Privacy Policy

# Privacy Policy

Effective date: 2026-07-26

This Privacy Policy describes how [Company Legal Name] ("Company", "we", "us", or "our") collects, uses, stores, protects, and deletes information when customers and authorized users use the DFM Finance Control Centre application (the "Service").

This document is a commercial readiness draft and must be reviewed by qualified legal counsel before public launch or customer signature.

## 1. Who This Policy Applies To

This Policy applies to:

- Customer administrators and authorized users who access the Service.
- Customer-provided business, finance, inventory, audit, and MIS data uploaded to or processed by the Service.
- Support and helpdesk information submitted through the Service.

The Service is intended for business use. It is not intended for children or consumer-facing public use.

## 2. Information We Collect

We may collect and process the following categories of information:

- Account information: username, role, permissions, password hash, client or tenant assignment, and login status.
- Uploaded business data: Excel, CSV, ZIP, and related finance source files provided by users.
- Generated outputs: working papers, exports, dashboards, MIS snapshots, logs, and calculation summaries.
- Support information: helpdesk issue title, description, priority, module area, status, notes, and resolution.
- Security and audit logs: timestamp, username, client key, action type, IP address, and relevant non-content metadata.
- Technical information: browser request metadata, session cookies, and operational diagnostics required to run the Service.

Users should not upload live ERP passwords, bank passwords, GST portal credentials, payment card data, government identity numbers, health data, or unrelated personal data unless a written agreement expressly permits it.

ERP connector credentials: to download reports from the customer's ERP, an administrator may store an ERP API key and secret for their company. These are encrypted at rest with a key held in AWS KMS, are never displayed again after entry (only the last four characters of the key are shown), are used only by the ERP download worker, and can be removed by an administrator at any time. Server deployments do not store ERP passwords or browser session cookies. On a local desktop installation, a saved ERP browser login may be kept on that machine for the user's own downloads.

## 3. How We Use Information

We use information to:

- Authenticate users and enforce admin, user, developer, and client access controls.
- Process customer-provided source data into finance workings, audit outputs, dashboards, and exports.
- Maintain MIS history and operational support records.
- Diagnose issues, respond to helpdesk requests, and improve the Service.
- Protect the Service against unauthorized access, misuse, data leakage, and operational failure.
- Comply with contractual, legal, security, and audit obligations.

We do not sell customer data.

## 4. Uploaded Finance Data

Customer source files remain customer-provided data. The Service uses uploaded files only for the purpose of operating requested finance, audit, MIS, and support workflows.

Generated outputs are based on source data, configured mappings, and application calculation logic. Users must verify outputs before relying on results for statutory, audit, reporting, tax, management, or commercial decisions.

## 5. AI, RAG, and External Providers

The current intended architecture is privacy-first:

- Local RAG and local LLM processing should be preferred where feasible.
- Hosted AI APIs must not be enabled silently.
- If a hosted AI or embedding provider is used, the Company must document what leaves the server, the provider, the retention policy, and whether customer approval is required.
- Uploaded files are not sent to hosted AI providers by default.
- If the optional limited OpenAI question box is enabled by the operator (`OPENAI_API_ENABLED=1`), the text a user types into it is sent to OpenAI after personal identifiers (for example PAN, GSTIN, email addresses, phone and bank numbers) are redacted. Uploaded files and calculation results are not sent unless `OPENAI_SEND_APP_CONTEXT=1` is also set, in which case only batch module status and row counts are included.

## 6. Sharing and Disclosure

We may share information only with:

- The customer organization and its authorized users, based on configured access rights.
- Service providers and infrastructure providers used to operate, secure, host, back up, or support the Service.
- Developers or support personnel who need access to resolve issues, subject to access controls and confidentiality obligations.
- Legal, regulatory, or audit parties where required by law, contract, court order, or lawful process.

We do not sell or rent customer data.

## 7. Data Security

We use administrative, technical, and organizational controls intended to protect information, including:

- Role-based access controls.
- Admin-controlled permissions.
- Tenant/client access restrictions where configured.
- CSRF protection and security headers.
- Audit logging for sensitive actions.
- ZIP upload hardening and file-type validation controls.
- Password hashing and session protections.

For production deployment, customers and operators must use HTTPS, secure cookies, production WSGI hosting, strong secrets, restricted administrator access, and monitored backups.

## 8. Data Retention and Deletion

Data retention depends on the deployment model and customer configuration. By default, local deployments may retain uploaded files, generated exports, logs, MIS snapshots, and helpdesk records until deleted by an authorized administrator or retention process.

Customers may request deletion of customer data according to the applicable agreement. Deletion should include primary records, uploaded files, generated exports, caches, and indexed/vector content where applicable.

## 9. Cookies and Sessions

The Service uses necessary session cookies for login, security, CSRF protection, and application operation. The Service is not designed to use advertising cookies.

## 10. User and Customer Rights

Depending on applicable law and the customer agreement, users or customers may request access, correction, deletion, export, or restriction of personal data. Requests should be sent to:

[privacy contact email]

The Company may need to verify the requester and coordinate with the customer organization before acting on a request.

## 11. India-Specific Privacy Terms

Where Indian law applies, this Policy is intended to support compliance with applicable Indian privacy and information security requirements, including the Digital Personal Data Protection Act, 2023 and rules/notices made under it, and the Information Technology Act, 2000 including Section 43A and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 to the extent applicable.

For Indian deployments:

- The customer organization is generally expected to act as the Data Fiduciary for personal data included in uploaded business records, unless a signed agreement states otherwise.
- The Company is generally expected to act as a Data Processor or service provider for customer data processed through the Service.
- Personal data should be processed only for lawful purposes connected with the Service, such as finance automation, audit support, MIS reporting, access control, support, security, and compliance.
- Users should upload only data that the customer is legally permitted to process and share with the Service.
- The Service is not designed for children, behavioural monitoring, targeted advertising, or consumer profiling.
- If a personal data breach occurs, the customer and Company should coordinate on notices to the Data Protection Board of India and affected Data Principals where required by applicable law.
- Requests by Data Principals for access, correction, erasure, grievance redressal, withdrawal of consent, nomination, or other rights should be routed through the customer organization unless the Company is legally required to respond directly.

India grievance contact:

[Grievance Officer Name]

[Grievance Officer Email]

[Grievance response timeline, e.g. within 30 days or as required by applicable law]

## 12. International Use

If the Service is used across jurisdictions, the customer and Company must ensure that transfer, hosting, processing, retention, and deletion terms meet applicable privacy and data protection laws.

## 13. Changes

We may update this Policy from time to time. Material changes should be communicated through the Service, contract notice, or another reasonable method.

## 14. Contact

[Company Legal Name]

[Company Address]

Privacy contact: [privacy contact email]