Privacy notice · Digital Personal Data Protection Act, 2023
Your data in MiyeeCFO
In short
Your finances are stored on your own device. If you turn on Cloud Sync, a copy is encrypted on your device before it is uploaded, so nobody else can read it, not even us. AI Insights send a summary of your finances to an AI provider only when you ask a question and have agreed to it. We do not sell data, show ads or track you.
1. What we collect, why, and where it goes
| Data | Why | Where it is kept |
|---|---|---|
| Your financial records (accounts, transactions, budgets, loans, cards, investments, goals, profile) | To run the app for you | In your browser's storage on your device. Never sent to us unless you use Cloud Sync or AI Insights. |
| Cloud Sync (optional): your email, an encrypted copy of your records, a hash of a login key, session tokens, and encrypted copies of your data key (for the recovery key) | Backup and use on several devices | Cloudflare's database. Your records are encrypted with a key made from your password on your device; the server can never read them. Your email is stored in readable form to identify the account. |
| MiyeeCFO AI (optional): a summary of your finances and your question, and a daily count of how many insights you used | To answer your question and keep the free daily allowance fair | The summary is sent through our server to Anthropic (Claude, United States) for that answer only; we do not store it. The daily count is kept with your Cloud Sync account. |
| Your own AI key (optional; Groq, Google Gemini, OpenAI or Anthropic) | To answer your question with the provider you chose | Your key stays in your browser; the summary goes directly from your browser to that provider, under its own privacy terms. |
| Fund codes and stock symbols you track | To fetch the latest prices | Sent to mfapi.in (AMFI NAVs) and Yahoo Finance through our server. No amounts or personal details are sent. |
| Standard web requests (IP address, browser) | To deliver the app | Seen by Cloudflare (hosting) and the public libraries the app loads (cdnjs, jsDelivr, SheetJS, Google Fonts), as with any website. We do not run analytics or tracking. |
2. How MiyeeCFO meets the DPDP Act
The Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 (coming into force in phases) set how personal data may be used in India. For the data in section 1, Miyee Tech Labs is the Data Fiduciary; Cloudflare and Anthropic act as Data Processors.
| Duty | What MiyeeCFO does |
|---|---|
| Notice in clear language | This page, linked from the app's footer, from Cloud Sync sign-up and from AI Insights. |
| Consent: free, specific, informed | Separate choices for each purpose: Cloud Sync sign-up asks for consent to store your encrypted data; AI Insights asks once before sending any summary to an AI provider. Neither is pre-ticked, and the app works fully without either. |
| Withdrawing consent as easily as giving it | Log out of Cloud Sync or delete the cloud account at any time (Settings → Cloud Sync). Withdraw AI consent with one click on the AI Insights page. |
| Purpose limitation and minimisation | Data is used only for the purposes in section 1. AI requests carry a summary, not your full records. Price lookups carry only fund codes and symbols. |
| Security safeguards | End-to-end encryption of the cloud copy (AES-GCM with a key derived from your password by 600,000 rounds of PBKDF2), HTTPS everywhere, hashed login keys, account lockout after 10 wrong attempts, and sessions that expire after 90 days. |
| Breach notification | A personal data breach will be reported to the Data Protection Board of India and to affected users as the Rules require, with what happened, its likely effect and what we are doing about it. |
| Erasure | Delete cloud account (Settings → Cloud Sync) removes your account, encrypted backup, sessions and AI usage counts at once. Data on your device is yours to clear in your browser, or with Data Management → Reset. |
| Accuracy | You can correct any record in the app at any time. |
| Children's data | MiyeeCFO is for adults. We do not knowingly process children's data, and we do not track or target anyone. |
| Transfers outside India | Cloudflare may store the encrypted cloud copy outside India, and AI providers process requests outside India (Anthropic in the United States). We will follow any restriction the Government of India notifies under section 16 of the Act. |
3. Your rights, and how to use them
| Know and access | See everything in the app, and export it from Data Management (JSON or Excel). |
| Correct and complete | Edit any record in the app. |
| Erase | Delete the cloud account in Settings → Cloud Sync, or write to us. |
| Withdraw consent | Log out of Cloud Sync or delete the account; withdraw AI consent on the AI Insights page. |
| Grievance | Write to our Grievance Officer (below). If you are not satisfied, you can complain to the Data Protection Board of India. |
| Nominate | Name someone to act for you if you die or cannot act, by writing to us. |
4. Grievance Officer
| Name | Vipin Nair |
| Designation | Grievance Officer and Data Protection contact, Miyee Tech Labs |
| miyee.india@gmail.com (subject: "Grievance") | |
| Address | Ahmedabad, Gujarat 380015, India |
| Response | Acknowledged within 2 working days; resolved within 30 days |
This page describes our practices; it is not legal advice. It will be reviewed as the DPDP Rules come into force and when MiyeeCFO's features change.