OnFinance AI Pvt Ltd ("the Company," "we," "us," or "our"), registered at 24 Brigade Road, Bengaluru, Karnataka 560025, India, operates onfinanceai.org and the compliance automation platform accessible through it. We are committed to handling personal information responsibly and in accordance with applicable Indian data protection law, including the Information Technology Act 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011, and the Digital Personal Data Protection Act 2023. Contact: [email protected].
This policy explains what personal data we collect in connection with our regulatory circular tracking and evidence pack generation service, how we use it, and what rights you have.
1. Who This Policy Covers
This policy applies to compliance officers, regulatory affairs teams, and other authorised personnel at Indian banks, non-banking financial companies (NBFCs), insurance companies, and mutual fund operators who access onfinanceai.org or use the OnFinance AI platform. It also applies to visitors who browse the site without creating an account.
2. Information We Collect
The OnFinance AI platform is designed to process publicly available regulatory circulars from RBI, SEBI, IRDAI, and PFRDA publication feeds. The personal data we collect in connection with running the service is limited to:
- Account and contact data you provide at registration: name, institutional email address, organisation name, and role title.
- Uploaded or submitted content you choose to add to the platform, such as policy register documents or internal control descriptions used for mapping against detected regulatory changes. You control what you submit; we do not require the upload of documents containing personal data to deliver our core service.
- Usage and technical data collected automatically: IP address, browser type, pages visited, session timestamps, and feature interaction logs. This data is used to operate and improve the service.
- Communication content from emails or support requests you send us.
We do not use any meeting recordings, audio, or video. We do not collect precise geolocation data. We do not collect sensitive personal data as defined under Indian law (such as passwords in recoverable form, financial account numbers, or biometric data) except where you specifically provide it as part of an uploaded policy document, in which case the data is processed solely to provide the mapping and evidence pack service and is not used for any other purpose.
3. How We Use Information
Our core use of the data you submit is to operate the OnFinance AI compliance automation service: ingesting and analysing RBI, SEBI, IRDAI, and PFRDA circulars, generating paragraph-level change detection outputs, mapping changed provisions to your policy register, and assembling timestamped evidence packs your compliance team can use for audits and inspection responses.
We also use your information to:
- Manage your account and authenticate access to the platform.
- Send service notifications, including alerts when a new circular has been processed.
- Improve the accuracy of our change detection and evidence pack generation features based on aggregated usage patterns (never individual content reviewed without consent).
- Respond to support requests and communications.
- Comply with legal obligations under Indian law.
We do not sell personal information. We do not use the regulatory documents or compliance data you submit to train machine learning models without your explicit written consent.
4. Legal Basis for Processing
Under the Digital Personal Data Protection Act 2023, we process your personal data on the basis of your consent (given when you create an account and accept these terms), the necessity of processing to deliver the service you have requested, and compliance with applicable law. You may withdraw consent at any time, subject to the effect that withdrawal has on our ability to continue providing the service.
5. Sharing
We share personal information only in the following circumstances:
- Service providers who process data on our behalf under written contract and are bound to use the data only for the purpose we specify. These include cloud infrastructure providers hosting the platform and analytics tools for site performance measurement.
- Regulatory or law enforcement authorities where we are required to disclose under applicable Indian law.
- Business transfers: in the event of a merger or acquisition, personal data may be transferred as part of that transaction, subject to continued protection under this policy or a materially equivalent one.
We do not transfer your personal data outside India to third-country recipients except where adequate safeguards are in place consistent with the Digital Personal Data Protection Act 2023 and applicable rules.
6. Retention and Security
We retain account data and submitted content for as long as your account is active and for a reasonable period thereafter consistent with regulatory record-keeping expectations relevant to our client institutions. Evidence packs and archived circulars are retained for the period specified in your service tier (30 days for Navigator tier; 12 months for Compliance Suite tier; custom for Institution tier). After the retention period, data is deleted or anonymised.
We apply administrative, technical, and physical safeguards designed to protect personal information against unauthorised access, disclosure, alteration, and loss. Our security practices are designed with the controls recommended under the IT Rules 2011 in mind. We have not yet obtained third-party certifications such as ISO 27001 or SOC 2, which remain planned for future compliance milestones.
7. Your Rights
Under the Digital Personal Data Protection Act 2023 and other applicable Indian data protection law, you may have the right to:
- Access a summary of the personal data we hold about you.
- Correct inaccurate or incomplete personal data.
- Erase personal data where processing is no longer necessary or where you withdraw consent.
- Nominate another individual to exercise these rights on your behalf.
- Raise a complaint with the Data Protection Board of India once constituted and operational.
To exercise any of these rights, email us at [email protected]. We will respond within 30 days.
8. Cookies
See our Cookie Policy for details on the cookies we use and how to manage them.
9. Changes and Contact
We may update this policy to reflect changes in our practices or applicable law. Material changes will be reflected by an updated "Last updated" date at the top of this page. We encourage you to review this policy periodically.
OnFinance AI Pvt Ltd24 Brigade Road, Bengaluru, Karnataka 560025, India
Email: [email protected]
Phone: +91 80 4092 1600