Privacy Policy
How Fintrack Labs collects, uses, stores and protects your personal and financial data.
Last updated: 27 August 2026 · Shyam Sundar (Sole Proprietor)
Shyam Sundar (Sole Proprietor) ("we", "us", "our") operates Fintrack Labs, a personal wealth-tracking service available at fintracklabs.com (the "Service"). This policy explains what data we collect, why, how long we keep it, who we share it with, and the rights you have over it. It is written to meet the Digital Personal Data Protection Act, 2023 (India) and, where applicable, the EU/UK GDPR.
1. Who is responsible for your data
Shyam Sundar (Sole Proprietor), trading as Fintrack Labs, is the data fiduciary (controller) for the personal data described in this policy.
Business address: 1163/3, E.B. Nagar, Arni, Tiruvannamalai District, Tamil Nadu, 632316, India
Contact for privacy matters: [email protected]
Grievance Officer: Shyam Sundar, Grievance Officer — [email protected]
2. What we collect
- Account details — your email address and a password. Passwords are hashed by our authentication provider (Supabase) and are never visible to us in readable form.
- Financial data you enter — assets, mutual fund holdings, stocks, fixed deposits, bonds, gold, property, insurance policies, goals, income and expenses. All of it is typed in by you.
- Technical data — IP address, device and browser type, and basic usage events needed to operate and secure the Service.
- Support correspondence — anything you send us by email.
- Payment records — the amount, date and transaction reference of any Fintrack Labs Pro purchase, and for an auto-renewing plan the identifier of the subscription itself. We never receive or store your UPI ID, card number or bank details; those go directly to Razorpay, and the mandate authorising renewals is held by Razorpay and your bank rather than by us.
3. What we never do
We think these are as important as what we do collect:
- We never ask for, and cannot access, your bank, broker, demat or mutual fund account credentials. Fintrack Labs has no account-aggregation or screen-scraping capability. Every figure in your dashboard is one you entered yourself.
- We never sell, rent or trade your personal or financial data.
- We never use your financial data for advertising, profiling for third parties, or credit assessment.
- We never share your data with anyone except the service providers listed in section 6, each of which receives only the minimum needed to perform its function.
4. Why we use it, and on what legal basis
- To provide the Service — to operate your account and render your dashboard, net worth and reports. Basis: performance of our contract with you.
- To generate Pro insights — automated observations about the data already in your account. Basis: performance of our contract with you (Pro plan).
- To process payments and manage your plan status. Basis: performance of our contract, and our legal obligation to retain transaction records.
- To secure the Service — detecting abuse, debugging faults, preventing unauthorised access. Basis: our legitimate interest in a safe, working product.
- To send essential service and account notices. Basis: performance of our contract. We do not send marketing email without separate consent.
5. Where your data is stored
Your account and financial data are stored in a managed Postgres database provided by Supabase, protected by row-level security so that one account cannot read another's data. All traffic between your browser and our systems is encrypted in transit using TLS (HTTPS).
Data may be processed outside India by the providers listed below. Where required, transfers rely on the provider's standard contractual clauses or equivalent safeguards.
6. Service providers who process data for us
This is the complete list. If it changes, this page changes.
| Provider | Purpose | Data it receives | Region |
|---|---|---|---|
| Supabase | Authentication and encrypted database hosting | Email address, password hash, all portfolio data you enter | Singapore / EU |
| Vercel | Website and application hosting | IP address, request logs | Global edge |
| Cloudflare | CDN, DNS and denial-of-service protection | IP address, request metadata | Global edge |
| Razorpay | Payment processing for Fintrack Labs Pro, including UPI Autopay mandates | Payment amount, transaction reference, and — for auto-renewing plans — the mandate that authorises future charges. We never receive or store your UPI ID, card or bank details. | India |
| AMFI / mfapi.in | Public mutual fund NAV lookup | Scheme codes only. No personal or account data is sent. | India |
| Yahoo Finance | Equity, ETF and crypto price lookup (via our own server) | Ticker symbols only, relayed by our server. Your identity is never sent. | Global |
| open.er-api.com | Foreign exchange reference rates | Currency codes only. No personal data is sent. | Global |
7. Cookies and local storage
Fintrack Labs sets no advertising cookies, no analytics cookies and no third-party tracking cookies. We use browser local storage for a small number of strictly necessary and functional items:
| Item | Category | Purpose | Retained |
|---|---|---|---|
| Supabase auth session | Strictly necessary | Keeps you signed in between visits. Cleared on sign out. | Until sign out or expiry |
| Theme preference | Functional | Remembers whether you chose light or dark mode. | Persistent |
| Last open tab | Functional | Returns you to the screen you were last using. | Persistent |
| Snapshot marker | Functional | Records that today's net-worth checkpoint has been taken, so it is not duplicated. | Persistent |
Because none of these are used for tracking or advertising, no consent banner is required for them under the DPDP Act or the ePrivacy Directive. You can clear them at any time from your browser settings; clearing the session item simply signs you out.
8. How long we keep it
- Account and financial data — for as long as your account is active.
- Operational audit metadata — changed field names only, retained for 90 days.
- After you delete your account — your account and portfolio are removed from active systems immediately. Isolated encrypted disaster-recovery copies may persist for the hosting provider's documented backup lifecycle and are not used or restored except for disaster recovery.
- Payment and tax records — confirmed transaction records are separated from your account and limited to the amount, date, plan, provider and transaction reference. They are retained for seven tax years from the end of the relevant Indian tax year, or longer only while a documented legal hold or proceeding requires it; unpaid checkout attempts are deleted with the account.
- Support correspondence — 24 months.
9. Your rights
Under the DPDP Act 2023 (and the GDPR where it applies) you may:
- Access — ask what personal data we hold about you, or export all of your portfolio data yourself at any time from Settings → Your data → Export.
- Correct — edit or correct any data from within the app.
- Erase — delete your account and its data from Settings → Account, or by writing to us.
- Withdraw consent — where processing rests on consent, withdraw it at any time.
- Complain — raise a grievance with our Grievance Officer (details in section 1). If you remain unsatisfied, you may escalate to the Data Protection Board of India, or to your local supervisory authority in the EU/UK.
We respond to rights requests within 2 business days and in any case within the statutory period. There is no charge.
10. Security
We apply encryption in transit, row-level database access controls, hashed passwords, and least-privilege access for the small number of people who can reach production systems. Our service worker is configured never to cache any financial or authentication response on your device.
No online service can promise absolute security. Please use a strong, unique password. If we become aware of a personal data breach affecting you, we will notify you and the Data Protection Board of India without undue delay, as required by law.
11. Children
Fintrack Labs is not directed at anyone under 18 and we do not knowingly collect data from children. If you believe a child has created an account, write to us and we will delete it.
12. Changes
We may update this policy. Material changes will be notified in-app or by email before they take effect, and the "last updated" date above will change.
13. Contact
Privacy questions: [email protected]
Grievance Officer: Shyam Sundar — [email protected]
Post: Shyam Sundar (Sole Proprietor), 1163/3, E.B. Nagar, Arni, Tiruvannamalai District, Tamil Nadu, 632316, India