Legal

Terms of Service

Effective date: 27 October 2026
They apply to the FinLens connection flow — the pages you pass through after a business sends you a FinLens link — and to this website.

FinLens lists the emails in your mailbox that are likely to carry your financial documents, with the text of each, for the one business you approved, and collects the files that business asks for. These are the terms on which it does that, what we cannot promise, and how to stop it.

contents

Accepting these terms
What FinLens does
What FinLens is not
Your age
Your permission, and how to withdraw it
Once files are delivered
What we cannot promise
What comes with each file
Acceptable use
Who owns what
Limitation of liability
Indemnity
Stopping a request
Businesses that integrate FinLens
Governing law & jurisdiction
Changes to these terms
Contact, grievances & your rights

1. Accepting these terms

FinLens is a product of Value Garage Private Limited (CIN U66190DL2025PTC453505), a company incorporated in India with its registered office at Flat no. 26, Vandana Apartment, East Delhi, Delhi — 110092 ("FinLens", "we", "us"). These terms are an agreement between you — the person whose mailbox is read — and us.

They cover the FinLens connection flow: the link a business sends you, the Google sign-in and consent step it leads to, the FinLens page you see if you say no there, the list of your emails and the collection of files after you approve, and every later check and request the business makes while your permission lasts. They also cover this website.

You accept these terms by continuing through that flow. If you do not accept them, close the page or decline on Google's screen. Declining costs you nothing: no mailbox is read, no file is collected and nothing is sent to anyone. While the link is valid, you can change your mind and try again (§5).

FinLens does not charge you anything. There is nothing to buy, subscribe to or cancel. Our commercial relationship is with the business that made the request.

Our Privacy Policy forms part of these terms. It says what we do with your data and how long anything is kept, and carries our Limited Use commitments under the Google API Services User Data Policy. Nothing here reduces a commitment made there.

2. What FinLens does

A business you deal with — a lender, an insurer, a broker or any other company ("the requesting business") — needs financial documents from you. Instead of you finding and uploading them, it asks us to list the emails in your mailbox that are likely to carry them and collect the files it needs, with your permission:

The business asks us for a link to pass to you.
Before giving you the link, the business must show you our standard disclosure in its own app, word for word. It names the business by its registered name as the only recipient, and says which emails we look for, what the list of them contains, what we never open, how long your permission lasts, that the business can ask us for files and to check again, and how to withdraw.
The link takes you straight to Google, whose own screen asks whether you will give FinLens read-only access to your Gmail. We never see your Google password. Approving there is your permission for what the disclosure described, and nothing is fetched until you give it. You then return to the business's app.
When the business asks us for your documents — not before — Gmail's own search runs seven fixed searches in your mailbox, on Google's side, the same for everyone: for emails with a file attached that are likely your financial documents — proofs of identity, loan and property papers, account and investment statements, fixed-deposit advices, card statements, and files you sent to banks, lenders and builders — each over its own period, leaving out Spam, Trash, Drafts and Chats (Privacy Policy §4.3 lists them). We do not check who sent an email. The business receives a list of the emails they find: for each, its date and time, the sender's name, From and To addresses, subject line, the text of the email, whether Gmail confirmed it came from the sender's domain, which emails belong to the same conversation, and the names of its files. The list is usually ready within a few minutes of the business asking. If it never asks, nothing is read.
The business asks for the files it needs from the list, and we fetch only those, exactly as they were sent: we open no locked file and ask for no identity details. We do not read what is inside any file. Each part of a list, and each delivery, can be collected for 3 hours after it is ready. We then permanently delete what we hold of them.
Your permission lasts up to six months. During that time the business can ask us for files on its lists, and ask us to check your mailbox again for new email — never more than once an hour. A later check runs the same searches over only email that arrived since the check whose list the business last collected began (or, if it has collected none, over each search's own period), and is listed, delivered and deleted as in steps 4 and 5. You can withdraw at any time (§5).

Be clear about what you are agreeing to. The purpose of FinLens is to give the business that asked a list of the emails our searches find in your mailbox, and then the files it chooses. The text of each email in the list, its subject line, file names, names and addresses — and whatever they say, a password or a one-time code a bank sent you included — and the files and whatever is inside them reach that one named company because that is the service you asked for, and nobody else. The searches aim at financial email, but match words, not meaning, so some personal email may be listed too.

3. What FinLens is not

No FinLens account.

You do not sign up, and there is no login, dashboard or settings page. Lists and delivered files are deleted within three hours. While your permission lasts we hold the encrypted access credential behind it, and a record of what was done.

Access lasts up to six months, for what you approved only.

Your permission lets the one business named in the disclosure ask us for files on its lists, and to check again for new email, for up to six months. We look only when it asks; checks run one at a time and at least an hour apart. We do not watch your mailbox. A different business needs a new link and a new approval.

Read-only.

We cannot send, reply to, modify, delete or label your email, and never ask to.

Gmail only.

No other mailbox provider is supported.

We do not assess you.

FinLens produces no score, rating, opinion, recommendation or advice about you, and takes no decision about you. What the requesting business does with your files is a matter between you and that business, under its own rules and regulator.

4. Your age

You must be 18 or older, and legally able to enter into this agreement. We do not ask your age and nothing in the connection flow checks it; we rely on the requesting business having established who its customer is. If you believe a request concerns someone under 18, tell us (§17) and we will refuse it and destroy anything we hold.

5. Your permission, and how to withdraw it

You give your permission once, on Google's consent screen, after the business has shown you our standard disclosure. It allows FinLens to read your Gmail, read-only, to list the emails the disclosure describes for that one business, and to fetch the files it asks for and hand them to it — when it first asks for your documents, and at the later checks and requests it makes during the term, up to six months.

If you decline, nothing is fetched, and any access given on that link is handed back to Google. You are then offered two equal choices: try again, or return to the business. Trying again asks Google's question afresh, and nothing is shared until you approve. The link expires 60 minutes after the business created it; after that, ask the business for a new one.

You can withdraw at any time, in any of three ways:

Where	How to withdraw
In the business's app	The business must give you a way to withdraw in its app and tell us at once when you use it. We then revoke our access at Google and delete our copy; any list or files we still hold for it are deleted at once, no further check or request runs, and nothing more can be collected.
At Google	Remove FinLens at myaccount.google.com/permissions. This takes effect at Google immediately and does not depend on us, so nothing more can be read. When we learn of it — at the business's next check or request, or when your permission's term ends, whichever is first — we delete our copy and any list or files we still hold for it, and nothing more can be collected.
Through us	Write to our grievance officer (§17) and name the business. We then revoke our access at Google and delete our copy; any list or files we still hold for it are deleted at once, no further check or request runs, and nothing more can be collected.

Withdrawing is as easy as giving permission. You do not need a reason or a FinLens account. Delete your data sets out each route step by step.

What withdrawal does. It stops everything that has not yet happened, including every later check and request. Any list or files the business has not yet collected are deleted at once, and it then cannot collect them; we revoke and delete the access credential. It cannot recall lists or files already delivered (§6). Because our copy of each list and each delivery lasts at most three hours, what withdrawal mainly ends is your permission and the access credential behind it — which also end on their own after six months.

6. Once files are delivered

We cannot get them back. Once the list of your emails, your files, and the details delivered with them, reach the requesting business, it holds its own copy under its terms, privacy policy and retention rules — not ours. Our copy is deleted within three hours, but that does not delete theirs, and we cannot recall, retrieve, alter or delete a file once it has left us. To have their copy deleted, or to ask what they did with it, ask that business directly.

This is why the business must show you our disclosure, naming it, before you approve anything.

7. What we cannot promise

FinLens is provided as is. We do not promise that any particular file exists in your mailbox, will be found, or can be opened, for these reasons:

We only list the email our fixed searches find, and never email in Spam, Trash, Drafts or Chats. A document whose email matches none of the searches is not listed. A link to a portal instead of an attachment, a picture embedded in an email, such as a logo or a signature image, or a file larger than 25 MB (26,214,400 bytes), is not listed, and an email you delete from Gmail after it is listed can no longer be collected.
We open no locked file. A password-protected file is delivered still protected, and we do not ask for your details to open it.
We do not read what is inside a file, and we do not check who sent an email. We cannot tell whether a file is genuine, complete, legible or safe to open. Where the list says Gmail confirmed an email came from the sender's domain, that is Gmail's record, not our check.

We make no promise about availability: there is no service level, no uptime commitment and no guaranteed completion time, and we hold no security certification (see our Trust page). To the fullest extent permitted by law, we exclude implied warranties of merchantability, fitness for a particular purpose and non-infringement.

8. What comes with each file

We read nothing inside your files. With each one we deliver a few facts taken from the headers of the email that carried it: whether you received or sent it, its date, the address it was sent from, and the file's name and type. None of this is analysis or opinion, and no person checks it.

Those facts can be wrong — a file's declared type most of all. So:

The file governs. Where a fact delivered with a file and the file disagree, the file is correct. It is the file exactly as it was sent.
We do not verify a file's contents, or who sent the email that carried it. We make no representation that a file is genuine, complete, up to date or safe to open.
If something delivered about you is wrong, tell the requesting business, which holds the copy that matters, and tell us at privacy@finlenstech.com.

9. Acceptable use

Use FinLens only for a mailbox you control, and only for a request genuinely made of you. You agree not to:

Use FinLens for a mailbox that is not yours, even with the owner's password or their say-so. The permission we act on must come from the account holder.
Misrepresent your identity, or complete a flow created for somebody else.
Use the service for an unlawful purpose, or to obtain documents you are not entitled to.
Interfere with the service — probing, scanning, overloading, getting round a security control, or trying to reach another user's or business's data.
Copy, scrape, resell or reverse engineer the service or this website, or use automated means to interact with the connection flow.

This does not cover security researchers acting in good faith within the scope on our Trust page. Write to security@finlenstech.com first, and never test against a real person's mailbox.

10. Who owns what

Yours stays yours. Your email and files belong to you. We acquire no rights in them beyond listing, collecting and delivering them under the permission you gave. We do not license them onward, and we do not keep them.

Ours stays ours. The FinLens software, the connection flow, this website and the FinLens and Value Garage names and marks are ours or licensed to us. These terms let you use the connection flow for its purpose only; no other licence is granted by implication.

11. Limitation of liability

To the extent permitted by law, and subject to the next paragraph:

Our liability to you is limited to direct loss. We are not liable for indirect, incidental, special or consequential loss, or for loss of profit, revenue, business, goodwill or anticipated savings, arising out of or in connection with your use of FinLens.
We are not liable for what the requesting business does with files you approved sending to it, for its decisions, or for its handling, retention or disclosure of them (§6).
We are not liable for a file that could not be found or opened (§7), or for an error in a fact delivered with a file where the file itself was delivered (§8).

Nothing in these terms limits or excludes any liability that cannot be limited or excluded under Indian law — including liability for fraud or fraudulent misrepresentation, for death or personal injury caused by negligence, and any liability under the Digital Personal Data Protection Act, 2023 or consumer protection law. Where a mandatory statutory right applies to you, these terms give way to it.

12. Indemnity

You agree to indemnify us against claims, losses and reasonable costs arising from your use of FinLens in breach of §9 — in particular from connecting a mailbox you do not control, or completing a flow created for another person. This does not extend to anything arising from our own breach, negligence or unlawful act.

13. Stopping a request

You can end it at any time. Decline on Google's screen, withdraw in the business's app or through our grievance officer (§17), remove FinLens at myaccount.google.com/permissions, or let the link expire. No notice is needed and nothing is owed.
We can refuse or stop a request where we reasonably suspect a breach of §9; where it appears to concern a person who did not authorise it or who is under 18; where the law requires it; or where a technical failure prevents us completing it safely. We then destroy what we hold, and the business is told the request did not complete.
Everything ends on its own. Your permission ends six months after you give it, if nothing ends it sooner, and we then revoke our access at Google and delete our copy. Lists and delivered files are deleted within three hours, or at once when your permission ends. Sections 6, 7, 8, 10, 11, 12, 15 and this sentence survive.

14. Businesses that integrate FinLens

These terms are for the person whose mailbox is read. They are not the terms on which a business uses FinLens. A business contracts with Value Garage Private Limited separately, under the Partner Terms. Nothing on this page governs that relationship or gives a business any right under it. If you are evaluating FinLens for a business, read the Partner Terms and write to partners@finlenstech.com.

15. Governing law & jurisdiction

These terms are governed by the laws of India. The courts at Delhi have exclusive jurisdiction over any dispute arising out of or in connection with them. This does not take away any right you have under consumer protection law to bring a complaint before a consumer commission or other forum where you live or work, or any step that law requires before a court is approached.

If you have a complaint, raise it with us first (§17).

16. Changes to these terms

We may update these terms. A revised version is posted here with a new effective date, and the version in force when you give your permission governs it, and every check made under it. A change to what you are asked to agree to applies only to permission given after it — never a silent widening of one you already gave. The current version of the disclosure the business shows you is published at finlenstech.com/consent-disclosure.

17. Contact, grievances & your rights

General and privacy questions: privacy@finlenstech.com
Grievance officer (DPDP): Suraj Agarwalla — privacy@finlenstech.com
Security reports: security@finlenstech.com
Business enquiries: partners@finlenstech.com

Your rights under the DPDP Act

India's Digital Personal Data Protection Act, 2023 lets you:

ask what we hold about you and what we did with it;
ask us to correct what we hold about you;
ask us to destroy what we hold;
raise a grievance with the officer named above;
nominate someone to exercise these rights for you.

Privacy Policy §12 sets these out in full, and Delete your data is the step-by-step route for erasure. Two limits: we keep lists and files for hours, so an access request usually finds none left — while your permission lasts, we hold the encrypted access credential; and lists and files already delivered must be requested from the business (§6).

If a grievance is not resolved, you can complain to the Data Protection Board of India, whatever we say here.

Value Garage Private Limited · CIN U66190DL2025PTC453505
Registered office: Flat no. 26, Vandana Apartment, East Delhi, Delhi, India — 110092