Privacy Policy

⚠ Not legal advice. These are structural starting-point templates so the launch isn't blocked on a blank page. Have qualified counsel review and finalize before publishing — especially anything about jurisdiction, data-processing commitments, liability, and India's DPDP Act / any GDPR exposure. Bracketed […] items are decisions the owner/counsel must fill.

Effective date: [date] · Entity: [legal entity name], [address], [jurisdiction].

1. Who we are. Rigana AI ("Rigana", "we") provides a finance analytics application. This policy covers data we handle when you use our website and app.

2. What we collect.

• Account data: name, work email, company, role (provided by you or your admin via invitation).
• Financial content you upload: MIS/Excel workbooks and the figures derived from them, stored to provide the service.
• Usage/technical data: logs, audit events, device/browser info for security and reliability.
• Request-access form: name, email, company, message.

3. How we use it. To provide and secure the service, compute the answers/reports you request, support you, and improve reliability. [State clearly if data is not used to train third-party models — recommended commitment.]

4. Sub-processors. We use third parties to run the service: [Anthropic] (LLM for turning your questions into queries — note: numbers are computed from your data, not the model), [Railway] (hosting/database), [Resend] (transactional email). [Link a current sub-processor list.]

5. Storage & security. Where data is hosted [region], access controls, encryption posture [align with the Track-B hardening: at-rest encryption, tenant isolation], audit logging.

6. Retention. We keep your data while your account is active and for [period] after, then delete or anonymize [detail].

7. Your rights. Access, correction, export, and deletion of your data — contact [email]. [Add DPDP/ GDPR-specific rights as applicable.]

8. Data location & transfers. [Where data resides; any cross-border transfer basis.]

9. Children. Not directed to anyone under [age]; not for consumer use.

10. Changes. We'll post updates here and notify you of material changes.

11. Contact. [privacy@domain] / [address].