Privacy Policy

In short: we collect what you send us, plus the email receipts you connect — each with its own consent. We keep the structure and delete the raw text within 30 days. We never sell your data, never train models on it, and never show ads. You can export or delete everything at any time.

1. What we collect

Per source, with your consent for each:

messages you send to our number — text, voice notes, images;
email receipts, if you connect an inbox;
your profile details — name, phone number, household membership;
technical logs needed to run and secure the service.

2. Why we collect it — per-purpose consent

Each purpose — expense tracking, reminders, digests, plans — is consented to separately. A new feature that reuses your data triggers a new consent request. We do not repurpose data silently.

3. Retention

Raw message text and media are deleted after parsing, within 30 days. The structure stays: the structured record — amount, category, date, visibility level — is retained until you delete it, or until you delete your account, at which point both go. Deleted data is removed from backups on their rotation cycle.

4. Who processes it

We never sell data and never show ads. These are every third party that touches your data:

Processor	What it handles	Where data sits
Meta — WhatsApp Cloud API	Message delivery to and from your number	Meta infrastructure
LLM providers	Parsing that rules can’t handle, on pseudonymised input — contracted no-training posture	US / EU regions
Razorpay	Subscription payments and UPI Autopay mandates	India
Cloud hosting	Your ledger, household records and backups	India

Anything sent to a model provider is pseudonymised first: names, phone numbers and account tails are replaced with tokens before it leaves our servers. We do not claim end-to-end encryption — WhatsApp’s encryption terminates at our webhook, after which we can read a message in order to parse it. Data is encrypted in transit and at rest on our own infrastructure.

5. Your rights

Under India’s Digital Personal Data Protection Act you may:

access and export everything we hold about you;
correct anything inaccurate;
erase your data and your account;
withdraw consent for any single purpose;
nominate someone to exercise these rights on your behalf;
raise a grievance and receive a response.

A member who leaves a household takes their personal entries with them. Complaints are acknowledged within 72 hours and resolved within DPDP timelines.

6. Breach notification

In the event of a personal data breach we will notify the Data Protection Board of India and every affected user as required by the DPDP Act — what happened, what data was involved, and what we are doing about it.

7. Grievance officer

Under the DPDP Act you can raise a grievance directly with a named person here.

Registered entity name	[REQUIRED — fill in]
Registered postal address	[REQUIRED — fill in]
Grievance Officer	[REQUIRED — a named individual, not a role]
Email	grievance@jirvo.ai
WhatsApp	+91 96286 04444
Response commitment	Within 30 days