Privacy Policy

Sozo Labs Pvt Ltd ("we", "our", or "us") operates the BalanceSe mobile application and the website at balancese.com (together, the "Platform"). This Privacy Policy explains how we collect, use, store, share and protect your information when you use our Platform.

In delivering our services we work with Shreem Datatech Solutions Pvt. Ltd. ("SreeM"), a Registered Investment Advisor, for the secure handling of certain categories of financial data, including bank account and mutual fund information. That data resides on SreeM's servers. BalanceSe renders it on your device and does not store it on Sozo Labs servers.

By using BalanceSe, you agree to the terms of this Privacy Policy. This document is an electronic record under the Information Technology Act, 2000 and requires no physical or digital signature.

2.1 Information You Provide

• Full name and email address
• Phone number (for authentication)
• Date of birth, gender, city, occupation and income band, where you choose to provide them
• Account preferences, budgets, categories, tags and manually entered transactions
• Correspondence with our support team and responses to surveys

2.2 Financial Data via Account Aggregator

This includes bank account information, transaction history and account balances, fetched only with your explicit, informed consent and used solely to provide spend analysis and financial insights within the App. Credit card and investment data (equities, ETFs, crypto and other holdings) that you supply directly is held by Sozo Labs.

2.3 Transactional SMS Data

With your permission, BalanceSe detects bank and card transaction messages to track spending automatically. This is described in full in Section 3.

2.4 Usage and Device Data

• App interactions and feature usage
• Device information (model, OS version, screen size, device identifier)
• App version and crash reports
• IP address, mobile network details, country and language preferences
• Approximate or precise location, where you grant location permission

2.5 Payment Information

Payment transactions are processed by Razorpay, an RBI-compliant payment gateway, or by the Google Play Store or Apple App Store where a subscription is purchased through them. We do not store any raw payment card details on our servers.

2.6 Information We Never Collect

Automatic expense tracking is a core function of BalanceSe. With your permission, the App identifies messages sent by banks, card issuers and payment providers and transmits those messages to our secure servers, where they are parsed to extract structured transaction details:

• Amount, date and time
• Merchant or payee name
• Transaction type (debit, credit, refund)
• Trailing digits of the account or card
• Available balance, where the message states it

The extracted transaction records are stored on our servers so that your history remains available across sessions and devices.

3.1 Limits on This Processing

• Only messages originating from recognised financial senders are transmitted to our servers. Personal messages between individuals are not read, transmitted, stored or analysed for any purpose.
• One-time passwords are never read, transmitted or stored.
• SMS data is never shared with advertising, marketing or analytics providers.
• This permission is entirely optional and may be withdrawn at any time in your device settings. The App continues to work through manual entry and the Account Aggregator flow, though automatic capture will stop.
• On deletion of your account, transaction records derived from SMS are deleted in accordance with Section 9.

We use the following third party services in our App. Each acts on our documented instructions, is bound by confidentiality and security obligations, and may not use your information for its own purposes.

• Provide and maintain our App and services
• Fetch, parse and display your financial data with your consent
• Generate budgets, insights, summaries, reminders and net-worth views
• Process subscription payments
• Verify your identity at account creation and during password reset
• Send important notifications about your account or service
• Analyse app usage to improve features and user experience
• Attribute user acquisition to marketing campaigns
• Detect, prevent and remediate fraud, abuse and unauthorised access
• Detect and fix crashes and technical issues
• Comply with legal obligations

We do not use your financial data to make automated decisions producing legal or similarly significant effects, and we do not sell your personal information.

Every permission below is optional and may be reviewed or withdrawn at any time in your device settings. Declining a permission disables only the dependent feature, not the App.

• SMS (read): automatic detection of bank and card transaction messages
• Notifications: transaction alerts, budget reminders, security notices
• Storage / media: attaching receipts and exporting reports
• Location: location-based features and regional personalisation
• Camera: receipt scanning and profile photograph

We do not sell or rent your personal or financial data to any third party, for any reason, at any time. We may share data in the following limited circumstances:

• SreeM: bank account and mutual fund data, which SreeM securely manages and stores under a contractual obligation to provide protection equivalent to this Policy
• Service Providers: the third parties listed in Section 4, strictly for the purposes described
• Group Companies: members of the Sozo Labs group, for support, security and infrastructure
• Legal Requirements: if required by law, court order, subpoena or government authority, or where we believe in good faith that disclosure is necessary to prevent physical harm or financial loss, or to investigate suspected unlawful activity
• Business Transfer: in the event of a merger, acquisition or sale of assets, with appropriate confidentiality protections and prior notice of any change in data handling
• With Your Consent: for any other purpose with your explicit consent

We take special care to protect your financial data:

• Bank and mutual fund data is fetched only through the RBI-regulated Account Aggregator framework
• All data is transmitted using bank-level encryption (TLS) and encrypted at rest
• We do not store raw bank credentials
• Access to personal data is restricted to authorised personnel on a need-to-know basis, with role-based controls, logging and monitoring
• Financial data is used solely to provide you with insights within the App
• You can revoke consent to access your financial data at any time

No system can be guaranteed completely secure, and you remain responsible for protecting your device, credentials and app lock. Where a personal data breach affecting you occurs, we will notify you and the relevant authority within the timelines prescribed by law.

We retain your personal data for as long as your account is active or as needed to provide services. If you delete your account:

• Your personal data, including transaction records derived from SMS, is deleted within 30 days
• Financial data fetched via Account Aggregator is deleted immediately
• Anonymised analytics data may be retained for up to 12 months

We may be required by law or contract to preserve particular records — for example, for fraud prevention, or to bring or defend legal claims — and such records are retained only for as long as that obligation subsists. Data managed by SreeM is retained in accordance with SreeM's own practices under applicable law.

You have the right to:

• Access: Request a copy of the data we hold about you and the parties it has been shared with
• Correction: Request correction of inaccurate or incomplete data
• Deletion: Request deletion of your personal data
• Withdrawal of Consent: Withdraw consent for financial data access or SMS access at any time
• Data Portability: Request your data in a portable, machine-readable format
• Nomination: Nominate another individual to exercise your rights in the event of death or incapacity
• Grievance Redressal: Raise a complaint with our Grievance Officer and escalate to the appropriate authority if unresolved

To exercise any of these rights, contact us at support@sozolabs.in. We may need to verify your identity before acting on a request.

BalanceSe is not intended for users under the age of 18. We do not knowingly collect personal information from minors. If you believe a minor has provided us with personal information, please contact us immediately at support@sozolabs.in and we will delete it promptly.

Our App uses analytics tools (Mixpanel) that collect anonymised usage data to improve the App experience. No cookies are used for advertising targeting within the App.

Our website uses cookies and similar technologies to keep you signed in, remember preferences, measure traffic and campaign performance, and improve security. Most browsers allow you to block or delete cookies through their settings, though disabling them may limit some features. You may also limit ad personalisation by resetting or restricting your device advertising identifier.

This Privacy Policy is governed by:

• Information Technology Act, 2000 (India)
• Digital Personal Data Protection Act, 2023 (DPDP Act)
• RBI Account Aggregator Framework (Master Direction NBFC-AA, 2016, as amended)
• Sahamati guidelines for the Account Aggregator ecosystem

We may update this Privacy Policy from time to time. We will notify you of significant changes via:

• In-app notification
• Email to your registered address
• Updated "Last Updated" date at the top of this page

Continued use of the App after changes constitutes acceptance of the updated policy.

If you have any questions, concerns, complaints or requests regarding this Privacy Policy, please contact our Grievance Officer. We acknowledge complaints within 24 hours and aim to resolve them within 15 days of receipt, in accordance with applicable law.