Privacy Policy — Fingrid.ai

Website: https://fingrid.ai/
Operated by: Inforvio Technologies Private Limited (“Inforvio”, “Fingrid.ai”, “we”, “our” or “us”)

1. Introduction

Inforvio Technologies Private Limited respects your privacy and is committed to protecting personal data processed through Fingrid.ai, its website, applications, APIs, artificial intelligence services and related technology platforms.

This Privacy Policy explains what information we collect, why we collect it, how we use and disclose it, where it may be processed, how long it may be retained, and how individuals can contact us regarding their personal data.

This Policy is intended to be read alongside applicable customer agreements, service agreements, product-specific notices and consent notices.

We process personal data in accordance with applicable Indian laws, including the Information Technology Act, 2000, applicable rules, and the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025, to the extent applicable and in force.

2. Scope

This Policy applies to:

Visitors to the Fingrid.ai website.
Individuals who contact us through email, forms, demonstrations or other communication channels.
Customers, prospective customers and their authorised representatives.
Users of our lending technology, AI, document processing, voice, analytics and related services.
Individuals whose information is submitted to or processed through our services by a customer or authorised business partner.

Where a bank, non-banking financial company (NBFC), lender or other business customer uses our services to process personal data, that customer may determine the purposes and means of processing and may have its own privacy notice. Inforvio's role may be that of a technology service provider or data processor, depending on the relevant service and contractual arrangement.

If you are a borrower or applicant interacting with a lender through our technology, please also refer to that lender's privacy notice. We may need to coordinate requests relating to such data with the relevant customer.

3. Personal Data We May Collect

The personal data collected depends on the service used and the information provided.

3.1 Identity and contact information

This may include:

Name and contact details.
Mobile number and email address.
Customer, employee, agent or application identifiers.
Organisation, designation and professional contact information.
Account and authentication-related information.

3.2 Lending and application information

Where a customer uses our lending or financial technology services, information submitted for processing may include:

Loan application and application-status information.
Employment, business and income information.
Financial statements, tax returns and other financial documents.
KYC or identity-verification documents, where enabled by the relevant customer workflow.
Loan-related records, declarations and supporting documents.
Information supplied by the lender, applicant or authorised representatives.

The precise categories depend on the customer's product configuration and the workflow being used.

3.3 Documents and extracted information

Users or customers may upload documents for optical character recognition (OCR), document classification, extraction, summarisation or other automated processing.

Uploaded documents may contain personal, financial, employment, identity or other confidential information. Extracted text, structured fields, document metadata and processing results may also contain personal data.

3.4 Voice, audio and transcription information

Where voice or call-processing features are enabled, we may process:

Audio recordings or audio streams.
Speech-to-text transcriptions.
Extracted information and conversation summaries.
Call or session identifiers and technical metadata.
Responses or suggestions generated from a conversation.

Voice data may be sent to external speech or transcription providers as described in Section 7.

3.5 AI conversations and session information

Depending on the service, we may process:

Questions, prompts and messages submitted by users.
AI-generated responses and suggested follow-up questions.
Session identifiers and workflow information.
Uploaded files and information extracted from those files.
Tool invocation records, diagnostic information and application logs.

Users should not submit information that is unrelated to the intended workflow or that they are not authorised to share.

3.6 Technical and security information

We may process technical information such as:

IP addresses and network information.
Authentication and access records.
User, tenant and session identifiers.
API requests and application events.
Error reports, diagnostic records and security audit logs.
Device, browser or service metadata where made available by the relevant platform.

3.7 Website and communication information

When you contact us or interact with our website, we may collect the details you provide, such as your name, email address, organisation, enquiry and related correspondence.

The use of cookies, analytics tools or similar technologies on the public marketing website has not been independently verified as part of the application code review. Any such technologies must be described accurately in a website-specific cookie notice where applicable.

4. Purposes for Processing Personal Data

We may process personal data for the following purposes, depending on the service and applicable legal basis:

Service delivery: To provide, operate and maintain our applications, APIs, AI services, lending workflows and document-processing capabilities.
Identity and access management: To authenticate users, manage accounts, enforce permissions and protect access to customer environments.
Application processing: To extract, organise, validate, analyse or transmit information required for a customer’s business workflow.
AI and voice features: To process prompts, documents, audio and transcriptions to provide configured AI-assisted features.
Customer support: To respond to enquiries, troubleshoot incidents and support customers.
Security and fraud prevention: To detect unauthorised access, investigate suspicious activity and maintain system integrity.
Audit and accountability: To maintain relevant system, access, workflow and security records.
Service improvement: To diagnose technical issues, improve reliability and maintain service quality, subject to applicable law and contractual restrictions.
Legal and regulatory compliance: To comply with applicable legal obligations, lawful requests and contractual requirements.
Business administration: To manage customer relationships, agreements, billing, procurement and business communications.

We will not treat the use of personal data for unrelated purposes as automatically authorised merely because the data was originally provided to us.

Where consent is required, we or the relevant customer will obtain it through an appropriate notice or workflow, as applicable. Where another lawful basis applies, processing will be undertaken in accordance with the applicable law.

Where consent is the applicable basis for processing, the relevant notice should explain the personal data involved, the purpose of processing and the means available to exercise applicable rights or withdraw consent.

Our lending workflows may capture consent-related information. The existence of a consent field or record does not, by itself, establish that every processing activity across every service is covered by valid consent.

Where a customer supplies personal data to us, that customer is responsible for ensuring that it is authorised to provide the data and has completed any notices, permissions or other steps required of it. Inforvio will process such information according to the applicable service arrangement and instructions, subject to law.

If consent is withdrawn, processing based on that consent will be handled as required by applicable law. Withdrawal does not necessarily invalidate processing that occurred lawfully before withdrawal, and some information may need to be retained where legally permitted or required.

We do not sell personal data as a business model. We may disclose or make personal data available in the following circumstances.

6.1 Cloud infrastructure and hosting providers

We use cloud services, including Amazon Web Services (AWS) and Google Cloud Platform (GCP), to support application hosting, databases, storage, backups, AI processing and related infrastructure.

6.2 AI, speech and transcription providers

Depending on the feature being used, relevant data may be processed by:

Google Cloud Vertex AI / Gemini for configured AI and language-model functionality.
Google Speech-to-Text for speech recognition.
ElevenLabs for configured text-to-speech or voice functionality.
AssemblyAI for configured audio transcription, including long-call transcription workflows.

For example, audio or call information may be sent to a transcription provider when a customer uses a feature that depends on that provider. Prompts or document content may be sent to an AI provider when required to produce a requested output.

These providers process information under their applicable terms, service configurations and contractual arrangements. Their own privacy notices and processing terms may also apply.

6.3 Other service providers

We may use services such as:

Google Maps for configured location or conveyance-related features.
Firebase for configured application or push-notification functionality.
Email, communications, monitoring, security, support and other infrastructure providers where required for service delivery.

The specific providers involved may vary by product, customer configuration and deployment.

6.4 Customers and authorised parties

We may share information with the relevant lender, financial institution, business customer or its authorised personnel when necessary to provide the contracted service. Access may be governed by roles, permissions, tenant separation and the customer's own operational policies.

6.5 Legal, regulatory and safety purposes

We may disclose information where reasonably necessary to comply with applicable law, respond to valid legal process, protect the rights or safety of individuals, investigate security incidents or enforce contractual rights.

6.6 Corporate transactions

Personal data may be disclosed as part of a merger, acquisition, restructuring, financing or sale of business assets, subject to appropriate safeguards and applicable law.

We seek to limit disclosures to what is reasonably necessary for the relevant purpose.

7. Data Storage, Processing Locations and International Transfers

Our current application configuration identifies the following principal cloud regions:

AWS: ap-south-1 (Mumbai, India) for configured AWS infrastructure.
Google Cloud Vertex AI: asia-south1 (Mumbai, India) in the reviewed environment configuration.

Some related services may process data in other locations. ElevenLabs and AssemblyAI are US-based providers, and data submitted to them may be processed outside India. Google services and other providers may also process information according to their service-specific configurations and terms.

The location of a primary database or cloud workload does not, by itself, guarantee that all related processing, support operations, logs, backups, metadata or third-party services remain in the same country.

We will assess and manage cross-border processing in accordance with applicable law, relevant contractual commitments and any restrictions that apply to the relevant data or service.

Customers with specific data-residency or sectoral regulatory requirements should confirm the applicable deployment configuration and processing arrangements with us before submitting data.

8. Artificial Intelligence and Automated Processing

Fingrid.ai may use AI and machine-learning services to support document extraction, text processing, summarisation, speech-related functionality, workflow assistance and other configured features.

AI-generated results may be incomplete, inaccurate or unsuitable for a particular decision. Outputs should be reviewed by an appropriately authorised person before being used for material lending, financial, compliance or other consequential decisions.

Unless expressly agreed in writing, our AI services are intended to assist a workflow and should not be treated as a substitute for the customer’s legal, regulatory, credit, risk or professional responsibilities.

Customer data may be transmitted to the AI or speech providers needed to fulfil the requested function. The handling of that data by those providers depends on the applicable service terms, account configuration and contractual protections.

Customers should not assume that every AI provider, model or feature is configured identically, or that all providers have the same data retention or model-training practices. These details should be verified for the specific service used.

9. Security Safeguards

We use technical and organisational measures intended to protect information against unauthorised access, disclosure, alteration, loss and misuse. Depending on the service and deployment, these measures may include:

Role-based access controls.
Tenant separation and tenant-related access restrictions.
IP allowlisting in configured environments.
Encryption of designated personal-data fields.
Authentication and access controls.
Audit logging and security monitoring.
Backup and recovery mechanisms.
Restricted access to production systems and operational environments.

No method of transmission, storage or processing is completely secure. We cannot guarantee that every system, connection, integration or data category is protected by identical safeguards.

The engineering review identified areas requiring improvement or production verification, including migration of certain personal-data encryption from AES-ECB to a stronger authenticated encryption approach, verification and enforcement of database TLS, and reduction of sensitive content in certain audit logs. Accordingly, this Policy does not represent that all database connections enforce TLS or that every data category is encrypted in the same manner.

We will continue to assess and improve security safeguards based on risk, applicable requirements and operational needs.

10. Data Retention and Deletion

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, subject to applicable law, customer instructions, contractual requirements, dispute resolution, security needs and lawful retention obligations.

Retention may differ across:

Customer accounts and business records.
Loan applications and supporting documents.
Uploaded files and extracted information.
AI conversations and session records.
Audio recordings and transcriptions.
Application, security and audit logs.
Backups and recovery copies.
Communications and support records.

Current implementation limitation: The engineering review did not establish that a uniform, fully implemented retention schedule or automated deletion process exists for every category of data. Some AI session data, audit records and technical logs may remain stored until the relevant retention and deletion procedures are implemented and executed. Certain logs may also contain information submitted during tool or document-processing calls.

We therefore do not represent that every record is automatically deleted after a fixed number of days.

We are working toward documented retention periods, data minimisation and deletion procedures for relevant data categories. Where a verified retention period applies to a particular service, it should be specified in the applicable customer agreement, product notice or approved retention schedule.

Where deletion is requested, we will assess the request, the applicable legal requirements, the relevant customer relationship and whether retention is necessary or legally permitted. Deletion from active systems may not immediately remove all information from backups, archived records or records that must lawfully be retained.

11. Privacy Rights and Requests

Subject to applicable law and the relevant service arrangement, individuals may have rights to:

Obtain information about personal data processed about them.
Request correction or updating of inaccurate or incomplete personal data.
Request erasure of personal data where applicable.
Withdraw consent where processing is based on consent.
Raise a grievance regarding the handling of personal data.
Nominate another individual where the applicable law provides for such a right.

How to submit a request

Send a request to sreedhar@loanwiser.in with the subject line “Privacy Request — Fingrid.ai”.

Please include enough information for us to understand the request and identify the relevant service or interaction. We may request reasonable additional information to verify identity or authority, while avoiding unnecessary collection of further personal data.

We will review and respond to requests in accordance with applicable law and the relevant deadlines.

At the time of this Policy's preparation, the engineering review did not identify dedicated self-service endpoints for all privacy rights or a complete in-product privacy request workflow. Requests may therefore need to be handled through the contact process above.

If your data was provided to us through a lender or other business customer, we may need to refer the request to that organisation or coordinate with it before acting. We will explain this where appropriate.

12. Children's Personal Data

Our business services are not intended to be directed at children unless a specific service and lawful arrangement expressly provides otherwise.

Where a service processes a child's personal data, the relevant organisation and Inforvio must assess and meet applicable requirements relating to notices, verifiable parental consent, restrictions on processing and any applicable exemptions.

If you believe that a child's personal data has been submitted to us inappropriately, contact us using the details in Section 17.

13. Cookies and Similar Technologies

The public marketing website's use of cookies, analytics, advertising pixels and similar technologies must be verified separately from the application source code.

Where such technologies are used, they may support essential website functionality, security, preferences, traffic measurement or other disclosed purposes.

You can review the cookie controls available through your browser. Blocking certain cookies may affect website functionality.

Before publishing this Policy, Inforvio should verify the live website and add an accurate cookie notice describing the technologies actually deployed, their purposes, the relevant providers and any consent or preference mechanism required by applicable law.

14. Third-Party Websites and Services

Our website or services may link to third-party websites, applications or services. Those third parties operate under their own privacy policies and terms.

We are not responsible for the independent privacy practices of third parties outside our control. Please review the relevant third-party terms and notices before submitting personal data to them.

15. Personal Data Breaches and Security Incidents

We maintain security and operational processes intended to identify, investigate and respond to security incidents.

If a personal-data breach occurs, we will assess its nature, scope, likely consequences and applicable notification obligations. Where required by applicable law, we will provide notices to the relevant individuals, customers, authorities or other recipients within the applicable timelines.

Where we process data on behalf of a customer, we will follow the applicable contractual incident-notification and cooperation arrangements, subject to law.

Individuals who suspect unauthorised access or disclosure involving Fingrid.ai should contact us promptly using the details in Section 17.

16. Changes to This Privacy Policy

We may update this Policy to reflect changes in our services, technology, processing practices, contractual arrangements or applicable law.

The revised version will be published on our website with an updated “Last Updated” date. Where required, we will provide additional notice or obtain consent before implementing changes that require it.

17. Contact and Grievance Details

For privacy requests, complaints or questions about this Policy, contact:

Organisation: Inforvio Technologies Private Limited
Website: https://fingrid.ai/
Direct Executive / Grievance Email: sreedhar@loanwiser.in (Sreedhar Ramasamy, Founder & CEO)
Phone: +91 88835 65000
Registered Office Address: C6, Lacasa Apartment, Nehru Nagar West, Coimbatore, Tamil Nadu – 641014
Grievance Officer / Privacy Contact: Sreedhar Ramasamy, Founder & CEO

Please do not send passwords, complete identity documents, full financial records or other highly sensitive information in an initial email unless specifically requested through an approved secure process.

Important Notice

This document is a general policy draft and is not a legal opinion or a certification of compliance. It must be reviewed against the services actually deployed, customer agreements, applicable sectoral requirements and the final production configuration before publication.