DPDP disclosure
Digital Personal Data Protection Act — disclosures
Last updated: 2026-07-18
This page satisfies the disclosure requirements of the Digital Personal Data Protection Act, 2023 (DPDP Act). For the general privacy policy see /privacy.
1. Data Fiduciary
Plenitude Systems Private Limited (CIN: U62012TN2026PTC192818) is the Data Fiduciary. Contact the DPO at privacy@finnilai.com.
2. Categories of personal data we process
| Category | Examples | Purpose | Retention |
|---|---|---|---|
| Account | Email, full name, phone, MFA secret hash | Sign-in, MFA, notifications | Life of account + 30 days |
| Workspace | Business name, GSTIN, PAN, TAN, bank details, logo | Invoice generation, tax filings | Life of workspace + 30 days |
| Transactional | Invoices, bills, ledger entries, payments, GST returns | Core accounting product | 8 years (Income Tax Act §44AA) |
| Party | Customer + vendor names, GSTINs, PANs, contact details | Recorded transactions | 8 years |
| Payment | Razorpay subscription id, customer id — NOT card numbers | Subscription billing | 7 years (RBI §16) |
| Behavioural | Session logs, IP addresses, device UA | Security, anomaly detection | 90 days |
| Support | Tickets, messages, screenshots you upload | Product support | 2 years after resolution |
3. Sub-processors we share data with
Data is stored in India and served from Mumbai (bom1 Vercel region). We use the following sub-processors — all data- processing agreements are on file:
| Sub-processor | Purpose | Data shared | Region |
|---|---|---|---|
| Supabase | Primary database + auth + file storage | All workspace data | Mumbai (ap-south-1) |
| Vercel | Application hosting + edge caching | Session cookies, request bodies | Mumbai (bom1) |
| Razorpay | Subscription billing + payment collection | Name, email, subscription metadata | India |
| Resend | Transactional email delivery | Recipient email + message body | United States |
| Meta (WhatsApp Cloud API) | WhatsApp message delivery | Phone number + template variables | United States |
| Sentry | Error monitoring | Stack traces + minimal request context (email hashed) | United States |
4. Your rights under the DPDP Act
Right to information (§8)
This page + our privacy policy constitute your notice of processing.
Right to access + portability (§11)
Log in and go to Settings → Privacy & data. The Download all my data button generates a machine-readable JSON with every row we hold for your workspace, including bank details, tokens, and audit history.
Right to correction (§12)
Every invoice, bill, party record, and setting is editable by the workspace owner + admins. Locked / issued documents that can’t be edited retain the legal form we’re required to keep — you can add correction / adjustment entries.
Right to erasure (§12)
Log in and go to Settings → Privacy & data. The Request workspace deletion action starts a 30-day cooling-off period, after which everything is permanently deleted from our systems. You can cancel any time in the 30-day window.
Tax-record retention override: if you request deletion during the 8-year Income Tax Act retention window, we cannot retain your records on your behalf, but you accept responsibility for any regulatory record request that may arise afterwards.
Right to grievance redressal (§13)
Data Protection Officer: privacy@finnilai.com. We respond within 7 business days. If unresolved, you may escalate to the Data Protection Board of India.
5. Children
FinNilai is not intended for anyone under 18. We do not knowingly process children’s personal data.
6. Security
Data at rest is encrypted (Supabase-managed AES-256). Data in transit uses TLS 1.2+ with strict transport security. RLS policies scope every query to your workspace membership. MFA is mandatory for staff accounts and available for all users. Full details in the security section of our privacy policy.
7. Changes to this page
Material changes are announced via email 30 days in advance. The Last updated date at the top of this page always reflects the current version.