Welcome to ExpenseFlow AI(“ExpenseFlow”, “we”, “our”, or “us”), developed by Aditya Raj. ExpenseFlow AI is an autonomous personal finance management platform designed to help individuals and families track expenses, parse bank statements, and optimize financial health with total privacy.
We operate under a simple, foundational principle: Your financial data belongs exclusively to you. We do not sell your personal information, monetize your transactions, or build advertising profiles on your spending habits. This Privacy Policy details the exact lifecycle of information collected through our web platform, mobile applications (including Android APK), and related services.
02.Information We Collect
We only collect data that is strictly necessary to deliver intelligent financial management services:
Account Credentials: Email address, hashed and salted passwords (via bcrypt), and secure verification OTP digests. If you choose to log in via Google OAuth, we receive your name, verified email, and profile avatar URL provided by Google.
Financial Statement Records: Bank statements, credit card statements, and UPI transaction sheets that you voluntarily upload in PDF, CSV, or XLSX format. This includes parsed fields such as transaction dates, merchant descriptions, credit/debit amounts, and account category assignments.
Technical Diagnostics: Anonymized client IP addresses (hashed for brute-force rate limiting), browser agent, and operating system attributes required to render responsive charts and verify session authenticity.
03.How We Use Financial Data
Your financial records are processed strictly within the confines of your authenticated account to:
Extract tabular financial records from uploaded bank statement files via local deterministic regex and OCR pipelines.
Compute personalized Financial Health Scores, savings ratios, debt-to-income benchmarks, and monthly trend curves.
Enable natural-language financial Q&A through your dedicated private AI Copilot session.
Maintain your authenticated session, enforce rate limits, and protect against credential attacks.
04.AI Processing & Zero-Training Guarantee
ExpenseFlow AI leverages state-of-the-art language models and deterministic parsing algorithms to categorize ambiguous merchant strings and answer budgeting queries.
No Model Training: Your financial data is NEVER retained by AI infrastructure providers to train, retrain, or improve public foundation models.
Stateless Inference: All AI requests are executed statelessly under zero-data-retention agreements where prompts are discarded immediately after generating the response.
Anonymized Context: Account numbers and raw bank credentials are automatically masked prior to semantic parsing.
05.Security & Encryption Standards
We implement enterprise defense-in-depth protocols to safeguard your records:
In-Transit Encryption: All data transmissions between your browser, mobile app, and servers use TLS 1.3 / HTTPS with Strict-Transport-Security (HSTS).
At-Rest Encryption: Database stores use AES-256 bit encryption at rest.
Cryptographic Password Hashing: Passwords are never stored in plaintext and are hashed using bcrypt with salt rounds.
CSRF & Rate Limiting: All authentication and financial endpoints feature cryptographically signed CSRF tokens and sliding-window IP rate limiting to prevent brute-force attacks.
06.Data Retention & 1-Click Complete Erasure
We retain personal and financial records only for as long as your account remains active. You maintain total sovereign ownership of your data at all times:
1-Click Data Export: You can download your full transaction and budget history in standardized CSV or Excel format at any time from the Transactions tab.
1-Click Account Erasure: You can permanently delete your entire profile via Settings → Delete Account. This immediately purges all transaction rows, uploaded statements, budget history, feedback, and user records from our database without soft-deletion locks.
07.Infrastructure & Third-Party Service Providers
ExpenseFlow AI partners only with verified infrastructure providers who adhere to strict data privacy covenants:
Vercel: Web hosting, global edge content distribution, and serverless compute.
PostgreSQL Database Providers: Managed, encrypted database infrastructure for persistent record storage.
Google OAuth: Optional single-sign-on verification.
Web3Forms: Encrypted relay for support inquiries sent through the contact form.
We do NOT embed third-party advertising trackers, sell user profiles to data brokers, or integrate social tracking pixels on dashboard screens.
08.Your Rights (GDPR, CCPA & DPDP Act India)
Depending on your jurisdiction, including the Digital Personal Data Protection Act (India), General Data Protection Regulation (EU GDPR), and California Consumer Privacy Act (CCPA), you are entitled to:
The right to know what personal data is collected and how it is processed.
The right to access and receive a portable copy of your records.
The right to correct or update inaccurate financial classifications.
The right to withdraw consent and request immediate, irreversible deletion of your data.
09.Policy Updates & Contact Information
We may periodically update this Privacy Policy to reflect platform features, security upgrades, or legislative revisions. If material changes are made, we will notify registered users via their account dashboard or verified email address.
Have a question or privacy inquiry?
Our team is available to assist with data access or compliance inquiries.