Privacy Policy

What we collect

We only collect what the product needs to work. Everything financial in Sambhaal is typed in by you — we do not connect to your bank, and nothing is imported automatically.

• Account and contact information: your name, email address, phone number (if you give one), and the password hash created by our authentication provider. We never see your password in readable form.
• Financial metadata you enter: institution name, the type of account or policy, a nickname you choose, maturity, renewal and premium dates, nominee status, your own notes, and at most the last four digits of an account or policy number.
• Documents you upload: scans and photographs of statements, policies and identity documents, stored in private file storage.
• Family circle information: who you invited, the email address you invited them at, their role, and whether the invite is pending or accepted.
• Reminders you create, and whether they were marked handled or snoozed.
• Helper call requests: your name, phone number, preferred time and the topic, if you ask for a call back.
• Basic technical logs needed to keep the service running and secure, such as timestamps and error records.

What we never collect

• Bank login IDs or passwords. We have no field for them and no feature that needs them.
• UPI PINs, ATM PINs, card numbers, CVVs or OTPs. Nobody from Sambhaal will ever ask you for these — if someone claiming to be from Sambhaal does, it is fraud.
• Full account or policy numbers. Where you enter a reference, we deliberately store only the last four digits.
• Live balances or transaction feeds. Sambhaal has no connection to any bank, and cannot see or move your money.

Why we hold it

• To show your family a single organised view of what is held where.
• To send reminders before a maturity, renewal or premium date passes.
• To keep your documents available to the people you have chosen to share them with.
• To provide support when you ask for it, and to keep the service secure and working.
• We do not sell, rent or trade your data. We do not use your financial entries or documents for advertising, and we do not share them with advertisers or data brokers.

How family circle sharing works

Sambhaal is built around a family circle. Everything you add belongs to that circle, not to you alone, and every active member of the circle can see it: entries, dates, reminders and uploaded documents.

Sharing is consent-based in both directions. Nobody joins a circle unless an owner or admin invites their email address and they accept it by signing in with that address. Before an invite is sent, we show a confirmation step spelling out exactly what the new person will be able to see.

Roles limit what people can do. Owners can manage members and everything else; admins can add and change entries, documents and reminders; viewers can see but not change anything.

An owner can change a role or remove someone at any time, and access ends immediately when they do.

Our access rules are enforced in the database itself, so one family circle's records cannot be read by another circle.

Service providers

We use a small number of processors to run Sambhaal: cloud hosting and database infrastructure, private file storage, an email delivery service for reminders and invites, and a payment provider for subscriptions. They process data on our instructions only.

Our payment provider handles card and bank details for subscription billing directly. Sambhaal does not store your card number.

How long we keep it, and how to delete it

• We keep your data while your account is active, so your family's records stay available.
• You can delete an individual entry, reminder or document yourself at any time from inside the app.
• You can ask us to delete your account and everything in it by writing to privacy@sambhal.in from your registered email address. We action deletion requests within 30 days and confirm when it is done.
• You can also ask for a copy of your data, or ask us to correct anything that is wrong, at the same address.
• If you are one member of a shared circle, deleting your own account removes you and your personal details; records the circle still relies on remain with the remaining members unless the owner deletes the circle.
• Some records, such as billing invoices, may be retained where law requires it, and backups are cycled out on a rolling schedule.

Security

• Data is encrypted in transit and at rest by our infrastructure providers.
• Documents are stored privately and are served only through short-lived links to signed-in members of the owning circle.
• Access is enforced per family circle at the database level, not only in the interface.
• Because we never hold credentials or move money, a breach of Sambhaal could never be used to empty an account.

Children

Sambhaal is intended for adults. We do not knowingly create accounts for anyone under 18.

Changes to this policy

If we make a material change we will email account owners and update the date at the top of this page before the change takes effect.

Data controller and contact

The data controller for Sambhaal is Sambhaal (contact details to be confirmed on incorporation). For any privacy question, access request, correction or deletion request, write to privacy@sambhal.in. We aim to respond within seven working days.