1. Overview
Capitallytics ("we", "us") runs www.capitallytics.com and its apps: the Personal workspace (net worth, income, expenses, loans, goals, budget and portfolio), the Business workspace (books, invoices and bills, bank statements, reports and forecasts), calculators, and the AI CFO. This policy explains what we collect, where it is kept, who helps us process it, how long we keep it, and how you can see or delete it.
2. What we collect
- Account: your email address, name (if you give it), sign-in details, two-factor settings and your plan. Google sign-in shares your name and email with us.
- Personal workspace: the income, expenses, assets, loans, goals, budgets, holdings and portfolio transactions you add or import, and the figures we calculate from them (such as net worth history).
- Business workspace: organisations, team members you invite, accounting books, journal entries, customers and vendors, invoices, bills, bank-statement rows, budgets, forecasts, reports and connected integrations.
- Uploads: bank and card statements, mutual fund statements (CAS), broker holdings files, bills and other documents you choose to upload (see section 4).
- AI CFO: your questions, the answers, and things you ask it to remember.
- Payments: plan, amount, dates and status of your payments and auto-pay — never card numbers.
- Technical data: IP address, browser and device type, and error and security logs, used to keep the service running and secure.
3. Where your data is kept
Everything you store in Capitallytics is kept on our servers — with our database provider, Supabase, in its Seoul, South Korea region on Amazon Web Services. It is linked to your account and protected so that only you, and people you invite to a Business organisation, can see it. Your data is therefore transferred outside India, as the Digital Personal Data Protection Act, 2023 permits. See Security for how it is protected.
4. Statements and other uploads
- Statements, CAS and broker files read by the AI CFO or Portfolio import: the file is read once and deleted as soon as it has been read. A file that was never processed is deleted automatically, and no uploaded file is kept longer than a day.
- Business bank statements and Statements Studio: the file is read when you upload it and is not stored. Only the rows you confirm are saved.
- Bills you upload to the Business bills inbox: kept with your books, so you can open the original later, until you delete it or your account.
- "Send us this format": when you choose to send us a file we can't read yet, it is kept for up to 30 days to improve our importer, then deleted.
- A password for a protected PDF is used once to open it and is never stored. Account and card numbers are kept only as their last 4 digits.
5. The AI CFO
Every figure comes from our own calculations; the AI explains them. To answer you, we send our AI provider, Anthropic (Claude), your question and the figures needed to answer it, with identifiers such as your name, email and account numbers removed. If our rules can't read a document you upload and you choose to have AI read it, the document is sent to Anthropic to read; account and card numbers it finds are kept only as their last 4 digits. Nothing is used to train AI models. Your conversations and anything you ask the AI CFO to remember are stored in your account; you can delete remembered items at any time.
6. Who processes your data for us
We use these service providers. Each processes data only to provide its service to us.
| Provider | What for | What they receive |
|---|---|---|
| Supabase Inc. (on Amazon Web Services, Seoul, South Korea) | Database, sign-in and file storage | Everything you store in Capitallytics |
| Vercel Inc. | Hosting and content delivery | Every request to the site passes through Vercel |
| Anthropic (Claude) | AI CFO answers and reading documents our rules can't read | Your question and the figures needed to answer it, with identifiers removed; documents you choose to have AI read |
| Razorpay | Payments and card auto-pay | You enter card or UPI details on Razorpay's checkout; we receive payment status, never card numbers |
| Resend | Emails we send you | Your email address and the email's content |
| Optional Google sign-in; Google Analytics and Tag Manager on public pages after you allow analytics | Name and email for Google sign-in; page-usage data only if you allow analytics | |
| Microsoft Clarity | Understanding how public pages are used, after you allow analytics | Clicks, scrolls and page views on public pages, only if you allow analytics |
Market prices and exchange rates come from public data providers (listed on Security); they receive no personal data. We do not sell your data. We share it only as described here, when you create a share link, or when the law requires us to.
8. What stays on your device
Your browser keeps your preferences (such as theme and your analytics choice) and a short-lived copy of what a page is showing so it loads faster. Your financial records are kept on our servers, not stored in your browser. Signing out removes the signed-in copies from that device; deleting your account removes everything Capitallytics stored on it.
9. How long we keep data
- Your account and workspace data: until you delete it or delete your account.
- Uploaded files: as described in section 4.
- Business accounting records: if you delete your account, your books are kept for 8 years because accounting records may have to be kept by law. Your name and email are removed from them, nobody can sign in to them, and nothing is created or sent from them.
- We do not currently keep database backups. Our database host backs up only paid-plan projects and we are on its free plan, so deleted data is not kept in any backup.
- Analytics data is kept for 14 months, then deleted. It is collected only if you allowed analytics.
10. Your rights
Under the Digital Personal Data Protection Act, 2023 you can:
- See and download your data — Profile → Security → Download your data.
- Correct it — edit it in the app, or write to us.
- Delete your account and data — Profile → Security → Delete account. We email you a receipt. If you have card auto-pay, it is cancelled first.
- Withdraw consent — for analytics, in section 7; for document reading, by not uploading further documents and deleting what you uploaded.
- Nominate someone to exercise these rights if you die or cannot act yourself — write to the Grievance Officer.
- Complain to our Grievance Officer (section 12) and, if you are not satisfied, to the Data Protection Board of India.
11. Children
Capitallytics is only for people aged 18 or over. We do not knowingly collect data from anyone younger; if we learn we have, we delete it. A parent or guardian can contact the Grievance Officer.
12. Who we are, grievances and governing law
Capitallytics is operated by Kanisk Bora, a sole proprietor trading as Capitallytics. Address: MG Road, Gurugram, Haryana 122001, India. For personal data processed through Capitallytics, it is the data fiduciary under the Digital Personal Data Protection Act, 2023.
Grievance Officer (Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and the Digital Personal Data Protection Act, 2023): Kanisk Bora, email teamcapitallytics@capitallytics.com. Response time: We acknowledge every complaint within 24 hours and resolve it within 15 days. Write to the Grievance Officer about how your personal data is processed, or to exercise your rights over it, with your account email and enough detail for us to find the issue.
Governing law and jurisdiction: These terms are governed by the laws of India. The courts at Gurugram, Haryana have exclusive jurisdiction.
13. Contact
Privacy questions: teamcapitallytics@capitallytics.com. When our practices change we update this page and the date at the top.