Privacy Policy

FiniiOne AI, operated by FiniiOne AI Technologies Pvt Ltd, with its registered office at RZD-368 ,GRD FLOOR GALI 5, MAHAVIR ENCLAVE, Palam Village, New Delhi, South West Delhi- 110045, Delhi, provides invoicing, inventory, purchase, collection, reporting and KYC verification software for businesses in India.

For the account you create with us, FiniiOne AI Technologies Pvt Ltd acts as the Data Fiduciary. For the customer, vendor and employee records you upload into your own workspace, you are the Data Fiduciary and we process that data only on your instructions as your Data Processor.

• Account details you give us: name, mobile number, email address and business name.
• Business identity details: PAN, GSTIN, business category, address and bank details used on your invoices.
• Records you create: invoices, stock entries, purchases, expenses, collections and ledgers.
• Party details you add: customer and vendor names, contact details, PAN, GSTIN and addresses.
• KYC verification inputs and results when you run a verification check.
• Payment details processed by our payment gateway. We never store your full card or UPI credentials.
• Technical data: sign-in activity, device and browser information, and error logs used to keep the service secure.

We collect only what is needed for the purposes below. We do not knowingly collect data of children or of persons with a lawful guardian without verifiable parental consent.

• Creating and securing your account and issuing one-time sign-in codes.
• Running the features you use: invoicing, inventory, purchases, collections, banking and reports.
• Statutory and tax compliance: GST return data, TDS, MSME reporting and record keeping required by Indian law.
• Customer and vendor onboarding KYC checks that you initiate.
• Billing, subscription invoices, payment confirmation and recovery of dues.
• Service communication: transaction emails, reminders, support replies and important product notices.
• Promotional or informational emails only where you have consented; you can opt out at any time.
• Fraud prevention, security monitoring and resolving disputes.

We ask for your clear, informed and specific consent before collecting your personal data — at sign-up, on our contact form, on onboarding forms and before every KYC check. No consent box is pre-ticked, and we never bundle unrelated purposes together.

You can withdraw consent at any time from the data rights page or by writing to our Grievance Officer. Withdrawal applies going forward; it does not affect processing already carried out, and we may still keep records that Indian tax and company law requires us to retain.

• You must confirm that you hold verifiable consent from the person or business being verified before you run a check.
• Bank account numbers, phone numbers and personal email addresses are masked in reports and internal logs.
• Uploaded bills and purchase documents are read in memory to fill the form and are never stored by us.
• Each verification stores the purpose, the consent confirmation and an audit trail of who ran it and when.

We share personal data only with service providers who help us run FiniiOne, under contract and only for the purposes above: our cloud hosting and database provider, our email delivery provider, our payment gateway, and the verification data sources used for KYC checks. We do not sell personal data or share it for advertising.

Data is primarily stored on servers in or serving India. Where a provider processes data outside India, the transfer is limited to countries not restricted by the Government of India.

• Account and business profile data: while your account is active.
• Invoices, tax and accounting records: at least 8 years, as required by Indian tax law, even after account closure.
• KYC verification records: 5 years from the date of the check, then anonymised.
• Contact form and support messages: 2 years.
• Security and sign-in logs: up to 12 months.

When data is no longer needed for a lawful purpose and no legal retention applies, we delete or anonymise it.

Access is protected by one-time email codes, row-level access rules so one business can never see another's data, role-based permissions for sub-users, encryption in transit, and masking of sensitive fields. If a personal data breach occurs, we will notify the Data Protection Board of India and affected users as required by law.

• Access a summary of the personal data we process about you.
• Correct or complete inaccurate details.
• Erase personal data that is no longer needed, subject to statutory retention.
• Withdraw consent for any purpose you agreed to.
• Nominate another person to exercise your rights if you die or become incapable.
• Raise a grievance with us, and escalate to the Data Protection Board of India.

Submit any of these on our data rights page.

We use only essential cookies and local storage — to keep you signed in, remember your theme and language choice, and keep forms working. We do not run advertising or cross-site tracking cookies.