Privacy Policy

1. About XPENSEDIARY

XPENSEDIARY provides an automated personal finance workspace on WhatsApp and the web dashboard. For security or data protection inquiries, you can reach our technical and privacy team directly at privacy@xpensediary.com or support@xpensediary.com.

2. Information We Collect

When you interact with XpenseDiary via WhatsApp or our web application, we collect only the minimum required data to provide personal financial accounting:

• Phone Number: Used as your unique account identifier to associate your WhatsApp conversations and authenticate dashboard login via OTP.
• Profile Name: Provided by WhatsApp to address you politely in conversational messages.
• Expense & Income Messages: Transaction amounts, merchant names, categories, and dates extracted from messages you send.
• Udhari / Khata Third-Party Names: When you record debts (e.g. "Lent 500 to Dave"), the names, nicknames, or honorifics you provide for counter-parties are stored in your personal ledger strictly to track your pending receivables and liabilities. We do not contact these third parties or collect their phone numbers.
• Media Files: Receipt images and voice recordings voluntarily uploaded for OCR extraction and audio transcription.

3. Information We NEVER Collect or Ask For

To safeguard your personal finances, we strictly do NOT collect, request, or store:

• Net-banking login credentials or bank account passwords
• UPI PINs or ATM PINs
• Debit or credit card numbers, CVVs, or expiration dates
• One-Time Passwords (OTPs) sent by your bank or financial institutions
• Direct automated access to your bank accounts
• Personal contacts or conversations outside our designated WhatsApp bot number

4. Forwarded Bank SMS Notifications

XPENSEDIARY does not connect directly to your bank account or scrape your SMS inbox in the background. If you voluntarily forward a transaction SMS from your bank to our bot:

• We parse only the amount, merchant, and transaction date.
• The original forwarded SMS text is discarded immediately after parsing.
• No account numbers or sensitive banking identifiers are saved.

5. AI Sub-Processors & Data Handling

To deliver real-time conversational understanding, receipt scanning, and voice transcription, we route anonymized message payloads through trusted AI infrastructure providers under enterprise data privacy terms:

• Groq Inc. (USA): Processes voice audio notes using Whisper Large v3 models and multimodal vision extraction.
• Google LLC (Gemini AI): Provides multimodal receipt OCR and complex natural language conversational intent fallback.
• Meta WhatsApp Cloud API: Secure message transport between WhatsApp and our application servers.
• Zero Model Training Guarantee: All AI processing occurs under enterprise commercial API terms. Your voice notes, receipt photos, and message texts are never stored or used by Google or Groq to train foundational or public AI models.
• Identity Isolation: Your personal phone number and account credentials are fully stripped before sending conversational text or media to external AI endpoints.

6. DPDP Act (2023) Compliance & Permanent Erasure

In accordance with India's Digital Personal Data Protection Act (DPDP Act, 2023) and international privacy standards, you maintain absolute control and data sovereignty over your records:

• Right to Erasure on WhatsApp: Text delete my data or delete account directly to the WhatsApp bot at any time. Following a two-step confirmation, our system executes an immediate, irreversible wipe of all your expenses, incomes, debts, categories, and account credentials.
• Right to Erasure on Web: You can also trigger immediate account purge from Settings → Delete Account on the web dashboard.
• Right to Access & Portability: Text export on WhatsApp or navigate to Settings → Download My Data to download an immediate CSV copy of your full financial ledger.
• Zero Advertising Tracking: We do not track you across other websites, do not deploy third-party advertising cookies, and will never sell or monetize your transaction data with credit bureaus or data brokers.

7. Security & Technical Architecture

All data in transit is protected using TLS 1.3 / HTTPS encryption. For complete details on our database isolation, employee access restrictions, and incident response policies, please visit our dedicated Security & Data Protection Page →

8. Contact & Grievance Officer

If you have questions regarding this Privacy Policy, wish to exercise your data erasure rights, or require grievance redressal under DPDP regulations, please contact:
XPENSEDIARY Privacy & Data Protection Desk
Email: privacy@xpensediary.com / support@xpensediary.com