Privacy Policy

Fynlens is operated by Vaishali Pandey, an individual sole proprietor based in Bengaluru, Karnataka, India, doing business under the brand name "Fynlens". She is the data controller for personal data processed in connection with the Services and, for purposes of India's Digital Personal Data Protection Act, 2023 (the "DPDP Act"), the Data Fiduciary.

For privacy questions or to exercise your rights, contact fynlensdeveloper@gmail.com.

This policy applies to the Fynlens mobile app on iOS and Android, the Website, and the email, push, and in-app messages we send you.

It does not apply to third-party websites or services that Fynlens links to (for example, your bank, your payment app, or the app stores). Those services have their own privacy policies.

We collect data you give us, data from files you choose to upload, and limited information collected automatically.

3.1 Information you provide

• Account details, such as your email, display name, and optional profile information (for example a photo, phone number, or preferences).
• Financial information you choose to record, such as transactions, balances, bills, budgets, goals, the accounts you set up, and your notes.
• Group and split details, including information you choose to enter about people you split expenses with.

We do not access your device's contacts or address book; any details about other people are entered by you.

3.2 Files you upload

When you choose to upload a statement, receipt, or photo, we store and process it to extract and organise the information it contains (see §8). These files can contain sensitive financial details, so you decide whether and when to upload them.

3.3 Information collected automatically

• Basic device and app information (such as device type, operating system, and app version) and a notification token, used to provide the Services and deliver notifications you've enabled.
• Limited usage and diagnostic information, used to keep the Services secure, understand how features are used, and improve them.
• Network information such as IP address, used for security and to record your consents.

We do not collect your precise location, and we do not use advertising identifiers or third-party advertising trackers.

• To provide and operate the Services.
• To personalise your experience and honour your settings.
• To communicate with you — including service messages and, only if you opt in, marketing messages (see §13).
• To keep the Services secure, prevent fraud and abuse, and troubleshoot problems.
• To understand and improve how the Services are used.
• To comply with our legal obligations and enforce our terms.

We do not sell your data, profile you for advertising, or use your financial information to train AI models.

If you're in the EEA or UK, we process personal data on these bases: performance of our contract with you (to provide the Services); your consent (for optional processing such as marketing and analytics, which you can withdraw at any time); our legitimate interests (to keep the Services secure and to improve them); and compliance with legal obligations. Where we process any sensitive data, we rely on your explicit consent.

We share personal data only as needed, and never for others' independent purposes:

• Service providers who help us run the Services on our behalf — such as cloud hosting and storage, document and data processing, communications and notifications, analytics, and payment and subscription management. They may process your data only on our instructions and under appropriate confidentiality and data-protection terms.
• Other people you choose to share with, such as members of expense-splitting groups you create or join. Information you share into a group is visible to its members, and information you enter about other members is visible to them once they join.
• Legal and protective situations — where reasonably necessary to comply with law or a lawful request, enforce our terms, prevent fraud or harm, or in connection with a business transfer (in which case we'll notify you and require comparable protection for your data).

6.1 Third-party AI and infrastructure sub-processors

When you upload a document for automatic processing (see §8), we share specific data with the following named sub-processors. Each acts only on our instructions, under a data-processing agreement that requires confidentiality and protections equivalent to those in this policy, and is contractually prohibited from using your content to train its models:

A given parsing request may be routed to OpenAI or to Google Gemini depending on document type, language, and availability.

We do not share your personal data with data brokers or advertising networks.

Fynlens is operated from India and relies on the service providers named in §6.1, which may process data in more than one country. Google Cloud services (hosting, storage, Document AI, and the Gemini API) are configured to process in the India (Mumbai, asia-south1) region for India-resident users where a regional endpoint is available. OpenAI processes requests in its own regions (which may include the United States); for those transfers we rely on contractual safeguards, including OpenAI's enterprise data-processing terms. Where personal data is transferred across borders, we use appropriate safeguards as required by applicable law, and we do not transfer data to any country restricted under applicable law. You can contact us for more information about these safeguards.

To save you time, Fynlens uses automated tools — including third-party AI services acting on our behalf — to read and organise information from documents you choose to upload, such as turning the contents of a statement or receipt into transactions. Before you upload a document we ask for your explicit consent and identify exactly who receives your data.

How it works, and who receives your data:

1. Google Document AI performs OCR on the document you upload (it receives the document's image/PDF contents).
2. The extracted text is then sent to a large language model — OpenAI (e.g. GPT-4o-mini) or Google Gemini (e.g. Gemini 2.5 Flash) — to identify transaction lines, merchants, dates, and amounts. The text sent can include your name, account-holder details, masked account numbers, transaction descriptions, and amounts.

Full details of each provider, the exact data shared, and where it is processed are in §6.1.

• This happens only when you choose to upload a document, after you grant the in-app Financial Data Processing consent.
• The information processed can include the sensitive financial details those documents contain.
• We do not use your financial information to train AI models, and none of these AI providers train on it — this is a contractual commitment, not the default behaviour of any consumer chatbot.
• We do not use automated processing to make legal or similarly significant decisions about you (for example, we do not assess creditworthiness).

If you'd rather not have a document processed this way, you can enter the information manually instead. If we materially change how this processing works — including adding or changing an AI provider — we'll publish a new version of this policy and the Financial Data Processing consent, and seek your consent again.

We keep personal data only for as long as needed for the purposes described in this policy, or as required by law. In general, we keep your account and financial information while your account is active. When you delete content or your account, we delete the associated personal data without undue delay — except where we must retain limited information to comply with legal obligations, resolve disputes, or maintain required records (such as proof of consent). Information you contributed to shared groups may remain with those groups' records, as described in §11.1.

We use reasonable technical and organisational measures designed to protect your data, including encryption of data in transit and at rest, access controls, and limiting access to authorised systems and personnel. No method of transmission or storage is completely secure, but we work to protect your information and will notify you and the relevant authorities of a personal-data breach where required by law.

Depending on where you live, you may have the right to access, correct, delete, export, or restrict the use of your personal data, to object to certain processing, and to withdraw consent for optional processing (such as marketing) at any time without affecting your use of the core app. Many of these are available directly in the app; you can also contact us at fynlensdeveloper@gmail.com. We'll respond within the time required by applicable law, won't discriminate against you for exercising your rights, and you may also lodge a complaint with your local data protection authority.

11.1 How to delete data

You can delete your data directly in the app:

• Delete individual records at any time — transactions, bills, budgets, goals, the accounts you've added, uploaded files and the information extracted from them, group content you authored, and optional profile fields.
• Deactivate your account (reversible) — your data is preserved and you can sign back in.
• Delete your account (Settings → Account → Delete account) — this permanently deletes your personal data without undue delay.

Some information may remain after account deletion:

• Shared group records. Information you contributed to groups you joined or created — including your display name as it appeared on past shared expenses — may remain visible to the other members so their shared financial records stay accurate. This is a recognised limit on the right to erasure under the GDPR and the DPDP Act. To remove your contributions from a group beforehand, leave the group first (other members may still keep their own records).
• Legal records. Limited information we are required to keep (such as proof of consent or records required by law) is retained only for as long as required and used only for that purpose.

Subscriptions purchased through an app store are managed by that store; cancel there.

Fynlens is intended for users aged 18 and over. We do not knowingly collect personal data from anyone under 18, and we will delete such data promptly if we learn of it. If you believe a minor has provided us with personal data, contact us at fynlensdeveloper@gmail.com.

We send marketing messages (such as product updates, tips, and offers) only if you opt in. See our Marketing Communications Consent for details and how to opt out. Service messages (such as account, security, and billing notices, and notifications you've configured) are not marketing and are sent because they're necessary to provide the Services.

The Fynlens mobile app does not use web cookies. It stores limited information on your device — such as sign-in tokens and cached data — so the Services work offline and across sessions, and uses limited analytics to understand usage and improve the app. Our website may use strictly necessary cookies for basic site function; if we add analytics or marketing cookies in the future, we'll provide a consent option and update this policy.

We may update this policy from time to time. We'll change the "Last updated" date and highlight material changes in the app or on our website, and seek your fresh consent where required by law. Continued use of the Services after an update takes effect means you accept the revised policy.

• Privacy questions, exercising your rights, or reporting a security concern: fynlensdeveloper@gmail.com
• Grievance Officer (India / DPDP Act): Vaishali Pandey, reachable at fynlensdeveloper@gmail.com.
• Postal correspondence: We're based in Bengaluru, Karnataka, India; email us first and we'll provide a mailing address on request.

India (DPDP Act 2023)

If you are located in India, the DPDP Act applies in addition to the rest of this policy. Vaishali Pandey is the Data Fiduciary. You have the right to access, correction, and erasure of your data, to grievance redressal, and to nominate another individual to exercise your rights in the event of your death or incapacity. We process personal data with your consent, which you can withdraw at any time; withdrawal does not affect processing carried out before then. Our Grievance Officer is reachable at fynlensdeveloper@gmail.com.

European Economic Area and United Kingdom (GDPR)

Vaishali Pandey is the controller. You have the rights of access, rectification, erasure, restriction, portability, and objection, and the right not to be subject to solely automated decisions producing legal or similarly significant effects (which we do not make). Our lawful bases are described in §5, and cross-border transfers use appropriate safeguards (see §7). You may lodge a complaint with your supervisory authority.

California (CCPA / CPRA)

We collect the categories of personal information described in this policy (identifiers, commercial information such as subscription history, internet and usage activity, and the financial information you provide, which may be "sensitive personal information") — from you, from your device, and from your sign-in provider if you use it — for the business purposes described above. We do not sell or share your personal information for cross-context behavioural advertising, and we use sensitive personal information only to provide the Services you request. You have the rights to know, delete, correct, and limit, and we won't discriminate against you for exercising them. To exercise these rights, email fynlensdeveloper@gmail.com.