Privacy Policy

1. Age Eligibility (18+ Requirement)

XpenseMate is strictly intended for individuals who are 18 years of age or older. In compliance with the Digital Personal Data Protection (DPDP) Act, 2023, we do not knowingly collect, process, or solicit personal data from minors. If you are under 18 years of age, you are not permitted to register an account or use our cloud-synchronized services.

2. Information We Collect

• Account Information: When you register, we collect your name, email address, and an encrypted hash of your password. We never store plain-text passwords.
• Authentication & Verification: We generate temporary One-Time Passwords (OTPs) sent to your registered email for account registration, verification, and password resets.
• Financial Entries: Manually logged transactions, custom accounts, transfers, recurring rules, loans, and savings goals that you enter into the application.
• Essential Session Tokens: We strictly use NextAuth security session cookies to authenticate your requests. We do not use any marketing, profiling, or third-party advertising tracking cookies.

3. Third-Party Infrastructure Providers

To deliver secure cloud capabilities and transactional messaging, we partner with trusted cloud infrastructure providers who act strictly as data processors:

• MongoDB Atlas: Provides our cloud database infrastructure, used strictly for encrypted storage, automated backups, and multi-device synchronization. Data is protected with TLS encryption in transit and AES-256 encryption at rest.
• Brevo (Sendinblue): Acts as our transactional email delivery service, used strictly for sending authentication OTPs, password reset links, and critical security notifications.

These providers process your data strictly under our technical directives. We do not sell, rent, or trade your personal or financial information to data brokers, advertising networks, or any other commercial third parties.

4. Data Storage Architecture

5. Data Retention & Erasure

We believe in responsible data minimization and retain your personal data only as long as necessary to provide the service:

• Active Account Lifecycle: Your personal data is retained for as long as your account remains active and in use to provide you with the application services.
• User-Initiated Deletion: You can delete your account at any time from in-app Settings. Account deletion immediately and permanently wipes your profile, transaction logs, accounts, and linked configurations from our cloud servers.
• Local Data Removal: You can clear locally cached data on your device at any time by clearing your browser cache or site storage.

6. Your Rights Under the DPDP Act, 2023

Under India's Digital Personal Data Protection (DPDP) Act, 2023, you have the right to access, correct, and erase your personal data processed by XpenseMate.

7. Grievance Redressal Officer

In accordance with the Information Technology Act, 2000 and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, if you have any questions, concerns, or grievances regarding the processing of your personal data, you may contact our designated Grievance Officer: