Legal

Privacy Policy

Effective date: 27 October 2026
Applies to the FinLens connection flow, the FinLens API used by the businesses we work with, and this website.

FinLens finds the emails in your Gmail that are likely to carry your financial documents, lists them for one business with the text of each, and collects the files that business then asks for, without opening them. This policy says what we take, why, who receives it, how long it is kept, and how to end it.

1. Who we are

FinLens is a product of Value Garage Private Limited (CIN U66190DL2025PTC453505), a company incorporated in India with its registered office at Flat no. 26, Vandana Apartment, East Delhi, Delhi — 110092 ("FinLens", "we", "us").

A business you deal with — a lender, an insurer, a broker, or any other company — asks you for financial documents. This policy calls it the requesting business. Instead of finding and uploading the documents yourself, you give FinLens permission to list the emails in your Gmail that are likely to carry your financial documents, with the text of each, for that business, and to fetch the files it then chooses and hand them to it.

We decide how your mailbox is read, what the list carries, what is fetched and delivered, and how long anything is kept, and you give your permission to us (§8). What the requesting business does with the list and the files after delivery is governed by its own privacy policy, not this one (§12).

2. Google user data & Limited Use

2.1 The scopes we ask for, and why

We request read-only access to your Gmail, through Google's own consent screen. If the business you use offers sending, we also ask for permission to send email you approve. We ask for nothing else. Access is refused if read-only access is not granted. Sending is optional.

2.2 Why nothing narrower works

• gmail.metadata cannot read attachments or the text of an email, and cannot search mail, which our fixed searches need. It would show that a message has a file attached, but never the file itself.
• The Gmail add-on scopes work only on a message you have open in Gmail. FinLens has no Gmail interface, and its checks run on our servers, including later checks when nobody is at a browser.
• gmail.modify and full mailbox access are wider, not narrower. We never need to write to your mailbox.

gmail.readonly is the narrowest scope that can return an attachment. gmail.send is the narrowest that can send an email: gmail.compose, gmail.modify and full mailbox access would also let us read or change drafts or mail, which we never need.

2.3 What happens to the data, including the transfer

• Use. Gmail data is used for one purpose: to find and list the emails in scope for the named business — when it first asks for your documents, and at the later checks it asks for while your permission lasts — and to fetch the files the business asks for and deliver them. The text of each email is only turned into plain text and passed on: we do not look for anything in it, analyse it or keep it for any other use. We do not open or read what is inside the files.
• Transfer. The list and your files go only to that one business, with your approval and for that purpose, or where necessary for security or to comply with law. No service provider of ours receives Gmail data, or anything derived from it.
• Never for any of the uses listed in §7.
• No people, and no AI. No person at FinLens reads your Gmail data. No third party processes it on our behalf, and no AI model receives any of it.

3. How FinLens works

Your permission lasts up to six months. During that time the business you approved can ask us for any of the files on its lists, and can ask us to check your Gmail again for new email. A later check runs the same searches over only email that arrived since the check whose list the business last collected began, and is listed, delivered and deleted as in steps 4 to 6. We never look on our own, never run two checks at once, and never check more than once an hour. If the business never asks, we read nothing at all, and still hold our access, encrypted, until your permission ends (§4.2). When your permission ends — at six months, or sooner if it is withdrawn (§8) — we revoke our access at Google and delete our copy, any list or files the business has not yet collected are deleted at once, and the business can fetch or collect nothing more.

4. Data we handle

4.1 No identity details

We do not accept your name, PAN, date of birth, mobile number or any other identity detail, from the business or from you, and we try no password. A password-protected file is delivered still protected. Until 17 October 2026 the business could send those details for us to open protected PDFs; that has ended, and none are held.

4.2 Your Google account

When you approve on Google's screen we receive one thing: a read-only Gmail access credential. Google does not send us your account's email address or identifier with it. (Your address does appear in the From and To lines of the emails we list; see §4.3.) The credential is held encrypted (§10) for the term of your permission — at most six months, or twelve months for a permission given before this policy's effective date — so that the business can ask for its list, and for later checks, when it needs them; we hold it whether or not the business has asked for anything. It ends at the first of these:

• the term runs out;
• you or the business withdraw (§8);
• Google stops accepting it — because you removed FinLens at Google, it went unused for six months, or you changed your Google password. We learn of this the next time the business asks for a check;
• a fault stopped us recording your approval: it then ends one hour after you approved at Google.

Each time, we revoke it at Google, so FinLens no longer appears among the apps with access to your account, and destroy our copy — even if Google cannot be reached at that moment. You can also remove the access yourself at any time (§8).

4.3 What we read from your mailbox

For the list, Gmail's own search picks the emails, on Google's side: we run seven fixed searches, the same for every person and every business, and read only the emails they find. Each looks for emails with a file attached that are likely to be one kind of financial document:

All but the investment-statement and fixed-deposit searches look only at email with a PDF, JPEG, PNG, ZIP or Word file attached, and leave out calendar invitations and a fixed list of routine mail: brokers' and exchanges' daily reports and contract notes, food delivery, travel and ride bookings, payment services, invoices, tickets, invitations, webinars, newsletters and one-time codes. The searches match words in the subject, file names, senders' and recipients' addresses, and dates; they do not understand meaning, so a list can include an email that is not a financial document, and miss one that is. They have no cap: every email a search finds is listed, and an email found by more than one is listed once. The words, file names and addresses are kept in our own code and are the same for everyone: no business and no person can change what is searched for in your mailbox.

We never read email in Spam, Trash, Drafts or Chats, or any email the searches do not find (§4.7). A picture embedded in an email, such as a logo or a signature image, is not a file for this purpose, and neither is a file larger than 25 MB (26,214,400 bytes), which is too large for us to fetch; an email with no other file is not listed.

We read nothing when you approve: the first check runs only when the business asks for your documents. The list is usually ready within a few minutes of its asking: we read about a hundred emails a minute, as fast as Gmail allows for one mailbox, and the searches usually find a few hundred. It is made and delivered in parts of up to 500 emails, each encrypted as it is made, and the business can ask for files from the parts it has while the rest are still arriving. Each part can be collected for 3 hours after it is ready, and is then deleted (§9.1).

We do not check who sent an email. An email that matches a search is listed whoever sent it, so a list can include mail that only claims to come from a bank or anyone else, and files that are not safe to open. For email you received, the list says whether Gmail confirmed, when it delivered the email, that it came from the sender's domain (Gmail's own DKIM, SPF and DMARC results); that is Gmail's record, passed on as it is, not a check of ours. Our terms require the business to scan every file it fetches for malware.

For each message the searches find, Gmail sends us its headers, its text and the list of its files. From them we use only its date and time; its sender's name and its From and To addresses; its subject line; its text — the plain-text version the sender included, or, where there is only a formatted version, that version turned into plain text on our own systems, with its links kept, up to 100,000 characters; Gmail's results on the sender, for email you received; the conversation it belongs to, which we pass on only as a reference of our own, meaningless outside your permission; and the name, type and size of each file, with how each file is marked as attached or embedded. The other headers, including who was copied on the email, pass through memory while the message is read and are never kept, logged or passed on; the email's own text, passed on as its sender wrote it, may still name them, for example in a reply or a forwarded message. We fetch a file only when the business asks for it, and we do not open or read what is inside it.

The text of an email is passed on as its sender wrote it. We do not read it for meaning, look for anything in it or remove anything from it. Emails from banks and lenders sometimes give, in their text, the password of an attached file or the rule for making one, a one-time code or an account number; when an email the searches find does, the business receives it. Our terms require the business to protect the text as personal data, never to log it, and to use it only for your own documents (§5.1).

A permission you gave on version 4 or 5 of the disclosure, before this policy's effective date, continues under this section's searches: each later check covers the email that arrived since the last list the business collected was made, or, if it collected none, each search's own period; and its lists carry none of the email's text, the sender's name, Gmail's results or the conversation (§15).

4.4 What we deliver: the list, then the files

Why a list first. So that the business collects only the files it needs, rather than every file we can find. We fetch a file from your Gmail only when the business asks for that file.

Nothing is read from your files: no text is taken out of them and no scanned page or image is read. No outside service or vendor receives them, no AI model reads them, and no person reads them.

4.5 Records we keep of what we did

We keep an append-only, tamper-evident log of each request: that consent was granted or refused (each refusal numbered), that access was sealed and later destroyed, that a check started, finished or failed, that files were delivered, and that your permission ended, and why. Each entry is chained to the one before it, so a deletion or alteration can be detected.

These entries contain no email or file content. Most hold only event names, timestamps, counts and outcome codes. The entry recording your approval also holds what was agreed — the business that receives your files, how long your permission lasts and the version of the disclosure you were shown, and, for permission given before 17 October 2026, the document types and any institution the business named — against a pseudonymous reference, never your name or email address. We also keep, for each request, the business's own reference for you, the request's status and times, and counts of what was found and delivered. The system drops any field that would carry mail content rather than relying on itself not to write one.

4.6 Website, technical and business data

The connection flow collects only the technical data needed to run securely: a session identifier and basic security signals. This website has no cross-site tracking and no third-party analytics or trackers.

For each business we work with, we keep its registered name, its API credentials (stored encrypted or as one-way digests), its notification address, and a count of the checks completed for it, which is what we would bill from. This is data about the business, not about you.

4.7 No other email is read, and no AI

We read no email in your mailbox that the searches in §4.3 do not find, and of the emails they find we use nothing beyond what §4.3 lists: their text is only turned into plain text and passed on, never analysed, and their other headers, including who was copied on them, are never kept or passed on (their text may still name them, §4.3). Until 17 October 2026 we also read the From, To and Cc lines of other email you received with a PDF attached, to find financial institutions we had not verified, kept organisation domain names from them, and could send some of those names to an AI model's provider in the United States (§15). That has ended:

• no AI model, ours or anyone's, receives anything from FinLens;
• the encrypted list of domains kept for each permission is destroyed;
• the shared counts of domains, and the labels kept with them, are deleted, and the last copies in our backups go with those backups, within eight days (§9.1);
• nothing of your data leaves India (§11).

4.8 Email you send through a business

Some businesses let you send an email from your own Gmail through FinLens, for example to ask a company you choose for a quote, with one of your documents attached.

• You decide. You allow sending on Google's screen when you connect, and you can leave it unticked. Before each email, the business shows you who it goes to, the message and any attachment, and it is sent only when you tap Send. Nothing is sent automatically or in bulk.
• What is sent. One email, from your Gmail address, to the one recipient you chose. The attachment, if any, is one of your own documents from your Gmail. Replies come to your own inbox. FinLens and the business do not receive them.
• What we keep. No copy once it is sent. Until then the message is held encrypted, for at most 10 minutes, and the attachment is read from your Gmail only at the moment of sending and never stored. Afterwards we keep only a record that an email was sent, when, and to which domain (for example example.com, never the full address) (§9.1).
• What the business learns. Only that the email was sent, and when.
• Stopping. Tell the business you no longer want to send, or withdraw your permission as in §8.

5. Who receives the list and your files

5.1 The business you approved

One business receives the list of your emails and your files: the one named as their only recipient in the disclosure it showed you before you approved, including the lists and files from every later check and request while your permission lasts. It receives what §4.4 describes, and must collect each part of a list, and each delivery, within three hours. It never receives your Google credential, access to your mailbox, who was copied on an email (except where the email's own text names them), or any part of an email but those §4.4 lists.

Addresses and names. The list gives each email's From and To addresses, and the name the sender gave, whoever they belong to. On email you received, the From address is the sender's — a bank, a lender, a builder or anyone else — and the To addresses are usually yours, with anyone else it was addressed to. On email you sent, the From address is yours and the To addresses are the people and organisations you wrote to, such as a bank or a builder. So the business receives the names and addresses of people other than you.

The text of each email, its subject line and its file names are passed on exactly as they are, so whatever they say — a password or a one-time code a bank sent you, part of an account number, a name, something about your personal life, or the words of someone who wrote to you — reaches the business. The searches aim at financial email, but they match words, not meaning, so some personal email may be listed too.

Once delivered, the business holds its copy under its own privacy policy and retention rules. Our terms with it let it use the list only to choose files for the service it described to you, require it to protect each email's text as personal data, never to log it, and to use it only for your own documents, require it to delete the list when your permission ends, and require it to scan every file it fetches for malware. Deleting our copy does not delete theirs; to have theirs deleted, ask them.

5.2 Service providers

Two infrastructure providers run the platform for us, both in India: DigitalOcean, which hosts our server in Bangalore, and Google Cloud in Mumbai, where Google Cloud KMS holds our master encryption key (§10) and Google Cloud Storage holds our encrypted nightly backups of the database (§9.1). Neither Google service ever receives a list or a file. Cloudflare runs the DNS for our domain: it answers lookups of our host names and carries none of the service's traffic or data. The current list of providers is on our Trust page, and a new provider is listed there before it touches any data. The lists and your files are handled only on our own systems; no outside document-processing vendor, AI service or other service receives them.

5.3 Legal requirements

We disclose data where a law, a regulation or valid legal process requires it, after checking the demand's validity and scope. Where lawful, we tell you.

5.4 No other sharing

There is no other sharing. We have no data-broker relationships and no data feeds to anyone.

6. What we use data for

Three purposes, and no others:

• Fulfilling the request you approved: finding and listing the emails our searches select, with their text, for the business — when it first asks for your documents, and at each later check it asks for while your permission lasts — fetching the files it asks for, and delivering them to that business.
• Security and integrity: detecting abuse, and keeping the tamper-evident record in §4.5.
• Legal compliance: meeting our obligations under applicable law.

To run and improve the product we use only counts that hold no email or file content — how many emails a check listed, how many each search found, and how many files a request delivered — kept with each request's record (§4.5).

7. What we never do

• We never use your data for any purpose other than those in §6.
• We never sell your data, and never share the list of your emails or your files with anyone other than the one business named in the disclosure you were shown, except as §5.3 requires.
• We never read email in Spam, Trash, Drafts or Chats, or any email our fixed searches do not find (§4.7).
• We never look in your mailbox on our own. A check, or a fetch of a file, happens only when the business you approved asks for it, while your permission lasts; checks run one at a time and never more than once an hour.
• We never send an email you have not seen and approved, and we cannot modify, delete or label your email.
• We never give the business your Google credential, access to your mailbox, or who was copied on an email, except where the email's own text names them.
• We never ask for your identity details, never try a password, and never open a locked file.
• No person at FinLens reads your email or your files, our software does not open or read what is inside your files or look for anything in the text of your emails, and no AI model is used. The systems that handle them can connect only to Google and to the notification addresses of the businesses we work with.

8. Your permission, and withdrawing it

You give your permission once, in two steps:

1. In the business's app. Before giving you the link, the business shows you our standard disclosure, word for word. It names FinLens, names the business as the only recipient, says which emails we look for, what the list of them contains and what we never open, how long your permission lasts, that the business can ask us for files and to check again, and how to withdraw. You are not asked to agree to anything there; you decide whether to open the link.
2. At Google. Google's screen asks whether you will give FinLens read-only access to your Gmail. Approving there is your permission for what the disclosure described, for up to six months. You then go straight back to the business's app; there is no FinLens page in between.

If you say no, and then change your mind

If you say no on Google's screen, or leave the Gmail box unticked, nothing is fetched. Any access given on that link is handed back to Google and destroyed, and you see a FinLens page that names the business, says nothing was shared and what we would read, and offers two equal choices: try again or return to the business. Trying again asks Google's question afresh. You can do this on the same link until it expires, 60 minutes after the business created it; a refusal does not extend that. The business is told each time you say no, and how, but not why — we are not told why either. Each refusal is recorded (§4.5).

Withdrawing

You can withdraw at any time, in any of three ways, none of which needs a FinLens account. Withdrawing is as easy as giving permission. Withdrawing also ends sending, if you allowed it.

9. How long we keep things, and deletion

9.1 What is kept, and for how long

Deletion is verified, not assumed: a sweep runs on a schedule, not on request, and writes a completion record for every purge. You can ask us for a deletion receipt.

9.2 How to have your data deleted

1. Remove FinLens's access at Google at myaccount.google.com/permissions. This takes effect immediately and does not wait on us.
2. Write to privacy@finlenstech.com with the subject Delete my data, naming the business that asked you for documents. That also ends your permission: we revoke our access at Google and delete our copy, any list or files we still hold for it are deleted at once, and no further check or request runs. We confirm in writing what was held and what was destroyed.

The full route, including what a deletion request cannot reach and what survives it, is on Delete your data.

10. How your data is protected

• Encryption. Gmail credentials, the lists, stored files and the details kept with each are encrypted with AES-256-GCM envelope encryption under per-record keys, each bound to its own record so it cannot be replayed into another. The references in a list are encrypted under a key that belongs to your permission alone, held the same way and destroyed when your permission ends. The master key is held by a managed key service operated by Google in India, not by the application, and our services refuse to start in production without it. Our nightly database backup is encrypted the same way, as a whole, before it leaves our server, and the account our server stores it with can add a backup but cannot read or delete one.
• Separation between businesses. Each business is isolated from every other in the database itself, not only in application code.
• The systems that handle your files cannot be reached from outside. They accept no inbound network connections and take work from a queue. Files are handled in memory and never written to disk in readable form; the lists and the files we deliver are stored encrypted until deleted.
• Logs cannot carry content. The logger drops any field that would carry mail content — the text of an email among it — or credentials.
• Authenticated requests. A business's long-lived API key signs only its request for a short-lived access token, which authenticates everything else. Our notifications to businesses are signed. Credentials held for verification are stored encrypted or as one-way digests.
• Assessment. The platform is designed against OWASP ASVS Level 2. As a Google restricted-scope application, FinLens is subject to independent security assessment: it passed Google's CASA assessment at AL1, by TAC Security, on 16 September 2026. That is an assessment, not a certification.

11. Where your data is

Your data is stored and processed in India: our server is in Bangalore, and our key service and our backups are in Mumbai (§5.2). Nothing is transferred outside India in the ordinary operation of the service; if that changes, this policy will be updated before it does.

12. Your rights under Indian law

India's Digital Personal Data Protection Act, 2023 ("DPDP Act") governs this processing.

12.1 Who is answerable for what

Value Garage Private Limited is a data fiduciary for the processing in this policy, and processes your data on the basis of the consent you give as described in §8. The requesting business is a separate data fiduciary for what it does with the list and the files after delivery; its own privacy policy governs that.

12.2 What you can ask us for

• Access: what we hold about you and what we did with it. Because lists and files last only hours, the answer is usually the record in §4.5 and, while your permission lasts, the encrypted credential (§9.1).
• Correction: we hold no identity details, and what we list is copied from your email as it is; tell us if anything we hold about you is wrong.
• Erasure: ask us to destroy what we hold, at any time (§9.2); this also ends your permission. Lists and files already delivered must be requested from the business (§5.1).
• Nomination: nominate a person to exercise these rights for you in case of death or incapacity.

Write to us at the address in §16 and we will respond within the time the DPDP Act allows.

12.3 Grievances

Raise a grievance with our grievance officer (§16). If we do not resolve it, you can complain to the Data Protection Board of India, whatever we say here.

13. Children

FinLens is not intended for anyone under 18. Requests come from businesses that must already have established their customer's identity, including age; our terms with them require it. If you believe a request concerns a minor, contact us (§16) and we will refuse it and destroy anything held.

14. If there is a breach

If a breach involves your personal data, you are told without delay. We hold no way of reaching you ourselves — your email address is kept only in the lists we give the business, and with a file it fetches from email you sent, all of which we delete within three hours — so we tell the business you came through at once, so that it can tell you without delay. The notice describes what happened, the data involved, the likely consequences for you, what we are doing, what you can do to protect yourself, and a named person who can answer questions.

We notify the Data Protection Board of India with an initial description without delay and full details within 72 hours of becoming aware, and notify the affected businesses at the same time. We follow this now, although the rules that require it take effect only in May 2027.

15. Changes to this policy

We post any change here with a new effective date. A change to what you are asked to agree to applies only to permission given after it, once the business has shown you the disclosure that describes it — never as a silent widening of a permission you already gave.

What changed on this policy's effective date, with versions 8 and 9 of the standard disclosure:

• Your permission now lasts up to six months from the day you give it, where it lasted up to twelve, and our encrypted access to your Gmail is kept no longer than that (§3, §9).
• We no longer look in your Gmail when you approve. We look only when the business asks for your documents, and the list is usually ready within a few minutes of its asking; until it asks, we read nothing, and we hold our access, encrypted, until your permission ends, as before (§3, §4.2, §4.3).
• Nothing else changes in what we read, deliver or keep.

Permission given before that date, on version 6 or 7 of the disclosure, continues for the twelve months it was given for, unless it is ended sooner; its first list was made when it was given, and each later check runs only when the business asks, as before.

Sending (21 October 2026). Some businesses can now let you send an email you approve from your own Gmail through FinLens (§4.8), shown with version 7 of the standard disclosure. We ask for this only where the business offers it, and you can decline it and still share documents. Nothing changes for a business that does not offer sending, or for any permission already given.

What changed on 20 October 2026, with version 6 of the standard disclosure:

• The list no longer covers every email with a file attached across your whole Gmail history. It covers what seven fixed searches find — emails with a file attached that are likely to be financial documents, each search over its own period — run by Gmail's own search and the same for everyone (§4.3). It is usually ready within a few minutes.
• Each email in the list now comes with its text, as its sender wrote it; until then we never asked Gmail for the body of an email (§4.3, §5.1).
• Each email in the list also comes with its sender's name, for email you received whether Gmail confirmed it came from the sender's domain, a reference to its conversation, and which of the searches found it (§4.4).
• Nothing else changes in what we deliver or keep: the three hours, the twelve months, read-only access, India, and no AI.

That version widened what you were asked to agree to — the text of each email above all — so it applies only to permission given on or after 20 October 2026, on version 6 of the disclosure. Permission given before that date on version 4 or 5 continues as it was given: its first list was made as that version described; each later check runs this version's searches over only email that arrived since the check whose list the business last collected began, so it lists fewer emails than that version described; and its lists carry none of the email's text, the sender's name, Gmail's results or the conversation, so nothing reaches the business under it that its version did not describe.

What changed on 18 October 2026, with version 5 of the standard disclosure: the first list no longer stopped at the newest 5,000 emails, and went back through your whole Gmail history; every list arrived in parts as we read your email, and the business could ask for files while the rest was still arriving; and each part could be collected for 3 hours after it was ready, where until then the three hours ran from when the whole list was ready. That version widened what you were asked to agree to, so it applied only to permission given on or after 18 October 2026, on version 5 of the disclosure; permission given before that date on version 4 continued as it was given.

What changed on 17 October 2026, with version 4 of the standard disclosure:

• The list came to cover every email in your Gmail that had a file attached, received and sent, from or to anyone, with files of every type. Until then it covered only email you received from financial institutions we had verified, or sent to them, with a PDF or an image attached, and we checked each received email's signature against the institution.
• The list no longer names an institution or a kind of document, and we no longer check who sent an email. Our terms now require the business to scan every file it fetches for malware (§5.1).
• We no longer open password-protected files, and accept no identity details: every file is delivered exactly as it was sent (§4.1).
• We no longer read other email to find financial institutions, and no longer use an AI model. Anthropic, which could receive organisation domain names to label, receives nothing from us; the lists of domains kept for each permission are destroyed, and the shared counts and labels deleted (§4.7). Everything is stored and processed in India, with no exception (§11).

That version widened what you were asked to agree to, so it applied only to permission given on or after 17 October 2026, on version 4 of the disclosure. Permission given before that date, on version 2 or 3, had been given for a narrower list and could not be widened: it ended that day, its access was handed back to Google, and nothing more is read under it.

The versions before those both took effect on 16 October 2026. The later, with version 3 of the disclosure, added the read to find institutions that version 4 ended, and our encrypted nightly backup of the database, held by Google Cloud Storage in India, which continues (§9.1). The earlier, with version 2, brought in the list: from then, before anything was collected, the business received a list of the emails in scope and chose the documents we then fetched. Permission given on version 1 of the disclosure, which did not describe the list, ended that day.

16. Contact & grievances

Privacy questions · privacy@finlenstech.com
Grievance officer (DPDP) · Suraj Agarwalla — privacy@finlenstech.com
Security reports · security@finlenstech.com

Value Garage Private Limited · CIN U66190DL2025PTC453505
Registered office: Flat no. 26, Vandana Apartment, East Delhi, Delhi, India — 110092