Privacy policy

Last updated: 8 October 2026

This Privacy Policy explains how FinLaxmi, operated by Finominal AI Pvt Ltd (including the Google-connected application named Finlaxmi Ingest, “we”, “us” or “our”), handles information when you use finlaxmi.com, connect Gmail, upload statements, use our financial-planning tools or communicate with us through WhatsApp. Our privacy and compliance contact is developer@finlaxmi.com.

1. Information we handle

• Account and support information: information you supply, such as your name, email address, phone number, account settings and communications with us.
• Financial information: uploaded or imported statements, their full extracted text, account and card identifiers, balances, transactions, dates, descriptions, and reconciliation results. Planning tools process the income, spending, assets, debts, family details, goals and assumptions you enter.
• Statement-unlocking information: passwords or identity details you supply for opening encrypted statements, such as a date of birth or customer identifier. A statement password is different from your Gmail or internet-banking password. Do not give us your Google password, banking login password, PIN or one-time password.
• Connection and discovery information: Google authorization tokens, the connected email address, message and attachment identifiers, sender/recipient information, subjects, dates, attachment names, discovery decisions, processing status and source associations.
• Technical information: login/session cookies, IP addresses, browser/request information and operational or security logs needed to operate and protect the website.
• WhatsApp information: your phone number or messaging identifier, profile name where supplied by the platform, messages you send to our business, planning answers and replies, and delivery or interaction records available to us. This is information from your conversation with FinLaxmi, not access to your other WhatsApp conversations or address book.

2. Gmail access: permission, purpose and limits

Connecting Gmail is optional and uses Google’s authorization screen. FinLaxmi requests https://www.googleapis.com/auth/gmail.readonly. This is a broad permission that allows reading Gmail messages and settings; Google does not limit this grant to bank senders or statement attachments. FinLaxmi uses it to find and import financial statements, identify their accounts, avoid repeated processing and track their sources. It does not grant permission to send, change or delete your Gmail messages.

Our discovery workflow searches primarily for emails with attachments and can also search for limited financial emails whose useful information is in the message body. It may examine sender, recipient, subject, date and attachment metadata from non-banking emails to decide which are relevant. For candidate messages, it can read message content and attachments to identify statements, holdings or financial advice, establish ownership or account identity, and find issuer-provided password instructions. A Gmail message response may contain non-financial text and non-financial attachments alongside a relevant document. These are not used for advertising or unrelated profiling. Forwarded messages and documents identified as belonging to someone else may be excluded or held for review.

While your connection remains active, background processing may check historical periods and newly received messages. Discovery is not a guarantee that every bank, format or period will be found. We do not request access to your Google Drive, contacts or calendar for statement discovery.

3. How information is used

We use information to operate your account; import, unlock and extract statements; associate them with accounts; reconcile transactions and balances; show financial records and processing exceptions; provide requested planning or categorisation features; respond to support requests; and prevent errors, abuse and unauthorized access. Financial calculations and extracted records may be incomplete or wrong; review them against the original documents.

4. Processing providers and disclosures

FinLaxmi is a server-based service, not a browser-only or device-only tool. Our website hosting provider, Hostinger, processes stored website and statement data. Our extraction service runs on Render and receives documents and necessary processing inputs, which can include a statement password, to return extracted information. Google processes the authorization and Gmail API requests.

Some document-unlocking paths use iLovePDF, which receives the document and any supplied document password when that path is used. WhatsApp/Meta delivers business messages; where our SendPulse integration is used, SendPulse also processes messaging identifiers, incoming messages and outgoing replies. Our planning service on Render processes the answers needed to produce a requested plan. These transfers are for the feature you choose, not permission to repurpose your mailbox data for messaging or advertising.

AI-assisted categorisation or merchant identification, where used, can send transaction descriptions and relevant transaction fields to OpenAI. In limited exception paths, after fixed rules cannot read a one-off account-opening or service document or an issuer’s password-rule graphic, our extraction service can send selected candidate-email text, inline images or a small number of rendered document pages to OpenAI to propose the missing account fact or password rule. The service validates proposals before use; recurring statement ledgers are intended to use deterministic extraction and reconciliation. Planning features that offer AI explanations can send the inputs and results needed for that explanation to an AI processing provider. We do not use Google-derived information to train or improve general-purpose AI models. A new use or additional transfer of Google data requires the applicable disclosure and consent before it begins.

To name the people and businesses you pay by UPI, FinLaxmi can send a payee’s UPI ID (VPA), as printed in your statements, to cStudios, a UPI lookup service. It returns whether the ID is valid and the account-holder name, bank and merchant status the UPI network holds for it. Only the UPI ID is sent, never your mailbox, statements, amounts or account numbers, and the answer is used only to label that payee in your own ledger.

Providers may process information outside India. We limit disclosure to the service being supplied and require applicable confidentiality, security and data-use restrictions. We may also disclose information when necessary for security or legally required. A business transfer involving Google-derived information requires prior explicit consent. We do not sell personal information, provide Google-derived data to advertising platforms or data brokers, or use it for advertising, creditworthiness assessments or lending decisions.

5. Google data and Limited Use

FinLaxmi’s use of information received from Google APIs will adhere to the Google API Services User Data Policy and the Google Workspace API User Data and Developer Policy, including their Limited Use requirements. These restrictions also apply to derived information. Google data is used only for the disclosed, user-facing features and permitted security or legal purposes.

Human access to Google-derived messages, documents or financial records requires your affirmative agreement to review specific data, except for permitted security investigations, legal obligations, or aggregated and anonymized internal operations allowed by Google’s policies. General acceptance of these terms is not permission for unrestricted human review of your mailbox.

6. WhatsApp communications and choices

WhatsApp is optional. We use your conversation to answer your request, provide available planning features and offer support. Contact details and platform metadata are used to support messaging with you, not unrelated profiling. Connecting Gmail or accepting these Terms does not subscribe you to WhatsApp marketing. We seek the required opt-in before initiating messages; messages outside the customer-service window require an approved template. We do not share one customer’s chat with another customer.

You can opt out by blocking our business in WhatsApp or emailing developer@finlaxmi.com with your messaging number, including its country code. Email requests are handled by our team, not an automated STOP command. For human assistance, use the same contact. Opting out stops communications; use data deletion to request removal of retained records as well.

Do not send full card or bank account numbers, PAN or other government ID numbers, passwords, PINs or one-time passwords through WhatsApp. Use the signed-in website if an available feature needs identity details. WhatsApp and any messaging provider process their own service records under their respective policies; see WhatsApp’s Privacy Policy and SendPulse’s Privacy Policy.

7. Storage and retention

We store account information, imported financial records, full extracted statement text, source associations and processing history on our systems for the service. The current statement service also retains original statement files for verification and reprocessing. These records do not have an automatic age-based expiry. Removing a working file does not remove its extracted text, transactions or audit information.

Disconnecting Gmail stops future authorized access but does not automatically delete previously imported information. We retain it while needed for the service you use, unless you request its deletion or an applicable obligation requires otherwise. Deletion requests are handled manually as described below. Limited records may need to remain for a legal obligation, security investigation or dispute; we will explain applicable exceptions. Backup copies, where present, may persist until their normal replacement and are not a separate source for ordinary product use.

WhatsApp planning sessions may be held temporarily while answering your questions; business-message histories, support correspondence and provider records can remain separately. Ending a chat or deleting it on your phone is not a request to delete our copies. For a verified deletion request, we identify the records held by FinLaxmi and our processors, explain any restricted retention and confirm the outcome. We do not claim that all backups or independent platform records disappear immediately.

8. Your controls, access and deletion

1. Stop Gmail access: use Disconnect in FinLaxmi where available, or remove FinLaxmi’s access in your Google Account connections. Revocation does not delete your emails in Gmail.
2. Request access, correction or deletion: use our data-deletion page or email developer@finlaxmi.com from your registered email address. State whether you want a copy, a correction, deletion of specified statements, Gmail-imported data, WhatsApp data, or your entire FinLaxmi account and associated data. WhatsApp-only users can identify their messaging number, including country code, without creating a website account. Do not include passwords or attach additional financial documents.
3. Verification and completion: we may ask for proportionate evidence that the data belongs to you. We will review the request, identify affected originals, extracted text, transactions, connection details and source/audit records, and tell you when it is completed or explain any restriction. A support request is not an instant or automated deletion command. We do not promise a 24-hour deletion deadline.

You can use available features that do not require Gmail without connecting your mailbox. Deleting information may prevent us from reproducing a prior report or verifying an account history. Nothing here limits rights provided by applicable law.

We handle requests without undue delay and within applicable legal deadlines. We confirm receipt, verify ownership as needed, explain the scope and expected timing, and send a completion response or explain any lawful exception. Opening an email draft is not submission: you must send it. You can follow up at the compliance contact above.

9. Security and website technologies

We use HTTPS for website and service connections, access controls for administrative functions, encrypted storage for Gmail refresh tokens, and protections against direct public access to statement-storage folders. These measures do not constitute a guarantee that every system is immune to unauthorized access or a claim of independent security certification. Protect your account and contact us if you suspect misuse.

WordPress uses cookies for login and session functionality. Blocking necessary cookies may prevent signing in. Pages can load resources such as fonts or linked content from other providers, which receive the technical request information needed to deliver them. External websites have their own policies. Google-derived financial information is not used for cross-site advertising tracking.

On our public marketing and checkout pages, we use the Meta Pixel and related cookies to measure visits, new registrations and completed purchases from advertising. The Pixel may send Meta the page address, event type, browser/device information and, for a completed purchase, the order value and currency. For signed-in visitors on those pages, we may also provide their account email, name, phone number and FinLaxmi user ID for ad matching; Meta’s Pixel hashes matching fields before transmission. We do not load the Pixel on pages showing personal financial plans, statements, transactions, assets or Gmail-derived information, and we do not send those records or planning inputs/results to Meta. Meta processes Pixel data under its own policies. You can limit advertising cookies through your browser settings.

10. Adults, policy changes and contact

The service is intended for adults aged 18 or over and is not directed at children. Contact us if you believe a child has supplied personal information. We will post policy updates here with a revised date and provide notice and obtain consent where required before materially changing how we use Google data.

Request data deletion

Privacy and compliance: developer@finlaxmi.com. See also our Terms of Service and home page.