DPDP disclosure
Digital Personal Data Protection Act — disclosures
Last updated: 2026-07-18
This page satisfies the disclosure requirements of the Digital Personal Data Protection Act, 2023 (DPDP Act). For the general privacy policy see /privacy.
1. Data Fiduciary
Plenitude Systems Private Limited (CIN: U62012TN2026PTC192818) is the Data Fiduciary. Contact the DPO at privacy@finnilai.com.
2. Categories of personal data we process
| Category | Examples | Purpose | Retention |
|---|---|---|---|
| Account | Email, full name, phone, MFA secret hash | Sign-in, MFA, notifications | Life of account + 30 days |
| Workspace | Business name, GSTIN, PAN, TAN, bank details, logo | Invoice generation, tax filings | Life of workspace + 30 days |
| Transactional | Invoices, bills, ledger entries, payments, GST returns | Core accounting product | 8 years (Income Tax Act §44AA) |
| Party | Customer + vendor names, GSTINs, PANs, contact details | Recorded transactions | 8 years |
| Payment | Razorpay subscription id, customer id — NOT card numbers | Subscription billing | 7 years (RBI §16) |
| Behavioural | Session logs, IP addresses, device UA | Security, anomaly detection | 90 days |
| Support | Tickets, messages, screenshots you upload | Product support | 2 years after resolution |
3. Sub-processors we share data with
Primary infrastructure — application servers, database, authentication and file storage — is operated by Plenitude Systems directly on a dedicated server in Mumbai. We do not use a third-party cloud database vendor for your workspace data. The sub-processors below handle only the specific narrow functions listed; data-processing agreements with each are on file:
| Sub-processor | Purpose | Data shared | Region |
|---|---|---|---|
| Hostinger International Ltd. | Dedicated server hosting + outbound SMTP | All workspace data (encrypted at rest on our managed server) | Mumbai, India |
| Cloudflare, Inc. | Encrypted off-site backup storage (R2) | Nightly encrypted database dumps | Global (encryption-at-rest key held by Plenitude) |
| Razorpay | Subscription billing + payment collection | Name, email, subscription metadata | India |
| Sentry | Error monitoring | Stack traces + minimal request context (email hashed) | United States |
4. Your rights under the DPDP Act
Right to information (§8)
This page + our privacy policy constitute your notice of processing.
Right to access + portability (§11)
Log in and go to Settings → Privacy & data. The Download all my data button generates a machine-readable JSON with every row we hold for your workspace, including bank details, tokens, and audit history.
Right to correction (§12)
Every invoice, bill, party record, and setting is editable by the workspace owner + admins. Locked / issued documents that can’t be edited retain the legal form we’re required to keep — you can add correction / adjustment entries.
Right to erasure (§12)
Log in and go to Settings → Privacy & data. The Request workspace deletion action starts a 30-day cooling-off period, after which everything is permanently deleted from our systems. You can cancel any time in the 30-day window.
Tax-record retention override: if you request deletion during the 8-year Income Tax Act retention window, we cannot retain your records on your behalf, but you accept responsibility for any regulatory record request that may arise afterwards.
Right to grievance redressal (§13)
Data Protection Officer: privacy@finnilai.com. We respond within 7 business days. If unresolved, you may escalate to the Data Protection Board of India.
5. Children
FinNilai is not intended for anyone under 18. We do not knowingly process children’s personal data.
6. Security
Data at rest is encrypted (AES-256, LUKS full-disk encryption on the Mumbai server; nightly off-site backups encrypted with keys held by Plenitude). Data in transit uses TLS 1.2+ with strict transport security. Postgres row-level security policies scope every query to your workspace membership. MFA is mandatory for staff accounts and available for all users. Full details in the security section of our privacy policy.
7. Changes to this page
Material changes are announced via email 30 days in advance. The Last updated date at the top of this page always reflects the current version.