Privacy Policy

Version 1.5 · Last updated: 25 October 2026

1. Who we are

ArthPulse (“ArthPulse”, “we”, “us”) is a personal-finance app that automatically tracks your bank, card and UPI transactions by reading the transaction alert messages (SMS) on your device. ArthPulse is operated by ArthPulse Labs, a sole proprietorship based in India. For the purposes of India's Digital Personal Data Protection Act, 2023 (DPDP Act), we are the Data Fiduciary for the personal data described here, and you are the Data Principal.

Contact for privacy questions & grievances: [email protected] / [email protected]

2. Who can use ArthPulse (18+ only)

ArthPulse is intended only for individuals aged 18 or older. We do not knowingly create accounts for, or process the personal data of, anyone under 18. We ask for your date of birth at sign-up and do not permit registration by anyone under 18.

3. What personal data we collect

We collect only what we need to track your transactions and run your account:

• Transaction alert messages (SMS): the content, sender and time of the financial SMS on your device. This is the core data that powers the app. On the Google Play version, before any message leaves your device, we drop messages we can identify as one-time passwords (OTPs) or personal messages from an individual's phone number — only bank/card/UPI-style alerts are uploaded.
• Transaction details we derive from those messages: amount, date, merchant name, category, and the last 4 digits of the account/card involved (we do not store full account or card numbers).
• Payment instrument details you add: bank, card type, card network, UPI app/handle, and the last 4 digits of the account — as you enter them.
• Profile: your name, email address, date of birth, and (optionally) phone number.
• Account security data: a securely hashed password, login sessions, and — if you enable it — biometric passkeys (only a public key is stored; your fingerprint/face never leaves your device).
• App & device signals: app version and which permissions you have granted, used to run and support the service.
• Approximate location: the internet (IP) address your app or browser connects from, and the approximate location we work out from it — city, state/region and country only. We do not collect GPS or precise location, coordinates, postcode or your internet provider’s name, and the app never asks you for a location permission. Your IP address is looked up on our own servers, against a local lookup file — it is never sent to any third-party location service. We keep this for at most 3 years (see §9).
• Anything you send us: feedback messages and corrections you make to your transactions.
• Limited in-app usage events: a few first-party signals — for example when our pricing banner or page is shown or tapped — recorded on our own servers to understand how the app is used and improve it. These are our own signals, never shared with advertisers or data brokers.
• Website analytics: when you visit arthpulse.in, we use analytics to understand how visitors use our website and to improve their experience. If you sign up after visiting our website, we also note how you found us. We do not use cookies for this or store your IP address, and this data is not sold or shared with third parties, other than service providers who process it on our behalf. It is kept for up to 3 years.

The app contains no third-party advertising, analytics or crash-reporting SDKs. The usage events above are entirely first-party (recorded by us, on our own servers), not collected through any third-party tracker. App crash logs are kept only on your device and are never uploaded.

4. How we use your data

We use your data solely to:

• read your transaction alerts and turn them into a categorised record of your spending;
• show your dashboards, balances, subscriptions and insights;
• maintain and improve the accuracy of our transaction parsing;
• run your account, sign you in, send verification/password emails, and respond to your requests;
• keep the service secure and prevent misuse — including spotting a sign-in from an unexpected place or device and being able to tell you about it;
• help you when you contact support, by seeing which of your devices is affected;
• understand, at a city level and only inside our own team, where and how the service is being used, so we can improve it. This is never shared with, or sold to, anyone outside ArthPulse.

We do not sell your personal data, and we do not use it for advertising.

5. Our legal basis: your consent

We process your personal data on the basis of your consent, which you give when you sign up and when you grant the SMS permission. Before you consent, we show you a notice of what we collect and why, and we record your consent. Your consent is specific and unbundled — you are not required to agree to any optional processing (such as product offers) in order to use the core service.

You can withdraw your consent at any time — for example by contacting us at [email protected]. When you withdraw the consent that the service depends on, we stop processing your personal data (except where the law requires us to keep certain records — see §9).

6. Who we share your data with

We do not sell or rent your personal data, and we do not use it for third-party advertising. We share your data only with a limited set of service providers who help us operate the service, under strict confidentiality obligations and only for the purposes described in this policy.

These providers support functions such as:

• secure cloud hosting of our application and database (located in India);
• sending you emails, such as verification and password-reset messages;
• processing limited non-personal information — we use external services to process certain non-personal, non-financial information to help run and improve the service. We do not share your message content, transaction amounts, or account details with them.

Our service providers are bound by contract to keep your information confidential and to use it only to provide their service to us. A current list of our key service providers is available on request at [email protected].

How we process your data — in-house. As of July 2026, all analysis of your financial data — reading your transaction messages and categorising your spending — is performed in-house on our own systems. We do not currently use any third-party AI service to process your data; the only external processing we rely on is the limited service described above (together with the hosting and email infrastructure noted above). We may in future use trusted third-party technology providers, including AI providers, to help — in which case they will be contractually bound to act only on our instructions, not to use your data for their own purposes, and not to train their own models on your data, and we will update this policy (asking for your consent where required).

7. Transfers outside India

Our primary storage is in India. Some of our service providers may operate outside India; where that is the case, only limited data (such as a business name or your email address) may be processed abroad, in accordance with this policy and applicable Indian law.

8. How we protect your data

We take reasonable security measures to protect your data, including access controls, security and data-access logging, and secure hosting in India. Data is transmitted over encrypted (HTTPS) connections. We store account and card identifiers as last-4 digits only (never full account or card numbers), and passwords only as secure one-way hashes. We keep logs to detect and investigate any unauthorised access.

If a personal-data breach occurs, we will notify you and the relevant authorities — including CERT-In and the Data Protection Board of India — as required by law.

9. How long we keep your data

We keep your transaction history and account data for as long as your account is active, so the app can show your financial picture and maintain parsing accuracy.

Approximate location and IP addresses are kept for a maximum of 3 years. After that they are erased automatically by a scheduled job — you do not have to ask, and it does not depend on you deleting your account. We hold them this long so that we can compare a period against the same period a year earlier; the security and support uses in §4 are served well inside it.

Security and abuse logs are kept for a maximum of 180 days, also erased automatically. This is a shorter period than the one above because it serves a shorter purpose — investigating recent misuse.

When you delete your account (see §10), we erase your personal data, except limited information and logs that the law requires us to retain for a period (currently up to one year under the DPDP Rules, 2025), after which those are permanently erased.

10. Your rights and choices

Under the DPDP Act you have the right to:

• access a summary of the personal data we hold about you and how we process it, and the list of processors we share it with;
• correct, complete or update your data (you can edit transactions in the app directly);
• erase your data / delete your account;
• withdraw consent (see §5);
• nominate another person to exercise your rights if you die or become incapacitated;
• raise a grievance with us (see §11).

Deleting your account and data. You can delete your account and all of your personal data yourself, at any time — in the app (Settings → Delete account) or on the web dashboard (Settings → Delete account). See our step-by-step guide at arthpulse.in/delete-account. When you request deletion, your account is scheduled for permanent deletion after a short grace period (currently 30 days), during which you can cancel and keep your account. After that, we permanently erase all of your personal data and retain only the limited records the law requires us to keep for a period (§9), which are then permanently erased. If you can’t sign in, email us at [email protected] or [email protected] and we’ll do it for you.

To exercise any of these rights, contact us at [email protected].

11. Grievance redressal

If you have a concern about how we handle your data, contact us at [email protected]. We will respond within the period required by law (no later than 90 days). If you are not satisfied, you may approach the Data Protection Board of India.

12. Children

ArthPulse is for adults (18+) only. We do not knowingly process the data of anyone under 18, and we do not carry out behavioural monitoring of, or targeted advertising to, children (see §2).

13. Changes to this policy

We reserve the right to update or modify this Privacy Policy at any time, at our discretion, to reflect changes in our services, technology, business practices, or legal and regulatory requirements. When we make changes, we will revise the “Version” and “Last updated” date above, and the changes take effect when the updated policy is posted here. If a change introduces a genuinely new purpose for using your personal data, we will ask for your fresh consent as required by law. Your continued use of ArthPulse after an update means you accept the revised policy.

14. Contact

• Privacy / data questions: [email protected]
• Grievances: [email protected]
• Website: arthpulse.in