Plain-Language Data Handling Policy

Privacy Policy

Last Updated: August 2026 • Compliant with India DPDP Act Principles

Our 4 Non-Negotiable Privacy Commitments

1. Zero File Retention: Raw bank statement CSV files are processed in-memory and discarded immediately after transaction parsing. We never store original statement files.
2. Zero Third-Party Selling or Sharing: We never sell, rent, broker, or share your financial transaction data with advertisers, brokers, lenders, or third parties.
3. No Generative AI Training: Your transactions are never fed into external Large Language Models (LLMs) or used to train AI models.
4. Complete Data Deletion & Portability: You can download a full export of your parsed data or permanently wipe all your records with a single click at any time.

1. What Data We Collect

When you use Suranyx, we collect only the minimal data required to calculate your cash flow forecasts and runway projections:

Account Information: Your email address and unique authentication identifier provided via Supabase Auth.
Parsed Transaction Metadata: Transaction date, description / narration text, transaction amount, transaction type (Debit/Credit), categorized spending bucket (Fixed Expense, Variable Expense, Income, Transfer), and running account balance.
User Configuration: Your customized runway alert threshold (e.g. ₹50,000).

2. In-Memory Processing (Zero Original File Storage)

When you upload an HDFC, ICICI, SBI, or Kotak CSV export:

1. The file stream is received by our backend server in memory.
2. Our deterministic TypeScript rules engine parses the tabular transaction lines.
3. The raw CSV file is immediately garbage collected and destroyed from memory.
4. Only structured transaction entities (amount, date, category) are stored in your isolated database schema.

3. Multi-Layer Database Isolation & Security

Your financial data is stored in a managed PostgreSQL instance on Supabase with three independent isolation guardrails:

PostgreSQL Row-Level Security (RLS): Every database row is tagged with your unique auth.uid() and protected by database-kernel tenant isolation.
App-Layer User Scoping: All API routes strictly validate the authenticated Supabase session before querying the database.
Assistant Scope-Lock: The Suranyx Assistant runs on deterministic local rules with strict read-only execution locks and user-scoping verification on every query.

4. Your Data Rights (Export & Permanent Deletion)

In accordance with the Digital Personal Data Protection (DPDP) Act of India, you retain complete ownership over your data:

Right to Data Portability

Download a complete JSON and CSV export of all your categorized transactions anytime from Settings.

Right to Erasure (Hard Delete)

Trigger permanent hard-deletion of all statements, transactions, and account records from Supabase with 1-click.

5. Designated Grievance Officer (India DPDP Act 2023 & IT Rules)

In accordance with the Digital Personal Data Protection (DPDP) Act, 2023 and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, the name and contact details of the Grievance Redressal Officer are provided below:

Name: Shubh (Founder & Data Protection Officer)
Email: [EMAIL_PENDING_MAIL_SETUP]
Location: Bengaluru, Karnataka, India
Response Redressal SLA: Within 48 hours for data requests, access queries, or deletion notices.