Privacy Policy

What we collect, why, who helps us process it, and the choices you have.

Updated November 2026

1. What we collect

Account details: your name and email address, and a hashed password, or your Google account name and email if you sign in with Google.
Financial information you enter: income, expenses, investments, loans, goals, insurance and SIPs in the planner and calculators.
Profile and family details: date of birth, country of residence, and the relationship and age of family members you add, used for retirement, goal and insurance calculations.
Adviser and client details: if an adviser invites you, the details they or you add to your profile, such as your email, phone number and intake-form answers, and the adviser's notes.
What you ask the AI: your FinChat messages and the AI action plans generated for you. If you try FinChat without an account, we keep the questions you type, but not your IP address. Please don't type personal details into your questions.
Usage records: when you're signed in, we log the pages you visit and the buttons you click, with your IP address and browser type. Our web servers also keep standard logs for security and debugging.
Payment details: handled by Stripe. We see your plan and payment status, never your card number.

We don't collect bank account or card numbers, PAN or Aadhaar numbers, or logins to your bank or investment accounts. You type in your numbers yourself.

2. How we use it

To run your account and keep your session secure.
To calculate and show your plan, financial health score, reports and AI features.
To let an adviser you work with see and manage the profile you share with them.
To support you, fix problems and decide what to improve, including from the usage records above.
To improve FinChat: we review the questions people ask. Before a question is saved we automatically remove email addresses, phone numbers, UPI IDs, PAN, Aadhaar and passport numbers, and card, bank account and IFSC numbers that we can detect.
To send service emails: email verification, password resets and billing notices, a few getting-started emails in your first week, and, for advisers, a weekly summary of their client agenda. The getting-started emails and adviser summary have an unsubscribe link.
To send product emails, such as planning tips, reminders, a monthly summary, feature news and offers for Pro, but only if you agree. New accounts choose this with a tick-box at sign-up, and anyone can change it in their profile. Accounts created before October 2026 receive them unless they unsubscribe. Every product email has a one-click unsubscribe link.

We do not sell or rent your personal data, show ads, or share your data with advertisers or data brokers.

3. Service providers we use

These companies process data for us only to run the features you use, under their own security and privacy terms.

Provider	What for	What they receive
Railway	Hosting our app and database (servers in Singapore)	All data stored on FinPlann
Anthropic	The AI action plan, FinChat, the free money check and adviser meeting notes	A summary of your financial data and your questions, when you use these features
Stripe	Payments and subscriptions	Your email, plan and payment details
Resend	Sending emails	Your email address and the email content
Google	Sign in with Google	Your Google sign-in, if you choose it
Cloudflare	Delivering the site securely, bot checks on forms, and storing images	Your IP address and request details
Piqo	Counting visits to our pages	Aggregated page-view statistics

About the AI: Anthropic does not use data sent through its API to train its models, and keeps it for up to 30 days for safety monitoring before deleting it. You can use FinPlann without the AI features.

If you share a profile with an adviser, that adviser and their team can see it. We may also disclose data where the law requires it, or to protect the safety of our users or others.

4. Where your data is stored and how it's protected

Our servers and database are hosted in Singapore. If you live in India or elsewhere, your data is stored and processed outside your country.

Encrypted at rest: your most sensitive financial values are encrypted in our database with Fernet (AES-128-CBC with HMAC-SHA256). That covers income and loan EMIs, investment amounts and values, expense amounts, your planner snapshot, AI action plans, adviser notes and partial intake forms. With direct database access these appear as unreadable ciphertext, and our admin panel doesn't display them.

Not encrypted at rest: details we need to look records up by, such as your email address and name; category labels and text descriptions; goal target amounts; and Stripe customer and subscription IDs. These are protected by access controls and encrypted connections. We're working to expand the encrypted set.

In transit: all traffic uses HTTPS with HSTS. Keys: the encryption key is stored separately from the database and never in our source code. Passwords: hashed with PBKDF2-SHA256; we never store them in plain text.

No system is completely secure, so please keep your login details private.

5. How long we keep it

We keep your account, planner data, AI history and usage records while your account is open. When you delete your account from your profile, they are deleted with it. Separately from your chat history, we keep a copy of each question asked in FinChat, with the identifiers above removed, for 12 months to improve answers; yours are deleted with your account. Server logs are kept for a limited time for security. We keep billing records for as long as tax and accounting rules require.

6. Your rights and choices

Access: ask for a copy of the personal data we hold about you.
Correction: update your details in your profile, or ask us to correct them.
Deletion: delete your account and its data from your profile at any time, or ask us to.
Emails: turn product emails on or off in your profile, or unsubscribe with the link in any of them. Service emails, such as password resets, still come.
AI features: you can choose not to use them.

These rights apply under India's Digital Personal Data Protection Act, 2023 and other laws that cover you. Email hello@finplann.com with "Privacy request" in the subject. Our founder, Pavan Polineni, handles privacy requests and complaints, and we reply within 2 business days.

7. Cookies

We use only cookies needed to run the site: one to keep you signed in, and one that protects forms against cross-site request forgery. Cloudflare may set a cookie to tell people from bots. We don't use advertising cookies or track you across other websites. Our page-view counting doesn't rely on advertising cookies.

8. Changes to this policy

We may update this policy as FinPlann changes. We'll change the date at the top, and tell you by email about significant changes.