Privacy Policy

What we collect, and why

We collect only what the service needs, grouped by purpose:

Account (essential)

Your email and sign-in identity, so we can create your account, sign you in and keep it secure. This is necessary to provide the service.

Profile for matching

Your salary band, tax regime, EPF and home-loan status, state, employer type, and whether you make 80C investments. We use these to match rule changes to you. A band is enough; we never need your exact salary for this.

Financial details (optional)

If you choose to add them, your monthly expenses, savings, investments, monthly investing, risk appetite and primary goal, used only to personalise your financial report.

Exact figures (optional)

If you add exact figures to narrow a range, we protect them as described in the next section.

Your exact salary is encrypted and write-only

Any exact figures you add are encrypted at the field level (AES-GCM) before they are written to our database. They are write-only: the API can never return them, they are never shown back to you, and they are used only inside our servers to narrow the rupee ranges you see. Everything else the service needs works from salary bands alone.

Consent and withdrawal

We rely on your consent for the non-essential purposes: personalisation, your financial report, and product emails. You can grant or withdraw any of these at any time in Profile, under Privacy and consent. Essential account processing is necessary to run the service and stays on for as long as you keep an account; if you no longer want it, you can delete your account.

Your rights

Under the DPDP framework you can:

Access and export your data

Download a machine-readable copy of your data at any time from Profile, under Your data, using Download my data.

Correct your data

Edit your profile fields whenever they change, directly in Profile.

Erase your data

Delete your account and all associated data from Profile, under Your data, using Delete my account. This is immediate and cannot be undone.

Raise a grievance

If you are unhappy with how we handle your data, write to our grievance contact below.

Retention

We keep your data only while your account is active, including your monthly briefing snapshots and any financial reports you generate. When you delete your account, we erase your personal data from our systems, except anything we must keep to meet a legal obligation.

Sharing

We do not sell your data and we do not share it with advertisers. We use a small number of infrastructure providers, for example hosting, to run the service, bound by contract to protect your data and to process it only on our instructions.

Contact

For any privacy question or to exercise a right, write to us at privacy@niyam.app. Niyam is a working title; our final contact and grievance-officer details will be confirmed before public launch.