Privacy Policy

1. Your data, and your business's data

When you create an account, sign in or contact us, we decide how your personal data is used. For that data, we are the Data Fiduciary under the DPDP Act.

Your business also uses Finvosmart to keep records about other people — customers, vendors and employees. For those records, your business is the Data Fiduciary. We process them only on your business's instructions, to provide the service, as a Data Processor. Requests about those records should go to the business that holds them, and we will help it respond.

2. Personal data we collect

• Account details: your name, email address, mobile number (if you give it) and password. Passwords are stored only as a one-way bcrypt hash, which nobody — including us — can read.
• Company details: your business name and, if you add them, your GSTIN, address and other registration details.
• If you sign in with Google: your name and email address, after Google confirms your identity. We never see your Google password.
• Records you add while using Finvosmart, such as invoices, customer and vendor details, and employee records.
• Security and usage data: IP address, browser type, sign-in times and server logs of requests to our service.
• Messages you send us, such as support requests.

3. Why we use it

• To create your account and company, and to sign you in securely.
• To provide the features you use — GST invoicing, e-invoicing, inventory, CRM, HR and the rest of Finvosmart.
• To send emails about your account: welcome messages, sign-in codes, password resets and important service updates.
• To answer your questions and give support.
• To keep the service secure: to detect abuse, prevent fraud and investigate incidents.
• To meet our legal obligations, such as keeping records required by law.

We use personal data only for these purposes. We do not sell personal data, and we do not use it for advertising.

4. Who we share it with

We share personal data only with service providers that help us run Finvosmart, only as much as each needs, and only for the purposes above:

• Our hosting provider, which runs the servers that store Finvosmart's data.
• Our email delivery provider, which sends account emails such as sign-in codes and password resets.
• Google, if you choose "Sign in with Google": we send Google your sign-in token so it can confirm the token is genuine.
• Meta's WhatsApp Business service, only if your business turns on WhatsApp sending: the recipient's number and the message or invoice being sent.
• The Government of India's e-invoice (IRP) and e-way bill systems, only when you generate an e-invoice or e-way bill: the invoice details the law requires, including your customer's GSTIN.

We may also disclose personal data where the law requires it, for example to comply with a valid order from a court or government authority.

5. Cookies and tracking

We do not use advertising or analytics trackers. To keep you signed in, the app stores your session in your browser's local storage, together with preferences such as the light or dark theme. Signing out removes your session.

6. How we protect it

• Encrypted connections (HTTPS) between your browser and our servers.
• Passwords stored only as bcrypt hashes.
• Role-based access, so each person sees only what their role allows.
• Strict separation between companies: one company can never see another company's data.
• Rate limits on sign-in and sign-up to stop automated attacks.

No system is perfectly secure. If a breach affects your personal data, we will inform you and the Data Protection Board of India as the DPDP Act requires.

7. How long we keep it

• We keep account and company data for as long as your account is open.
• When an account is closed, we delete or anonymise its personal data unless the law requires us to keep it longer — for example, tax records — or we need it to resolve a dispute. Before deleting a company's data, we give the business a chance to export it.
• We keep security logs for at least one year, as the DPDP Rules require.

8. Your rights

Under the DPDP Act, you can:

• Ask for a summary of the personal data we hold about you and how we use it.
• Ask us to correct, complete or update it.
• Ask us to erase it, unless we must keep it by law.
• Withdraw consent you have given. This does not affect processing already done, and we may then be unable to provide some services.
• Nominate someone to exercise these rights for you if you die or become unable to.
• Raise a grievance with us.

To use any of these rights, email contact@finvosmart.com. We may need to confirm your identity first. We aim to reply quickly, and we will always respond within 90 days — the maximum the DPDP Rules allow.

For records a business keeps about you in Finvosmart (for example as its customer or employee), please contact that business; we will help it respond.

9. Grievance Officer and complaints

You can contact our Grievance Officer at contact@finvosmart.com — please put "Grievance" in the subject line. If you are not satisfied with our response, you can complain to the Data Protection Board of India.

10. Children

Finvosmart is a tool for businesses and is not meant for anyone under 18. We do not knowingly collect children's personal data. If you believe a child has given us personal data, contact us and we will delete it.

11. Where your data is stored

Your data is stored on servers operated by our hosting provider. If personal data is ever transferred outside India, we will do so only as permitted under Indian law.

12. Changes to this policy

When this policy changes, we will update the date at the top. For significant changes, we will also tell you by email or in the app.

Contact us

Navgrow Engineering Service Pvt. Ltd.

CIN: U29302WB2025PTC281015

Email: contact@finvosmart.com