Privacy Policy

1. Who this applies to

This Privacy Policy explains how LabhPay (“we”, “us”) collects, uses, and protects your personal data when you use labhpay.com and our services. It is aligned with India’s Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 and its rules. By using LabhPay you agree to this policy.

2. What we collect

• Account data: your email and/or mobile number, Google account ID (if you sign in with Google), and display name.
• Financial documents you upload (e.g. credit card / bank statements, Form 16): processed transiently to generate insights. We mask your full card number and do not store the documents.
• Derived results (transactions, insights) held only for your active session in encrypted, short-lived storage.
• Consent records: the version you accepted, date/time, IP address, and browser user-agent — kept for compliance.
• Usage analytics: privacy-friendly, aggregate page/visit data. We do not build advertising profiles.

3. How we use your data

• To provide the service: read your documents and show you insights, tax estimates and calculations.
• To authenticate you and keep your account secure.
• To comply with legal obligations and maintain consent/audit records.
• To understand product usage in aggregate and improve LabhPay.

Our legal basis is your consent, which you may withdraw at any time (see Your rights).

4. How long we keep it

• Uploaded documents and derived results: processed in memory and auto-deleted shortly after your session (typically within 30 minutes), and on logout.
• Account data: kept until you ask us to delete your account.
• Consent and anonymised audit records: retained as required for compliance.

5. Service providers and international transfers

We use trusted processors to run LabhPay, and some may store or process data outside India:

• Hosting & infrastructure: Vercel and Hugging Face (application hosting), Supabase (account database), Upstash (temporary encrypted session store).
• AI providers (e.g. Google Gemini): we send only the figures/text needed to generate insights or read a document — never your full card number, and we do not request your name/PAN back.
• WhatsApp OTP delivery (NotifyNow) for login codes.

Where data is transferred outside India, we rely on your consent and take reasonable steps to protect it. This is permitted under the DPDP Act except to countries the Government of India may restrict.

6. How we protect your data

• Encryption in transit (HTTPS) and encryption of temporary document storage.
• Your full card number (PAN) is masked during processing and never stored.
• Short-lived, session-scoped storage with automatic deletion.
• Access controls and anonymised audit logging.

7. Your rights

Under the DPDP Act you may: access the personal data we hold about you; correct or update it; request deletion of your account and data; withdraw consent; and nominate a representative. To exercise any of these, email our Grievance Officer (below). We will respond within the timelines required by law.

8. Cookies

We use essential cookies to keep you signed in and protect against cross-site request forgery, and privacy-friendly analytics cookies to measure usage. We do not use advertising or cross-site tracking cookies.

9. Children

LabhPay is intended for adults aged 18 and over. We do not knowingly collect data from children. If you believe a minor has used the service, contact us and we will delete the data.

10. Grievance Officer

For any privacy questions, requests, or complaints, contact our Grievance Officer at labhpay@gmail.com. We aim to acknowledge within 48 hours and resolve within the timelines prescribed under Indian law.

11. Changes

We may update this policy. Material changes will be reflected by an updated date and, where appropriate, a fresh consent request. Last updated: 29 June 2026.