Privacy Policy

Finance Analyzer AI ("we", "us") provides a platform that reads bank statements, credit bureau reports, GST records and income tax returns, and turns them into analysis reports for lenders and finance teams. This policy covers the website, the web application, our API, and the WhatsApp and Telegram channels through which you can send us documents.

It explains what we collect, why, who else touches it, and how to get it deleted. If you use the platform on behalf of an employer, your employer decides who in your organisation may see the reports you generate.

Account information. Your name, email address, mobile number, company name and a hashed password. We never store your password itself.

Session information. A session token stored in your browser and the browser user-agent string it was created from, so we can keep you signed in and show you where your account is logged in.

Usage and billing records. Reports you create, how many credits each cost, your credit balance and the ledger of changes to it, and the time of your last sign-in.

Channel links. If you connect WhatsApp or Telegram, we store the chat identifier and username for that channel so replies reach the right account, along with the files you send through it.

Server logs. Ordinary web and application logs, which include IP addresses and request paths, kept for security and debugging.

We do not run third-party analytics, advertising or session-recording trackers on this site.

Bank statements, CIBIL reports, GST filings and ITR documents contain personal and financial information — often about somebody who is not you, such as a loan applicant. We treat them as the most sensitive thing on the platform.

• We use them only to produce the analysis you asked for, and to support and debug that process.
• If a PDF is password-protected, the password you supply is held only for as long as the file is being opened and is not stored with the document.
• We keep a copy of the uploaded file and the generated report so you can re-download and audit a report you have already paid for. See retention for how long.
• We do not use your documents, or anything derived from them, to train machine-learning models.

Your responsibility. When you upload someone else's statement you are confirming you have the right to do so and the lawful basis to have it processed. We act on your instructions in respect of that data.

• To create your account, sign you in and keep your session secure.
• To parse the documents you submit and generate reports from them.
• To meter credits, bill you and maintain a ledger you can check.
• To answer support requests and investigate faults you report.
• To send service messages — a report is ready, a file needs a password, your credits are low. Marketing email is separate and only with your consent.
• To detect abuse, prevent fraud and meet legal obligations.

Most statements are parsed by our own code on our own servers. Some are not: a scanned or photographed statement, or a layout we have not seen before, is sent to a third-party AI model to be read. Depending on the document that may be Anthropic, OpenAI, Google, Mistral or Amazon Web Services (Bedrock). These providers process the document to return a result to us and, under their business terms, do not train their models on it.

If you would rather no document of yours ever left our servers this way, tell us at support@zyxw.in and we will switch AI processing off for your account. Documents we cannot read without it will then fail rather than be sent onward.

We also rely on ordinary infrastructure providers for hosting, storage and message delivery (including WhatsApp and Telegram, if you use those channels). Some of these providers, and some of the AI providers above, operate outside India, so your data may be processed abroad.

We do not sell your data, and we do not share it for advertising. Beyond the sub-processors named above, we disclose information only:

• to other users of your own organisation's account, as your administrator configures;
• when the law requires it — a valid order from a court or authority with jurisdiction over us;
• to protect the platform or its users against fraud, abuse or a security incident, limited to what that requires;
• to a successor if the business is acquired, in which case this policy continues to apply until you are told otherwise.

We set one cookie: the session cookie that keeps you signed in. It is strictly necessary for the application to work, and clearing it signs you out. We do not set advertising or cross-site tracking cookies, which is why you are not asked to accept a cookie banner here.

• Uploaded documents and generated reports — kept for 90 days by default and then deleted automatically. An organisation on an enterprise agreement may set a different window; if yours has, your administrator can tell you what it is.
• PDF passwords — held only during processing, never written alongside the file.
• Account, credit and billing records — kept while your account is open, and afterwards for as long as tax and accounting law requires.
• Server logs — kept for a short operational period and then rotated away.

Traffic to the platform is served over HTTPS. Passwords are stored only as salted hashes. Access to production systems is limited to the people who operate them, and every report is scoped to the account that created it.

No system is perfectly secure. If we become aware of a breach affecting your personal data we will notify you and the relevant authority as the law requires. If you think you have found a vulnerability, please write to support@zyxw.in before disclosing it publicly.

Under the Digital Personal Data Protection Act, 2023 and other applicable law you may ask us to:

• tell you what personal data of yours we hold and who we have shared it with;
• correct anything inaccurate or incomplete;
• erase your data and close your account — we will do so except where we are required to keep records;
• nominate someone to exercise these rights if you die or become incapacitated;
• withdraw a consent you previously gave, without affecting what was done before.

Write to support@zyxw.in from the address on your account and we will respond within 30 days. If you are unhappy with our answer you may complain to the Data Protection Board of India.

The platform is built for lenders and finance professionals and is not directed at anyone under 18. We do not knowingly create accounts for children. If you believe a child has an account with us, tell us and we will remove it.

We may update this policy as the platform changes. The date at the top of this page always shows the current version. If a change materially affects how we handle your data we will tell you by email or in the application before it takes effect.

For any question about this policy, or to make a request under Your rights, write to support@zyxw.in. This address also reaches the person responsible for handling grievances about how we process personal data.