Privacy Policy
The short version
- We never sell your data, show ads or offer loans or credit.
- On Android, the full text of your SMS never leaves your phone. Only transaction details do. On iPhone, Ginaro never reads SMS; you choose which statements to upload.
- We ask for consent for each purpose separately, and you can withdraw it as easily as you gave it.
- Delete your account from the app or web dashboard, send DELETE on WhatsApp, or email [email protected] to erase your account and data.
- Service data is stored in India and encrypted at rest.
1. Who we are
Ginaro ("Ginaro", "we", "us") is the Data Fiduciary for the personal data described in this policy, as defined in India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and the DPDP Rules, 2025.
Contact: [email protected]
2. What we collect
| When | What we collect | Why |
|---|---|---|
| You visit ginaro.in | Aggregate, cookieless visit statistics (pages viewed, referrer, country, device type). Your IP address is used to deliver the site securely and to work out your approximate location (country and state only), which decides whether the site is available to you (India only) and its default language. We don't store it. | To run the website and understand which channels bring visitors. No cookies, and no cross-site tracking. |
| You join the waitlist | Name, email address, mobile number, phone type (Android or iPhone), primary bank (optional), who it's for (you, your parents, or both), your consent choices with a timestamp, and how you found us (referral or campaign tag). | To manage the waitlist, send you a one-time confirmation email, give you priority access when Ginaro launches, and email you about your waitlist spot and the launch. |
| You use the service (app, web or WhatsApp) | Phone or WhatsApp number, language, alert preferences (cadence, thresholds, quiet hours), plan. Transaction details: amount, debit or credit, merchant name or UPI ID, date and time, bank or UPI app, masked account ending as shown in the alert (for example XX1234), and reference number. Your category corrections and questions. Message delivery records (delivered, read, button tapped). | To build your weekly check-in and alerts, count each payment once, categorize spending, answer your questions about your own data, and keep messages within limits. |
| You send a bank statement | The PDF or CSV file you choose to send on WhatsApp, and the transactions we extract from it. | To add those transactions to your check-ins (the iPhone path, or when the app is not used). |
| Family mode | The link between the parent's and child's accounts, the parent's consent and its timestamp, the scope of what is shared, and when it is revoked. | To send a parent's summary and unusual-debit alerts to the family member they chose. |
| You contact us | Your email or WhatsApp message and our reply. | To help you and keep a record of grievances. |
What we never collect
- The full text of your SMS messages, personal messages or OTPs. The Android app reads bank and UPI transaction alerts on your device and sends only the fields listed above.
- Your contacts, photos, location, call logs or other apps' data.
- Bank passwords, UPI PINs, CVVs or full card or account numbers. We will never ask for them. If anyone asks for them in Ginaro's name, it is a scam.
3. Consent and how we use your data
We process your personal data on the basis of your consent, which we ask for separately for each purpose:
- Waitlist: storing your sign-up details and emailing you about your spot and the launch. You can unsubscribe anytime.
- WhatsApp messages: sending confirmations, check-ins and alerts. This is a separate, explicit opt-in.
- Transaction processing: reading transaction alerts on your phone, or statements you send, to build your check-ins.
- Family sharing: given by the parent whose data is shared, never by the person receiving it.
We may also process data without separate consent where the DPDP Act allows it, for example to comply with a law or a court order, or to respond to a security incident.
We use aggregated or de-identified data, which can't identify you, to improve parsing and categorization accuracy.
What we will never do
- Sell, rent or trade your personal data.
- Use your data for advertising, or let advertisers target you.
- Share your data with lenders or offer you loans, credit cards or credit referrals.
- Send you marketing on WhatsApp without your opt-in.
4. Who we share data with
We share data only with service providers (Data Processors) that help us run Ginaro, under contracts that limit them to our instructions:
- Cloudflare: website hosting, security and cookieless visit statistics (no personal profiles).
- Meta (WhatsApp): delivers the WhatsApp messages you opt in to. WhatsApp's own terms and privacy policy also apply.
- Google: stores waitlist sign-ups. This data may be stored outside India.
- GoDaddy: our email service, including the emails we send you.
- Cloud hosting provider in India: stores and processes your account and transaction data.
We may disclose data when Indian law requires it. We will tell you about such a request unless the law prohibits it.
5. Where data is stored and how it is protected
Your account, transactions and statements are stored on servers in India and encrypted at rest and in transit. Waitlist sign-ups are stored with Google (see section 4). Only people who need access to run the service have it.
If a personal data breach occurs, we will inform affected users and the Data Protection Board of India as required by the DPDP Rules, explaining what happened, the likely impact, and what we are doing about it.
6. How long we keep data
- Waitlist details: until you join the service, ask us to delete them, or 12 months after the waitlist closes, whichever comes first.
- Account and transaction data: while your account is active. After you send DELETE, we erase it within 30 days, except what the law requires us to keep.
- Statement files: we delete the original file once its transactions have been extracted.
- Inactive accounts: we will remind you before deleting data from an account that has been inactive for a long period.
7. Your rights
Under the DPDP Act you can:
- Access a summary of the personal data we hold about you and how we use it.
- Correct, complete or update your data. Replying with a category on WhatsApp corrects a transaction instantly.
- Erase your data: delete your account in the app or web dashboard, send DELETE on WhatsApp, or email us. You can export your data first.
- Withdraw consent at any time, as easily as you gave it. Send STOP or PAUSE to stop messages. A parent can revoke family sharing instantly.
- Get grievances resolved by our Grievance Officer (below).
- Nominate someone to exercise these rights for you in case of death or incapacity.
Withdrawing consent stops future processing. It does not affect processing done before you withdrew.
8. Children
Ginaro is for people aged 18 and over. We do not knowingly process the personal data of children (anyone under 18), and Family mode can't be used to share or monitor a child's spending. If we learn that a child has signed up, we close the account and delete the data. Parents or guardians can write to [email protected]. See also the Terms of Use.
9. Grievance Officer
If you have a question or complaint about your data, contact our Grievance Officer:
Email: [email protected] (subject: "Grievance")
We acknowledge every grievance within 48 hours and resolve it within the time set by the DPDP Rules. If you are not satisfied with our response, you can complain to the Data Protection Board of India.
10. Changes to this policy
If we make a material change, we will update this page and notify you on WhatsApp or by email before the change takes effect. If a change needs new consent, we will ask for it.