain the confidentiality they owe to their clients under the Chartered Accountants Act, 1949 and the Code of Ethics issued by the Institute of Chartered Accountants of India.
3. Personal data we collect
We collect the following categories of personal data:
| Category | Description | Source |
|---|---|---|
| Account data | Name, work email address, mobile number, firm name, role and password (stored in hashed form) | Provided by the User at registration |
| Billing data | Billing name and address, GSTIN, plan details, invoice history, payment status and transaction reference | Provided by the User and by our payment gateway |
| Customer Data | Bank account numbers and transactions, counterparty names, ledger entries, PAN, GSTIN, TDS details, invoices, and names, email addresses and telephone numbers of client contacts | Uploaded by the customer, received through Gmail intake, or exported from Tally or Zoho Books |
| Usage and device data | IP address, browser and device type, pages accessed, timestamps, audit-trail entries and error reports | Collected automatically |
| Communications | Support correspondence, feedback and demonstration booking details | Provided by the individual |
| Website data | Name, email address, firm name and cookie identifiers | Provided by the visitor and collected through cookies |
We do not collect or store payment card numbers, CVV numbers, UPI PINs or internet banking credentials. All payments are processed by our payment gateway, Razorpay, in accordance with its own security standards.
Financial information, including bank account details, constitutes sensitive personal data or information under Rule 3 of the SPDI Rules. Such information is collected only for the purposes set out in Clause 4 and with consent obtained by the User or by the customer, as the case may be.
4. Purposes of processing
We process personal data for the following purposes:
| Purpose | Data used | Basis |
|---|---|---|
| Creating and securing accounts and authenticating Users | Account and usage data | Consent; performance of contract |
| Providing the Service, including document extraction, reconciliation, exception review, MIS preparation and reminders | Customer Data and account data | Instructions of the customer as Data Fiduciary |
| Billing and issuing tax invoices and credit notes | Account and billing data | Performance of contract; legal obligation |
| Providing customer support and service communications | Account data and communications | Performance of contract |
| Maintaining security, preventing fraud and misuse, and keeping audit logs | Usage and account data | Legitimate use; legal obligation |
| Improving the Service through aggregated and de-identified analytics | Usage data | Consent |
| Sending product updates and promotional communications | Email address | Consent |
| Complying with law, court orders and lawful requests of government authorities | As required | Legal obligation |
We shall seek fresh consent before processing personal data for any purpose not described in this Policy.
Consent may be withdrawn at any time through the account settings or by writing to privacy@fynhelp.com, and withdrawal shall be as easy as the giving of consent. Withdrawal does not affect the lawfulness of processing carried out before it, but may prevent us from providing those parts of the Service that depend on the consent withdrawn.
5. Disclosure and sub-processors
We disclose personal data only to service providers that assist us in operating the Service. Each provider is bound by written obligations of confidentiality and security and receives only the data necessary for its function.
| Provider | Function | Data shared |
|---|---|---|
| Supabase | Database, authentication and file storage | All data held on the Service |
| Vercel | Website and application hosting | Usage data and application traffic |
| Google (Gemini) and Groq | Reading of document text that cannot be parsed directly; drafting of MIS narratives | Document text relevant to the task |
| OCR.space | Text recognition for scanned documents | Scanned pages relevant to the task |
| Razorpay | Payment processing | Billing data |
| Resend | Transactional and reminder emails | Name, email address and message content |
| Meta (WhatsApp Business) | Reminder messages, where enabled | Recipient telephone number and message content |
| Google (Gmail API) | Document intake from a connected mailbox, where enabled | Emails and attachments routed by the User |
| PostHog | Product analytics | Usage data |
| Sentry | Error monitoring | Technical error data and limited identifiers |
Artificial intelligence providers process data under terms that prohibit them from using it to train their models. FynHelp does not use Customer Data to train artificial intelligence models made available to other customers.
FynHelp’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
We may also disclose personal data:
to government agencies, courts or regulators where required by law, including under section 69 of the IT Act;
to a purchaser or successor in connection with a merger, acquisition or sale of business, subject to that party honouring this Policy; or
with the consent of the individual concerned.
We do not sell, rent or trade personal data.
6. Cookies
We use essential cookies to keep Users signed in and to protect the Service against fraud. These cookies cannot be disabled.
We use analytics cookies only with consent obtained through our cookie banner. Preferences may be changed at any time. We do not use advertising cookies and do not sell browsing data.
7. Location of data and cross-border transfers
Our primary database is hosted with Supabase in Sydney, Australia (Supabase ap-southeast-2).
Certain providers listed in Clause 5.1 process data outside India. Such transfers are made in accordance with section 16 of the Digital Personal Data Protection Act, 2023 and shall cease in respect of any country to which transfers are restricted by the Central Government.
Security logs are maintained within India as required by the directions issued by the Indian Computer Emergency Response Team (“CERT-In”) on 28 April 2022.
8. Data retention
We retain personal data only for as long as is necessary for the purposes for which it was collected, or as required by law:
| Category | Retention period |
|---|---|
| Customer Data | For the duration of the subscription and a thirty (30) day export period following cancellation, after which it is deleted within thirty (30) days |
| Account data | For the duration of the account, after which it is deleted or anonymised within ninety (90) days |
| Invoices, billing and tax records | Seventy-two (72) months, as required under section 36 of the Central Goods and Services Tax Act, 2017 and applicable income-tax law |
| Security and access logs | Not less than one (1) year under the DPDP Law, including one hundred and eighty (180) days within India under the CERT-In directions |
| Backups | Overwritten on a rolling cycle not exceeding thirty-five (35) days |
| Marketing contacts | Until the individual unsubscribes or withdraws consent |
Where we intend to erase personal data on account of prolonged inactivity, we shall notify the individual at least forty-eight (48) hours before such erasure.
9. Security practices
We maintain reasonable security practices and procedures in accordance with section 43A of the IT Act, Rule 8 of the SPDI Rules and the DPDP Law, including:
encryption of data in transit using TLS 1.2 or higher, and encryption of data at rest;
logical segregation of each customer’s data at the database level;
private file storage, with access provided only through short-lived signed links;
role-based access controls and least-privilege access for FynHelp personnel;
multi-factor authentication for administrative access;
logging and monitoring of access and changes, including a complete audit trail of review decisions;
regular backups and a documented recovery procedure; and
written confidentiality and security obligations with every sub-processor.
No method of transmission or storage is entirely secure. Any suspected compromise of an account should be reported immediately to support@fynhelp.com.
10. Personal data breaches
In the event of a personal data breach, FynHelp shall:
report reportable cyber security incidents to CERT-In within six (6) hours of becoming aware of them;
intimate the Data Protection Board of India without delay, and furnish a detailed report within seventy-two (72) hours, as required by the DPDP Law;
inform affected individuals without delay, in clear and plain language, of the nature of the breach, its likely consequences, the measures taken, and the steps they may take to protect themselves; and
where FynHelp acts as Data Processor, inform the affected customer without delay so that it may discharge its own obligations.
11. Rights of individuals
Subject to the DPDP Law, individuals have the right to:
obtain a summary of their personal data and of the processing activities undertaken, and the identities of the persons with whom it has been shared;
have inaccurate or incomplete personal data corrected, completed or updated;
have personal data erased where it is no longer necessary, unless retention is required by law;
withdraw consent at any time;
have their grievances redressed; and
nominate another individual to exercise these rights in the event of their death or incapacity.
Requests may be made through the account settings or by writing to privacy@fynhelp.com from the registered email address. We may take reasonable steps to verify the identity of the requester. We shall acknowledge each request within forty-eight (48) hours and respond within thirty (30) days, and in any event within the period of ninety (90) days prescribed under the DPDP Law.
12. Children
The Service is intended for professionals and businesses. We do not knowingly collect personal data from any person under the age of eighteen (18) years.
Where Customer Data contains personal data of a minor, the customer, as Data Fiduciary, is responsible for obtaining any verifiable parental consent required under the DPDP Law.
13. Grievance officer
Queries, requests and complaints regarding personal data may be addressed to:
- Name
- To be published
- Designation
- Grievance Officer
- Address
- the address to be published on this page
- grievance@fynhelp.com
- Privacy requests
- privacy@fynhelp.com
- Telephone
- To be published
We shall endeavour to redress grievances within one (1) month of receipt, as required by the SPDI Rules. An individual who is not satisfied with our response may, after exhausting this process, approach the Data Protection Board of India once the relevant provisions of the DPDP Law are in force.
14. Amendments
We may amend this Policy from time to time. Material amendments shall be notified to Users by email and within the Service not less than fifteen (15) days before they take effect. The date at the head of this Policy indicates when it was last revised.