1. Who we are
Paisa Agent is operated by Paisa Agent Technologies Private Limited, India ("Paisa", "we", "us"). It is an AI assistant on WhatsApp, the web dashboard at paisaagent.ai and a mobile app, that keeps records you tell it about — money, shared events and projects, a business, or almost anything else — and answers questions about them.
This notice is published under the Information Technology Act, 2000 and its rules, and the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the rules made under it, as and when they come into force. Paisa is the data fiduciary for the personal data described here.
2. What we collect, and why
Each item below is used only for the purpose against it.
- Your phone number — to run the WhatsApp conversation and to sign you in with a one-time code. Stored hashed and encrypted alongside the number itself.
- Your name and language — to address you and reply in your language.
- Email, name and profile picture from Google — only if you sign in to the mobile app with Google, to create and sign in to your account.
- Messages, voice notes, photos and documents you send — to understand what you are telling us and turn it into records. Voice notes are transcribed and the audio is not kept. Photos and documents (receipts, bills, statements, work photos) are kept — see section 6.
- The records themselves — expenses, income, budgets, loans, subscriptions, investments, event and project entries, vendors and payments, stock, attendance and wages, custom trackers — to keep track and to answer your questions, produce summaries, reminders and reports.
- What the assistant remembers about you — short facts drawn from the conversation (for example your salary date or that you run a shop) so it does not ask twice. Stored encrypted. Say "forget that" in chat to remove one.
- Data about other people that you enter — names and phone numbers of people you invite, and names, phone numbers, attendance, wages and work photos of workers you add to a team. See section 4.
- Payment details — if you buy a plan, your plan, order and payment status via Razorpay. We never see your card or bank details.
- Usage and attribution data — which features you use and how often, and which link or campaign brought you here, to run and improve the product.
- Sign-in and security logs — sign-in attempts, IP addresses and device information, to keep accounts safe.
3. Consent, and how to withdraw it
The first message you send Paisa on WhatsApp after the welcome (which links to this notice), the box you tick when creating an account on the dashboard, and continuing past the sign-in screen of the app, are your agreement to the processing described here for the purposes above — and your confirmation that you are 18 or older. We record when and how you agreed, and which version of this notice was current.
You can withdraw at any time. Deleting your data ends all processing: open Settings → Danger Zone on the dashboard, or send /deletemydata on WhatsApp for the link. Clear My Data removes your records and keeps the account; Delete Account removes everything (section 7). Sending stop on WhatsApp turns off tips, nudges and digests; replies to your own messages and alerts you have set up continue.
4. Shared spaces and other people's data
In a shared event, family space or team, members see the records of that space, and the assistant uses the space's activity to answer members' questions. Your personal records are never visible to anyone else.
If you add other people — invitees, workers, vendors — you are responsible for having their permission to record their details. An invitee is only messaged once, at your request, and nothing about them is stored beyond a hashed phone number until they accept. Workers added to a team do not get an account; their employer controls their records and can delete them.
5. Service providers we share data with
We never sell your data. We share it only with the providers below, each under contract, each receiving only what its job needs.
- Meta (WhatsApp Business Platform) — carries the conversation. Sees your phone number and every message either way. Global.
- Google Cloud — hosts the service and stores all records and files, in the Mumbai (asia-south1) region, encrypted at rest and in transit.
- Google Gemini via Vertex AI — reads your messages, photos, documents and voice notes to understand them, and the recent conversation and what the assistant remembers, to reply. Under Google Cloud's terms this data is not used to train Google's models. Main processing runs in the Mumbai region; a smaller model used to extract what to remember runs on Google's global endpoint and may process outside India.
- Razorpay — takes payments for paid plans. Sees your plan and an account identifier; your phone or email only if you ask for payment notifications. India.
- Resend — delivers email: one-time codes for email sign-in, and the message you send us through the feedback form (with the name and contact you give). United States.
- PostHog — product analytics. Receives events keyed to a random account identifier, never your phone number or name: which features were used, and for money events the amount, but never descriptions, vendor names or message text. United States.
- Langfuse — AI quality monitoring. Receives each exchange with the assistant after phone numbers, IDs, card and UPI details are masked, keyed to a hashed session identifier, so we can find and fix wrong answers. United States. Deleted when you delete your account.
- Sentry — error monitoring. Receives error reports with message text, phone numbers and request data stripped, keyed to a pseudonymous identifier.
Your records themselves stay in India. Where a provider above is outside India, the transfer is made under that provider's data-protection terms and Indian law.
6. Files you send
Photos and documents you send on WhatsApp or upload on the dashboard are kept in a private store in India, attached to the record they belong to, so you can open them later. They are visible to you and, in a shared space, to its members. They are kept for as long as your plan's document retention allows (one to two years depending on the plan, longer on paid team plans) or until you delete the record, the space or your data. Voice notes are not kept.
7. How long we keep things, and deletion
- Chat messages: stored encrypted and deleted after 90 days. A short encrypted summary of the conversation, and the facts the assistant remembers, are kept while your account exists; facts it only inferred expire after 180 days.
- Records (expenses, events, trackers and so on): kept while your account exists.
- Files: see section 6.
- Activity and security logs: one year, as the DPDP rules require for logs that would let a breach be detected.
- Clear My Data: your personal records, files, memory and messages are removed immediately; the account stays.
- Delete Account: your account is closed at once and everything is permanently erased 30 days later (the window exists so a mistaken deletion can be undone by contacting support). Records you contributed to events you do not own are detached from your identity rather than deleted from the owner's books. Invoices for paid plans are kept in anonymised form as tax law requires. A hashed record that a deletion happened is kept as proof.
8. Access by our staff
A small number of authorised people can see account metadata — name, plan, sign-up date, last activity, a masked phone number (+9198••••••10), and aggregate counts of records, messages and AI usage — to support you, investigate abuse, fix faults and manage cost. They do not read your messages, records or vendor details for analytics.
A full phone number is shown only when a written business reason is given, and every such reveal is written to an audit log with the time, the IP address and the reason. If the log cannot be written, the number is not shown.
9. Messages we send you
Besides replying to you, Paisa sends alerts you set up (budget limits, EMI and event reminders), summaries of your own records, and — unless you turn them off — tips, nudges and weekly digests. Digests may include a product suggestion picked from your spending, for which we may earn a referral fee; switch this off under Settings → Recommendations. Send stop on WhatsApp to turn off all promotional and engagement messages, or start to turn them back on.
10. Your rights
You can:
- See and correct your records on the dashboard or in chat; edit your name and language in Settings; tell the assistant to forget a remembered fact.
- Take copies: expenses as CSV and each event as Excel from the dashboard. For a copy of everything we hold about you, write to the grievance officer below.
- Delete everything (section 7).
- Nominate someone to exercise these rights for you if you are unable to, by writing to the grievance officer.
- Complain to us (section 13) and, if we do not resolve it, to the Data Protection Board of India.
11. Children
Paisa is for people aged 18 and over. We do not knowingly process a child's data. If you believe a person under 18 is using Paisa, write to the grievance officer and we will delete the account.
12. Security
Data is encrypted in transit and at rest. Chat messages, the assistant's memory and phone numbers are additionally encrypted at the application level. Sign-in codes are stored only as keyed hashes and expire in five minutes. Access to production systems is limited and logged. If a breach affects your data we will tell you and the Data Protection Board as the law requires.
13. Grievance officer
Grievance Officer, Paisa Agent Technologies Private Limited — support@paisaagent.ai. We acknowledge within 24 hours and aim to resolve within 30 days.
14. Changes
When this notice changes in a way that matters to you, we will tell you on WhatsApp or the dashboard before the change takes effect. The date at the top is the current version.