Our two roles: data fiduciary and data processor
FinSour handles personal data in two ways, and it matters which one applies to you.
As a data fiduciary, for this website and for anyone who contacts us. We decide what is collected here and why. This policy describes that in full.
As a data processor, for the verification requests our customers send to our APIs. A customer submits an identifier belonging to one of their own users. We run the check and return the result.
That customer decides why the check is run and on what basis, and stays the data fiduciary for it. The agreement and data processing terms we signed with that customer set out our obligations for that data. Those terms take precedence over this page.
What this website collects
This site sets no cookies. There is no consent banner because nothing is kept on your device to consent to. One third-party script does load: Google Analytics, which we run in a cookieless mode. Its consent settings are set to denied and its browser storage is switched off, so it writes no cookie, leaves nothing in local storage, and cannot recognise you on a later visit. You can check all of that in your browser's network tab and storage panel.
Because your browser fetches that script from Google, Google receives your IP address and user-agent string in the request, as it does for any file a browser fetches from it. Google acts as our processor for the measurement data, derives a coarse location from the IP address and does not store the address alongside the measurements. If you would rather the script never load, a tracker blocker or Google's own opt-out add-on stops it, and nothing on this site depends on it.
We record four things.
Page views. We store the path, the route template it matched, and the referring host when you arrive from another site. We also store a coarse device bucket and a pseudonymous visitor digest.
The digest is a keyed hash of your IP address, your browser's user-agent string and the current UTC date, worked out on our own server. We use the IP address and user agent to produce that digest, and then discard them. We store neither, and we send neither anywhere else.
The date is part of the input, so the digest changes at midnight UTC. We count you once per day, and one day's activity cannot be joined to the next.
Performance measurements. A sample of page loads reports loading and layout-stability timings as a metric name, a number, and the route template. Nothing identifying is attached to them.
Analytics measurements. Google Analytics receives the page address, the page title, the site you arrived from, and coarse device and location signals. Running without storage, it has no identifier for you, so it cannot tell a returning visitor from a new one and its visitor counts are estimates rather than counts of people.
Enquiries. If you use the contact form, we receive seven fields: your name, work email, company, mobile number, the service you select, what your enquiry is about (sales, partnership or general), and the message you write.
The form also records which page it was sent from, the contact page or the get-started page. If you opened it from a link on an API, solution or industry page, it records that page too, as a short name such as api:aadhaar-verification. We receive nothing else through the form.
Why we collect it
Page views and performance measurements tell us which pages people actually read, and whether the site is fast enough to use. We only ever look at them in aggregate.
We use enquiry details, including what your enquiry is about and the page you came from, to reply to you and to discuss API access. We do not sell them. We do not use them for advertising, and we do not share them with anyone for their own marketing.
What allows us to collect it
The DPDP Act requires a lawful basis for every use of personal data. Ours differs by what is collected.
For enquiries, the basis is your consent. You give it when you complete the contact form and send it. You can withdraw it whenever you like, and the section on your rights explains how.
For page views and performance measurements, we built the collection so that we do not hold personal data at all. The IP address and user agent are discarded once the daily digest is produced, and the digest cannot be worked back to a person. That is why this site asks you to consent to nothing.
How long we keep it
We delete page views on a rolling 400-day window. A sweep inside the service does that on its own. It does not wait on a job someone has to remember to schedule.
Performance measurements are aggregate counters. They hold nothing about you to delete.
We keep enquiries for two years, then delete them. The same kind of sweep does it, on the same schedule, without anyone having to remember.
Two years outlasts the sales conversation an enquiry belongs to. After that, the name, email and phone number of someone who never became a customer have no reason to sit in our database.
Verification data sent to our APIs
When a customer calls a verification API, the request carries an identifier belonging to a person or business that customer is checking. That identifier can be an Aadhaar or PAN number, a bank account, a vehicle registration, a company identifier, or a document image.
To run the check, we route the request to the issuing authority or the authorised source for that record. The source involved depends on which API is called.
We act on the customer's instructions for that data. We do not use it to train models or to build datasets of our own. We use it for no purpose other than returning the result that was asked for.
If your personal data reached us because a business ran a check on you, that business is the data fiduciary. It is the right first point of contact. Tell us and we will help them respond.
Aadhaar and other regulated identifiers
Some identifiers carry rules of their own, beyond the DPDP Act. Aadhaar is the clearest example, and the Aadhaar Act and the UIDAI regulations made under it govern what anyone may do with an Aadhaar number.
A customer running an Aadhaar-linked check must hold the authorisation that check requires. They must also collect the consent the law asks for before they submit anything to us. We publish a masking service because a masked Aadhaar number is enough for many workflows that would otherwise store a full one.
The service contract for each Aadhaar-linked API sets out what we may do with the identifier, how long anything may be held, and the conditions the customer accepts. Where that contract and this page differ, the contract governs.
Who else handles your data
This website and the API platform run on DigitalOcean infrastructure in the Bangalore region. Customer and verification data stays in India.
Our business email runs on Google Workspace, which stores mail outside India. That matters only for correspondence. If you write to us, or we reply to an enquiry you sent through this site, that email thread sits on Google Workspace.
We never send verification data by email. Running a check also involves the issuing authorities and authorised sources described above. We do not sell personal data, and we do not share it for advertising.
Security and certification evidence
Traffic to this site and to the APIs is encrypted in transit. We restrict access to enquiry and customer data to the people whose work needs it. We keep the security practices the IT Act and the rules under it expect of us.
We do not publish certification logos. Certification scope differs by service and by how it is deployed. So a badge on a public page tells you nothing about whether it covers the workflow you are buying.
We share current attestations, scope statements and audit evidence directly under NDA, mapped to the APIs you intend to use. Ask us and we will send the applicable set.
If a breach happens
No one can promise a breach will never happen. What we can tell you is what we will do.
If personal data we hold is breached, we will report it to the Data Protection Board of India. We will tell the people affected too, in the form and within the time the DPDP Act requires. Where the breach involves data we process for a customer, we will tell that customer without waiting, so they can meet their own obligations.
Your rights under the DPDP Act
Under the Digital Personal Data Protection Act, 2023 you may:
- ask us what personal data of yours we hold, and what we have done with it;
- ask us to correct anything inaccurate, complete anything missing, and update anything out of date;
- ask us to erase your personal data where we no longer need it for the purpose you gave it for;
- nominate someone to exercise these rights for you if you die or cannot act for yourself;
- withdraw a consent you gave earlier, as easily as you gave it;
- raise a grievance about how we have handled your data.
Write to the address at the end of this page and tell us which of these you want. We may ask you for enough detail to find your record and to be sure the request is yours. We answer as quickly as we can, and within the period the law sets.
Withdrawing consent stops any further use from that point. It does not undo what was already lawfully done beforehand.
If our answer does not satisfy you, you may take the matter to the Data Protection Board of India.
If your data reached us through a check a business ran, read the section on verification data first. That business holds the rights request, and we will help them answer it.
Automated decisions
We do not make automated decisions about individuals. A verification result reports what a source record said. Any decision that follows is made by the business that asked for the check.
Children
This website is meant for business use, and it is not directed at children. We do not knowingly collect personal data from children through it.
We do not track children, show them targeted advertising, or process their data in any way likely to harm them. If you believe a child has sent us personal data through this site, tell us and we will delete it.
Changes to this policy
If this policy changes, we will revise it here and update the date shown at the top of this page.
Contact and grievances
Our Grievance Officer is Aditya, Tech and Operations Lead, at aditya@finsour.io. Write there with any grievance about how your personal data has been handled, and we will respond.
Send general questions about this policy to support@finsour.io, or use the contact page on this site.
Finsour Technolab Private Limited issues this policy. Our address is 3rd Floor, RBH Complex, Variav, Surat, Gujarat 394520, India.