Policies
Privacy policy
Last updated: 6 November 2026 (draft, not yet published)
In short
Your statements are processed in your browser and are not sent to our servers. AIS, fund, demat, PF and bank statements, and any passwords you type to open them, are read by code running on your own device. They are not uploaded to our servers.
We have no user accounts. Your case is saved only as an encrypted file on your own device, if you choose to save it.
We receive only what we need to take payment, to answer you, to keep the site secure and, if you agree, to measure our ads and pages and to email you.
We never sell your data.
Who we are
ArthaSaathi (arthasaathi.com) is operated by Aashima Taneja, a sole proprietor, of 102, Building No. 3, Meridien Apartments, Veera Desai Road, Andheri (W), Mumbai 400058 (“we”, “us”). We decide why and how the limited personal data described below is used, and we are responsible for it under the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”) which govern our operations during the current transition period, and India’s Digital Personal Data Protection Act, 2023 (and its Rules).
What stays on your device
When you build a money map, the documents you add (for example your Annual Information Statement, mutual fund or depository statements, PF passbook, bank or card statements) and any passwords needed to open them are processed by code running in your browser. So are the details you type in, such as names, account references and amounts, and the dockets we generate for you.
None of this is sent to or stored on our servers. If you close the page without saving, it is gone. If you choose Save progress, the file is encrypted in your browser with a passphrase you set and then saved to your device. We cannot open it, and we cannot recover it if you lose the passphrase, so please keep the passphrase somewhere safe.
Under the active SPDI Rules, 2011, your passwords and financial information (such as bank details, card details, or statement contents) are explicitly classified as Sensitive Personal Data or Information (SPDI). Because this processing happens strictly on your local device, we do not collect, store, or possess your SPDI on our systems.
If you are acting for a family member who has died, for a minor, or for someone else, the details you enter about them also stay on your device. You confirm that you are entitled to use the documents and information you add. If you are a parent or guardian entering a child’s details, they stay on your device in the same way.
What does leave your browser
Loading the site and using it sends ordinary technical data to our host (your IP address and browser details, as in any website visit). If you accept cookies, Google receives the advertising and analytics data described below. If you buy a docket, the payment flow runs through Razorpay. We do not send the content of your statements or the details you type into the tool to any of these.
Please do not email us your statements, passwords or identity documents. We do not need them and do not want them.
What we receive
| What we receive | Why | Our basis | How long we keep it |
|---|---|---|---|
| Payment details: name, email, phone number and payment ID, as passed to us by Razorpay when you buy a docket. Card, UPI and bank details are handled by Razorpay and do not reach us. | To take payment, deliver your docket, issue a GST invoice, handle refunds and meet tax and accounting law. | You give it to us for this purpose when you pay. | 8 years, as tax and accounting law requires us to keep these records. |
| Email address, if you ask for reminders or to be told when a feature is ready. | To send only those emails. | Your consent, which you can withdraw at any time. | Until you unsubscribe or ask us to delete it. |
| Support emails and anything you include in them. | To answer you and keep a record of complaints. | You contact us for this purpose. | 2 years after the conversation ends. |
| Technical data: IP address, browser type, pages visited, in server and security logs. | To keep the site running, secure and to detect abuse. | Needed to provide the service and to meet security obligations. | 1 year (365 days), to fully comply with security log retention baselines. |
| Advertising and analytics data: which ad brought you here and which pages you visited, via cookies (see below). | To measure whether our ads and pages work. | Your consent, which you can withdraw at any time. | As set by the provider, up to 14 months. |
We rely on your consent, or where the law allows, on uses needed to provide the service you asked for and to meet legal obligations.
Cookies
The site works without cookies. With your permission, we use two kinds of optional cookie, and you choose each separately:
Analytics cookies (Google Analytics): to see which pages people visit and where they leave.
Advertising cookies (Google Ads): to see which ads lead people to start a money map.
The cookie banner has a button to accept and a button to refuse, shown with equal prominence. Nothing optional is switched on before you choose. You can change your choice at any time from the link at the foot of each page. Even if you accept, Google’s tags never load on the pages where you open statements or type details. Refusing does not affect how the site works. We do not use advertising cookies for anyone under 18.
Who we share data with
We share personal data only with service providers that help us run ArthaSaathi, and only what each needs:
Razorpay: payments and refunds. Razorpay handles your card, UPI and bank details under its own privacy policy and is responsible for them.
Cloudflare (Cloudflare Pages): hosts this website and records the technical logs described above; it also stores the email you leave if you ask us to tell you when a new feature launches.
Zoho (Zoho Mail): our support mailbox. If we start sending reminder or update emails, we will name the service that sends them here first.
Google: advertising and analytics, only if you accept those cookies.
We have a contract with each provider that acts for us, requiring it to protect your data and use it only for our purposes. Some of these providers may store data outside India, subject to Indian law on cross-border transfers. We may also disclose data if Indian law or a court or government order requires it. We never sell personal data or share it for others’ marketing.
Your rights You can ask us to:
tell you what personal data we hold about you, how we use it, and who we have shared it with;
correct or update it;
delete it, unless the law requires us to keep it (for example, payment records);
withdraw consent you gave, such as for emails or cookies (withdrawing is as easy as giving it, and does not affect what we did before);
name someone to exercise these rights for you if you die or become unable to; and have a grievance about how we handle your data looked into.
Email [email protected]. We reply within 30 days.
Complaints
If you have a concern about your personal data, write first to our grievance officer: Aashima Taneja, Proprietor and Grievance Officer, [email protected] (subject line “Grievance”), 102, Building No. 3, Meridien Apartments, Veera Desai Road, Andheri (W), Mumbai 400058. We acknowledge within 48 hours and aim to resolve it within 30 days (in compliance with the 1-month resolution mandate under the SPDI Rules, 2011). More details are on the Contact us page. If you are not satisfied with our response, you can complain to the Data Protection Board of India, once it is accepting complaints.
If something goes wrong
If a personal data breach affects you, we will tell you and the Data Protection Board of India as the law requires, and tell you what we know about what happened and what you can do.
Security
The site is served only over HTTPS. Because your statements are processed on your own device and not stored by us, the most sensitive information does not sit on our systems. Saved case files are encrypted in your browser before they are saved to your device. We restrict access to the data we do hold and review our service providers. No system is perfectly secure, so keep your device and your case-file passphrase safe.
Children
ArthaSaathi is for adults. We do not knowingly collect personal data from anyone under 18, and we do not use advertising cookies for them. If you tell us through the confirmation page, or we learn, that a person under 18 has given us personal data, we will delete it.
Changes to this policy
If we change how we handle personal data (for example, if a future feature needs to send information to our servers), we will update this page and change the date at the top before the change takes effect, tell you by email if we have your address and the change is material, and ask for your consent where the law requires it.