Privacy Policy

1. Introduction

Welcome to YnotFinance (“we,” “our,” or “us”). We operate the website ynotfinance.com (“Website”). This Privacy Policy explains how we collect, use, store, and protect your information when you visit our Website. It applies to all users globally, with specific provisions for users in India, the United States, the United Kingdom, the European Union, Australia, and other jurisdictions.

YnotFinance provides free financial calculators and the StatementIQ bank-statement-to-Excel/CSV conversion service. We are committed to safeguarding your privacy and complying with applicable data protection laws including the Digital Personal Data Protection Act, 2023 (India) and privacy regulations applicable in the United States (including GLBA-equivalent privacy guidelines), the GDPR/UK GDPR (United Kingdom/Europe), and the Privacy Act 1988 (Australia).

2. Information We Collect

2.1 Information You Provide Voluntarily

When you create an account, log in, or use our services, we collect:

• • Credentials & Registration Data: If you sign up manually, we collect your email address, full name, profile type, and a securely salted and cryptographically hashed password.
• • Google Social Sign-In: If you use Google OAuth to log in, we collect your Google email address, full name, and profile picture avatar.
• • Profile Details: Account type (Individual vs. Business Owner) and professional type details saved under Settings.
• • StatementIQ Uploads: Bank statement PDF files you choose to upload for conversion. These are processed programmatically in volatile memory strictly for file conversion and are never shared, sold, or forwarded to third-party advertisers or data brokers.
• • Transaction History & Billing Data: Metadata related to your subscription tier, billing dates, and purchase history. When you make a purchase, our payment gateway partner, PayPal, collects standard billing information including your full name, email address, and billing address/country to process the transaction and ensure tax compliance. YnotFinance never accesses, processes, or stores your credit card number, CVV, or other raw payment credentials.
• • Feedback & Communication: Any support emails, comments, or bug reports submitted voluntarily.

Age Limitation: The Website is designed strictly for users aged 18 and above. We do not knowingly collect or maintain data from individuals under 18 years of age.

2.2 Information Collected Automatically

When you browse or interact with the Website, we automatically collect:

• • Anonymized Security Identifiers: To enforce usage quotas and prevent malicious traffic/attacks, IP addresses are fetched. To protect your privacy, raw IP addresses are immediately hashed locally using one-way SHA-256 encryption before processing or caching, and are never saved in plain text in any logs or database.
• • Browser type, version, and operating system
• • Pages visited, referral source, and session duration
• • Country-level location and timezone (used to detect currency and regional tax systems)

2.3 Local Storage

We utilize browser localStorage rather than tracking cookies to save your settings (such as light/dark mode preference, currency settings, market country toggle, and cookie consent choices). This data remains on your local device and is never sent to our servers.

3. Financial Privacy Notice (GLBA — US Users)

**Calculator Inputs:** All financial details entered into our calculators (tax brackets, salaries, loan amounts) are computed locally inside your browser and **never transmitted to our servers**.

4. How We Use Your Information

We process personal and technical information strictly to:

• • Convert uploaded bank statement PDF files to Excel/CSV via StatementIQ
• • Authenticate, verify, and secure user accounts and dashboard sessions
• • Enforce and calculate monthly conversion limits to prevent system abuse
• • Auto-detect region to set appropriate currency and tax parameters
• • Analyze anonymous metrics to optimize calculator algorithms
• • Comply with regulatory obligations under Indian and US law

We do not sell, rent, or lease your personal information to third parties.

5. Cookies and Analytics

We use analytics tools to monitor performance and optimize website speed. Consent is requested via our cookie banner:

6. Third-Party Data Processors

We leverage carefully selected, industry-compliant third-party infrastructure:

• • Vercel: Web hosting, edge routing, and speed performance
• • Supabase: Encrypted user account database and secure PDF file bucket storage
• • Upstash: Redis rate limiting cache to enforce safety policies
• • PayPal: Sole secure gateway for processing USD subscription payments. PayPal collects and processes your checkout details (Name, Email, and Billing Address) for payment authorization, compliance, and fraud prevention. We never store or see your raw credit card numbers or CVV.
• • Resend: Secure SMTP transactional email delivery
• • Google Analytics: Anonymous usage reports

7. Security & Limitation of Liability

We implement industry-standard administrative, physical, and digital security measures to safeguard account data and document uploads. However, the transmission of information over the internet is never entirely secure.

Limitation of Liability: You acknowledge that you use our services and input credentials at your own discretion. To the maximum extent permitted by law, we carry zero liability for unauthorized access, data leaks, or security compromises resulting from password recycling, phishing, or client-side device security failures.

8. Your Legal Rights

8.1 Indian Citizens (DPDP Act, 2023)

• • Right to Access: Request a summary of your profile data by emailing us
• • Right to Correction: Edit your name and profile type directly under Dashboard → Settings
• • Right to Erasure: Permanently delete your account and all associated documents instantly via Settings → Danger Zone
• • Grievance Redressal: Grievance resolution channel detailed in Section 11

8.2 US Citizens (CCPA / CPRA)

• • Right to Know & Access: Review data categories processed
• • Right to Deletion: Instantly execute deletion in dashboard Settings
• • Right to Opt-Out: We do **not** sell personal information, and therefore no opt-out is necessary
• • Right to Correct: Update settings or contact support

8.3 UK & EEA Citizens (GDPR / UK GDPR Compliance)

If you reside in the United Kingdom or the European Economic Area, we process your personal data under the following lawful bases:

• • **Performance of Contract:** To provide the StatementIQ parsing tool and calculations requested by you.
• • **Consent:** For non-essential performance and analytics cookies.
• • **Legitimate Interests:** To prevent security abuses, run rate limiting, and optimize user experience.

You possess the following rights under GDPR:

• • Right to access, rectify, or erase (Right to be Forgotten) your personal data
• • Right to object to or restrict processing
• • Right to data portability in structured, machine-readable formats
• • Right to lodge a complaint with your local Information Commissioner (ICO) or National Data Protection Authority
• • **International Transfers:** Since our servers reside globally, data transfers are protected under Standard Contractual Clauses (SCCs) to ensure equivalent protection levels.

8.4 Australian Citizens (Privacy Act 1988)

For users in Australia, we handle personal information in strict accordance with the Australian Privacy Principles (APPs):

• • We collect data only for the primary purpose of delivering services (statement parsing and financial calculators)
• • You can request correction or deletion of your profile details by contacting support
• • If you wish to file a complaint regarding an alleged breach of APPs, please contact us. Unresolved complaints can be referred to the Office of the Australian Information Commissioner (OAIC).

9. Data Retention Policy

• • Converted Spreadsheets: Automatically and permanently purged **24 hours** after creation
• • Uploaded PDF files: Deleted within **2 hours** if a conversion is cancelled or fails
• • User Account profiles: Maintained for the duration of the account lifespan. If you trigger account deletion, all database records are permanently erased within **30 days**
• • Payment Logs & Transaction Metadata: Payment metadata and transactional records are retained by our payment processor, PayPal, in accordance with applicable banking laws, tax regulations, and gateway compliance mandates.

10. Changes to This Privacy Policy

We reserve the right to modify this Privacy Policy at any time. Changes will take effect immediately upon publication on this page. Your continued use of the Website and tools following revisions constitutes agreement to the updated terms.

11. Grievance Officer & Contact

If you have any questions, wish to exercise your data rights, or want to raise a grievance under the DPDP Act 2023:

• • General Support: [email protected]
• • Privacy & Data requests: [email protected]
• • Grievances (DPDP / CCPA / GDPR): [email protected]