Privacy Policy

Plynt ("we", "us", "our") is a personal finance planning platform built for India. We help you understand your financial health, set goals, and plan smarter — without selling financial products or showing ads.

This Privacy Policy explains what personal data we collect when you use our website, web app, and mobile app (together, the "Service"), how we use it, and the choices you have.

We do not sell your data. We do not share your financial information with advertisers, brokers, or insurers for marketing purposes.

We collect only what we need to run the Service. This includes:

Account information

• Name, email address, and password (stored in hashed form)
• Login and session information

Financial profile you enter

• Income, expenses, savings, investments, loans, insurance, tax inputs, and goals
• Family or household member details you choose to add (name, relationship, income, etc.)
• Date of birth or age, dependents, risk tolerance, and retirement preferences

Usage information

• Pages and features you use, actions you take in the app, and error logs
• Device type, browser, operating system, and approximate location (city/country from IP)

AI Coach messages

• Questions you ask and responses you receive in the AI Coach feature
• A summary of your computed financial plan sent as context so the Coach can answer accurately

Legacy data (optional — only if you enable Legacy)

• Bank account details (bank name, account type, last 4 digits, nominee)
• Investment, insurance, loan, vehicle, and property details
• Heir and succession plan information
• Will status and lawyer contact details
• Trusted contact names, phone numbers, and email addresses
• Personal emergency instructions (free text)
• Uploaded documents (insurance PDFs, property papers, identity documents)

Legacy data is encrypted at rest using AES-256-GCM. This means even our database administrators cannot read your Legacy data in plain text. Uploaded documents are stored in encrypted cloud storage (AWS S3) and accessible only via time-limited, authenticated download links.

What we do not collect by default: bank login credentials, Aadhaar numbers, PAN cards, credit card numbers, or direct access to your bank accounts. You enter financial figures manually. If you choose to store identity document numbers in Legacy, they are encrypted at rest.

We use your data to:

• Create and maintain your account
• Calculate your Safety Score, net worth, retirement readiness, tax estimates, and other plan outputs
• Store and display your goals, family plan, expenses, and reports
• Power the AI Coach with relevant context from your plan
• Send essential service messages (e.g. password reset, security alerts)
• Improve reliability, fix bugs, and develop new features
• Comply with applicable laws and respond to lawful requests

We do not use your data to recommend specific mutual funds, insurance policies, or loans for commission. Plynt is a planning tool, not a product marketplace.

Under the Digital Personal Data Protection Act, 2023 ("DPDP Act"), we process your personal data based on:

• Your consent — when you create an account and enter financial information
• Performance of the Service — to deliver the features you signed up for
• Legitimate uses — security, fraud prevention, and service improvement, where permitted by law

You may withdraw consent for optional processing (such as marketing emails) at any time. Withdrawal does not affect processing already done lawfully, and some data may be retained as required by law.

We do not sell or rent your personal data. We share data only in these limited situations:

• Infrastructure providers — cloud hosting, databases, and email delivery needed to run the Service. These providers process data on our instructions and under contractual safeguards.
• AI processing — when you use AI Coach, your message and relevant plan context are sent to our AI provider (Anthropic) to generate a response. See Section 6 below.
• Family sharing — if you invite a co-owner or share household data, information you choose to link is visible to authorised members of that household plan.
• Legacy sharing — if you share your Legacy with a trusted contact, they receive an email with a masked preview (no full account details). Full data is visible only after the recipient creates a Plynt account and authenticates. Share links expire after 30 days and can be revoked at any time.
• Legal requirements — if required by court order, law enforcement, or to protect rights, safety, or security.
• Business transfer — if Plynt is merged or acquired, data may transfer to the successor entity with the same privacy commitments.

The AI Coach uses a third-party language model to answer your financial planning questions. When you send a message, we transmit:

• Your question
• Relevant outputs from your plan (e.g. Safety Score, income, goals, gaps) — not your password or full raw database

AI responses are generated automatically and may contain errors. They are for informational purposes only and are not investment, tax, or legal advice. Do not share sensitive identifiers (Aadhaar, PAN, full account numbers) in chat.

We do not use your AI conversations to train public models without your consent. Conversation data may be retained briefly for quality and safety review.

Legacy is an optional feature that lets you organise important financial information and share it securely with trusted family members. Legacy is disabled by default and must be explicitly enabled by you.

What Legacy stores

• Financial account details (bank names, last 4 digits, nominees — not full account numbers unless you enter them)
• Investment, insurance, loan, vehicle, and property summaries
• Heir designations and succession plans
• Will status and lawyer contact information
• Trusted contact details (name, phone, email, relationship)
• Personal emergency instructions
• Uploaded documents (PDFs, images)

Encryption

All Legacy data stored in our database is encrypted using AES-256-GCM — the same encryption standard used by banks and financial institutions. The data is encrypted before storage and decrypted only when you (the authenticated account holder) request it. Even in the event of a database breach, Legacy data cannot be read without the encryption key, which is stored separately from the database.

Document storage

Documents you upload are stored in AWS S3 with server-side encryption (SSE-S3). Files are never publicly accessible. Download links are generated on-demand, authenticated, and expire after 1 hour. Files are stored in the AWS Asia Pacific (Mumbai) region.

Sharing with trusted contacts

• You control sharing — nothing is shared unless you explicitly click "Share" on a trusted contact
• The recipient receives an email with a masked preview (e.g. "HDFC ••••", "Insurance ₹10••••") — no full details
• Full Legacy data is visible only after the recipient creates a Plynt account and logs in
• Share links expire after 30 days and can be revoked by you at any time
• We do not grant Plynt employees, partners, or any third party access to your Legacy data

Nominee vs Heir distinction

Plynt allows you to record both nominees and legal heirs. We display an educational note explaining that under Indian law, a nominee is a custodian, not a legal owner. This information is provided for awareness only and does not constitute legal advice. Consult a qualified lawyer for succession planning.

Deletion

If you disable Legacy or delete your account, all Legacy data — including encrypted records, uploaded documents, trusted contacts, and share tokens — is permanently deleted. This deletion is irreversible.

• Active accounts — we retain your data while your account is active and you use the Service.
• Deleted accounts — when you delete your account, we remove or anonymise personal data within a reasonable period, except where retention is required by law (e.g. tax or fraud records).
• Backups — encrypted backups may persist for a limited time before automatic deletion.
• Logs — server and security logs are kept for a limited period (typically up to 90 days).

We protect your data using industry-standard measures, including:

• Encryption in transit (TLS/HTTPS) for all connections
• AES-256-GCM encryption at rest for Legacy data (bank accounts, insurance, heirs, documents)
• Server-side encryption (SSE-S3) for uploaded documents on AWS
• Hashed passwords using bcrypt — we never store plain-text passwords
• JWT-based authentication with 24-hour token expiry
• Pre-signed, time-limited URLs for document downloads (1-hour expiry)
• Access controls limiting employee access to production data
• Regular monitoring for unauthorised access

No system is 100% secure. You are responsible for keeping your password confidential and logging out on shared devices.

Depending on applicable law, you have the right to:

• Access — request a copy of personal data we hold about you
• Correction — update inaccurate information in Settings or by contacting us
• Erasure — delete your account and associated data
• Data portability — receive your data in a readable format where technically feasible
• Withdraw consent — for processing based on consent
• Grievance redressal — raise a complaint with our Grievance Officer (see Section 11)

To exercise these rights, email hello@plynt.in. We will respond within the timelines required by law (typically within 30 days under the DPDP framework).

Plynt is designed to comply with India's Digital Personal Data Protection Act, 2023. In practice, this means:

• We collect data only for clear, stated purposes
• We ask for your consent where required and honour withdrawal
• We implement reasonable security safeguards
• We appoint a Grievance Officer to handle complaints
• We notify you of significant data breaches as required by law
• We do not process children's data without verifiable parental consent (see Section 11)

If you are not satisfied with our response, you may escalate to the Data Protection Board of India once it is fully operational under the DPDP Act.

Plynt is intended for users aged 18 and above. We do not knowingly collect personal data from children under 18 without verifiable parental consent.

You may enter information about dependents (e.g. a child's education goal) as part of your family plan. This is treated as part of your account data, not as a separate child account.

If you believe a child has created an account without consent, contact us at hello@plynt.in and we will delete it.

We use cookies and local storage to:

• Keep you logged in
• Remember your preferences
• Understand how the Service is used (aggregated analytics via Google Analytics)

You can block cookies in your browser settings, but some features (such as staying logged in) may not work properly. We do not use cookies for third-party advertising. Google Analytics may set cookies to measure site traffic; see Google's Privacy Policy.

Your data is primarily stored and processed in India. Uploaded Legacy documents are stored in AWS S3 in the Asia Pacific (Mumbai) ap-south-1 region. Some service providers (such as our AI provider for the Coach feature) may process data on servers located outside India. Where this occurs, we ensure appropriate contractual safeguards are in place as permitted under applicable law.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or through a notice in the app. The "Last updated" date at the top will always reflect the latest version.

Continued use of the Service after changes take effect means you accept the updated policy.

For privacy questions, data requests, grievances, or general support, email us at hello@plynt.in. We respond to DPDP-related requests within the timelines required by law.

Data Fiduciary: Plynt
Grievance Officer: hello@plynt.in
Jurisdiction: India