Privacy Policy

1. Who we are

KutumbKosh ("we", "our", "us") is a financial information management platform that helps Indian families organize, track, and secure their financial asset information and nominee details. KutumbKosh is operated by Kutumbkosh Fintech Private Limited (CIN: U62099MR2026PTC477196), a company incorporated under the Companies Act, 2013, with its registered office in Thane, Maharashtra, India. This Privacy Policy explains how we collect, use, store, and protect your personal data in accordance with the Digital Personal Data Protection Act, 2023 (DPDPA) and applicable Indian laws.

2. Data we collect

We collect only the minimum data necessary to provide our service:

Account information: Email address (used for authentication via magic link), full name, phone number (optional), date of birth (optional), and PAN number (optional, for nominee verification only).

Financial asset identifiers: Institution names, asset types, last 4 digits of account numbers only (never full account numbers), approximate value ranges, and your personal notes. We never collect passwords, PINs, CVVs, full account numbers, transaction details, or Aadhaar numbers.

Nominee information: Names, relationships, contact numbers, dates of birth, and PAN numbers of your designated nominees.

Usage data: Login timestamps, device information, and IP addresses for security and audit logging purposes.

3. How we use your data

Your data is used solely to provide the KutumbKosh service: organizing your financial asset information, managing nominee mappings, generating reminders for gaps or expiries, enabling emergency access for your trusted contacts, and creating PDF exports of your vault. We do not sell, rent, or share your personal data with any third parties for marketing or advertising purposes.

4. Data storage & security

All data is stored in a PostgreSQL database hosted on Supabase, which maintains SOC 2 Type II certification. Data is encrypted at rest using AES-256 and in transit using TLS 1.3. Every database table is protected by row-level security (RLS) policies — your data is cryptographically isolated and accessible only through your authenticated session. Backups are automated and encrypted. For full security details, visit our Trust & Security page.

5. Third-party services

We use the following third-party services, all of which maintain industry-standard security certifications: Supabase (database and authentication), Vercel (application hosting), Razorpay (payment processing for Pro subscriptions), and Resend (transactional email delivery for account and subscription notifications). Razorpay handles all payment data directly — we never see or store your card numbers, UPI IDs, or banking credentials. Resend receives your email address solely to deliver transactional emails such as login links, subscription confirmations, and renewal reminders — it is not used for marketing without your consent. Each third party processes data in accordance with their own privacy policies and is contractually bound to protect your data.

6. Your rights under DPDPA

Under the Digital Personal Data Protection Act, 2023, you have the right to access all personal data we hold about you, correct inaccurate data at any time through your Settings page, delete your account and all associated data permanently, withdraw consent for data processing (which may require account deletion), and receive information about how your data is being processed. To exercise any of these rights, contact us at care@kutumbkosh.com or use the account deletion feature in Settings.

7. Emergency access & data sharing

Your trusted contacts can only view a limited summary of your vault (institution names, last 4 digits, nominee details, and your emergency instructions) after you explicitly approve their access request. Full account numbers, passwords, and sensitive credentials are never shared. You can revoke any trusted contact's access instantly at any time.

8. Data retention

We retain your data for as long as your account is active. If you delete your account, all personal data is permanently deleted within 30 days, except where retention is required by applicable Indian law. Audit logs are retained for 1 year for security purposes and then permanently deleted.

9. Cookies & tracking

KutumbKosh uses only essential cookies required for authentication and session management. We do not use advertising cookies, tracking pixels, or any third-party analytics that profile your behavior. We do not share any data with ad networks.

10. Changes to this policy

We may update this Privacy Policy from time to time. Significant changes will be communicated via email to all registered users. The "Last updated" date at the top reflects the most recent revision.

11. Contact us

For privacy-related concerns or to exercise your data rights, contact us at care@kutumbkosh.com.