Privacy Policy

Last updated: 22 June 2026

This Privacy Policy explains how Expenlio ("Expenlio", "we", "us" or "our"), a service operated from Gujarat, India, collects, uses, stores, shares and protects your information when you visit expenlio.com, use the Expenlio web application at app.expenlio.com, or otherwise interact with us (together, the "Service"). It also explains your rights under the Digital Personal Data Protection Act, 2023 ("DPDP Act") and other applicable Indian law.

By using the Service, you confirm that you have read and understood this Policy. If you do not agree with it, please do not use the Service.

1. A note on our approach

Expenlio is built on one promise: your financial data is yours. We do not sell your personal data to anyone, we do not connect to your bank or scrape your statements, and we collect the minimum information needed to run the Service.

2. Information we collect

(a) Information you provide

• Account information: your name, email address and a securely hashed password when you sign up.
• Financial data you enter: the accounts, balances, transactions, loans, credit cards, BNPL, budgets, goals, subscriptions and notes that you choose to add. You enter this manually; we never log in to your bank.
• Profile and preferences: settings such as currency, categories and display preferences.
• Support and communications: information you share when you contact us, give feedback or respond to surveys.

(b) Payment information

Paid subscriptions are processed by our third-party payment processor (for example, Razorpay). Your full card or bank details are collected and processed by the payment processor under its own terms and privacy policy. We receive only limited information such as a payment reference, the plan purchased, and whether a payment succeeded. We do not store full card numbers.

(c) Information collected automatically

• Device and log data: IP address (which may be truncated or anonymised), browser type, device information, pages viewed, and timestamps, used for security, diagnostics and to keep the Service reliable.
• Cookies and similar technologies: see section 6.

(d) What we do NOT collect

We do not collect your bank login credentials, and we do not access your bank accounts, statements or card networks. We do not knowingly collect more data than we need.

3. How we use your information and our legal basis

We process your personal data only for lawful purposes, including:

• To provide, operate and maintain the Service, including computing your Financial Health score, affordability checks, projections, insights and reports from the data you enter (performance of our contract with you and your consent).
• To process subscriptions, payments, invoices and renewals (performance of contract and legal obligation).
• To provide customer support and respond to your requests (legitimate use and consent).
• To secure the Service, prevent fraud, abuse and unauthorised access, and to debug and improve reliability (legitimate use and legal obligation).
• To improve and develop features, using aggregated or de-identified data wherever possible (legitimate use).
• To send you essential service communications (for example, security, billing or important changes). We will only send promotional messages where you have not opted out, and you can unsubscribe at any time.
• To comply with applicable law and respond to lawful requests by public authorities.

Where we rely on your consent, you may withdraw it at any time (see section 9). Withdrawing consent does not affect processing carried out before withdrawal.

4. AI features

Some features (such as Ask Expenlio) generate plain-language guidance from your own numbers. These features operate on the data in your account to produce results, and they do not invent figures that cannot be computed from your data. We do not sell your personal financial data, and we do not share it with third parties to train their AI models.

5. How we share information

We do not sell your personal data. We share it only in these limited situations:

• Service providers (processors): trusted vendors who help us run the Service, such as cloud hosting and content delivery, our payment processor, email delivery, and analytics. They may process your data only on our instructions and under confidentiality and data-protection obligations.
• Legal and safety: where required by law, regulation, legal process, or to protect the rights, safety and property of Expenlio, our users or the public.
• Business transfers: in connection with a merger, acquisition, financing or sale of assets, subject to this Policy. We will notify you of any such change in control.
• With your consent: where you direct us to share information (for example, family-shared goals).

We never sell or rent your data to banks, insurers, lenders or advertisers.

6. Cookies and similar technologies

We use strictly necessary cookies and local storage to keep you signed in and to operate the Service. We may use privacy-respecting analytics to understand usage in aggregate. We do not use third-party advertising or cross-site tracking cookies. You can control cookies through your browser settings, though some features may not work without essential cookies.

7. Data retention

We keep your personal data for as long as your account is active and as needed to provide the Service. We may retain certain information for longer where required for legal, accounting, tax, audit or dispute-resolution purposes. When data is no longer required, we delete or anonymise it. You can request deletion at any time (see sections 8 and 9).

8. Security

We use reasonable technical and organisational safeguards designed to protect your data, including encryption of passwords, encryption in transit (HTTPS), access controls and short-lived sessions. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Please keep your password confidential and notify us promptly of any suspected unauthorised use of your account.

9. Your rights

Subject to applicable law (including the DPDP Act), you have the right to:

• Access a summary of the personal data we process about you.
• Correct, complete or update inaccurate or incomplete data.
• Erase your personal data where it is no longer needed.
• Withdraw consent at any time, where processing is based on consent.
• Export the data you have added to the Service.
• Nominate another individual to exercise your rights in the event of death or incapacity.
• Grievance redressal and the right to complain to the Data Protection Board of India.

You can exercise most of these rights directly inside the app, or by emailing us at hello@expenlio.com. We may need to verify your identity before acting on a request.

10. Children

The Service is intended for users aged 18 and above. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, please contact us and we will take steps to delete it.

11. Storage and transfers

We aim to store and process personal data on infrastructure located in or compliant with Indian requirements. Where data is processed outside India by our service providers, we take steps to ensure it receives an adequate level of protection consistent with applicable law.

12. Grievance redressal

In accordance with the DPDP Act and the Information Technology Act, 2000 and the rules made thereunder, if you have any grievance about how your personal data is handled, you may contact our Grievance Officer by email at hello@expenlio.com. We will acknowledge grievances promptly and aim to resolve them within the timelines required by applicable law.

13. Changes to this Policy

We may update this Policy from time to time. We will post the updated version here with a new "Last updated" date, and, where the changes are material, take additional steps to notify you. Your continued use of the Service after changes take effect means you accept the updated Policy.

14. Contact us

Questions about this Policy or your data? Email hello@expenlio.com.