# Privacy policy > How Kosh collects, uses, stores and deletes your personal and financial data under India's Digital Personal Data Protection Act, 2023. Source: https://trykosh.com/legal/privacy Privacy policy # Your money data, handled with care. How Primedepth Labs collects, uses, stores and protects your personal data when you use Kosh, and the rights you have under India's Digital Personal Data Protection Act, 2023. Last updated 26 October 2026 On this pagePolicies **In short** - We collect what you give us (your account, profile and the statements you upload) and what Kosh works out from it. - We never ask for bank logins, OTPs, PINs or card numbers. Statement passwords are used only inside your browser and are never sent to us. - We use your data only to run Kosh for you. We don't sell it or rent it, and your money data is never used for advertising. - AI providers process your data to read statements and write your plan. Some of them, and our storage, are outside India. We tell you exactly which below. - You can download everything or delete your account at any time from Settings. ## 01Who we are Kosh is a product of **Primedepth Labs** ("we", "us"), a partnership firm registered in India. For the personal data described in this policy, we are the **Data Fiduciary** under the Digital Personal Data Protection Act, 2023 (the "DPDP Act"). Registered name PRIMEDEPTH LABS GSTIN 03ABGFP4193E1ZD Principal place of business Floor 4, R1 of D180-C, Industrial Area, Phase 8B, Sector 74, Mohali, SAS Nagar, Punjab 160055, India Privacy questions [contact@trykosh.com](mailto:contact@trykosh.com) ## 02What we collect ### Information you give us - **Account details:** your name and email address, your mobile number if you sign up with email (used for reminders about your account, trial and card dues), plus either a password (we store only a salted hash, never the password itself) or, if you continue with Google, the name, email address, profile photo link and account ID Google shares with us. We never receive your Google password or access to your Gmail, Drive or contacts. - **Profile:** anything you tell us during onboarding or later, such as age, city, occupation, monthly income, dependents, risk appetite, financial priorities, and tax details like salary structure, rent and deductions. - **Statements and documents:** bank, credit card, investment, loan or salary documents you upload, and their contents: transactions, balances, holdings, account labels, the last four digits of account or card numbers, and the account holder's name as printed. - **Conversations:** the questions you ask Kosh and its answers. - **Newsletter:** your email address, if you sign up for updates. ### Information Kosh creates from it Categorised transactions, monthly summaries, net worth, recommendations, goals, reminders, tax estimates, the screens Kosh designs for you, and the emails it writes to you. ### Information collected automatically - A single session cookie that keeps you signed in (see [Cookies](#cookies)). - Your IP address, used only in hashed form to limit abuse such as repeated sign-up or sign-in attempts. - Basic technical logs (time, page or endpoint, errors) kept by our hosting provider to run and secure the service. ### What we never collect Internet-banking credentials, OTPs, UPI or card PINs, full card numbers or CVVs. Payment details are entered directly with our payment partner, Dodo Payments, and never reach us. Passwords for locked PDF statements are used only inside your browser to open the file; only the unlocked text is uploaded. ## 03How we use it We use your personal data only for these purposes: - To provide Kosh: reading your statements, organising your money, calculating tax under both regimes, designing your screens, answering your questions and tracking goals. - To send the emails you've chosen: reminders, digests, statement reviews and, on Pro, the morning market brief. You can change these in Settings at any time. - To run billing for paid plans through Dodo Payments. - To keep Kosh secure, prevent fraud and abuse, and fix problems. - To meet legal obligations, such as tax record-keeping and responding to lawful requests. We do **not** sell or rent your data, use your financial data for advertising, share it with lenders or insurers for marketing, or use your statements to train AI models. Unless you opt out, we measure our own ads with Meta as described in [Analytics and ads measurement](#ads). Kosh's recommendations are educational and are never used to make decisions about you that have legal or similar effects. ## 04Consent and legal basis We process your personal data on the basis of the consent you give when you create your account and each time you upload a document (DPDP Act, section 6). Some processing is a legitimate use under section 7, for example keeping invoices to meet tax law or responding to a court order. You can withdraw consent at any time by deleting documents or your account, or by writing to [contact@trykosh.com](mailto:contact@trykosh.com). Withdrawing consent doesn't affect processing that happened before, but we won't be able to run Kosh for you without it. ## 05How AI processes your data Kosh is powered by large language models. To read a statement, write your review, design a screen, compose an email or answer a question, we send the relevant data (for example the statement's text or file, or a summary of your finances) to our AI provider, which returns a result to us. - **Current provider:** DeepSeek (Hangzhou DeepSeek Artificial Intelligence Co., Ltd.), through its API. Its servers may be located outside India, including in the People's Republic of China. - **Web research:** to keep tax rules and market briefs current, Kosh searches the public web through the same provider. These searches are about general topics (tax law, markets) and don't contain your statements; a search started from your question in chat may include words from that question. - We send only what each task needs, over encrypted connections, and we don't permit our AI provider to use your data for advertising. We may change AI providers to improve quality, cost or data location. We'll update this policy and tell you before a change that moves your data to a new country. ## 06Who we share it with We share personal data only with service providers who process it on our behalf (Data Processors), under contract and for the purposes above: Provider What they do Where data is processed Supabase Database and encrypted storage for your account data and statement files Tokyo, Japan DeepSeek AI processing and web search, as described above Outside India, including China Vercel Hosting and running the Kosh app Global network, primarily the United States Resend Delivering the emails Kosh writes to you United States Dodo Payments Payments, invoices and subscriptions (merchant of record) India and other countries Google "Continue with Google" sign-in, if you choose it, and Google Analytics for site usage (see [Measurement](#ads)) United States and other countries Meta Platforms Ads measurement, unless you opt out (see [Analytics and ads measurement](#ads)) United States and other countries We may also disclose data when required by law or by a lawful order of a court or government authority, to protect the rights and safety of our users or the public, or as part of a merger or acquisition, in which case this policy will continue to apply. ## 07Analytics and ads measurement We advertise Kosh on Facebook and Instagram. To learn which ads help people find Kosh, and to show our ads to people more likely to find it useful, we use Meta's Pixel and Conversions API. This is on by default and you can **opt out at any time**: from the notice shown on your first visit, or with the button at the end of this section. - **What Meta receives:** the pages you visit on our website and these milestones: creating an account and signing in, starting checkout, starting a trial, payments, uploading a statement and your first statement being read, asking your CFO a question (never what you asked) and finishing a daily mission. With them we send your email address, mobile number and account ID in hashed (scrambled) form, your IP address, browser type and Meta's own click and browser identifiers. - **Google Analytics:** we use Google Analytics to count visits and see which pages and features help. Page addresses are sent without their query strings, so things like a question you type to your CFO never reach Google. Google Analytics sets its `_ga` cookies and receives the milestones above and your use of Kosh's features, without your email. If you opt out, it switches to a cookieless mode that sends anonymous pings without identifiers. - **What Meta and Google never receive:** your statements, transactions, balances, tax details, conversations or anything else about your money. - **Campaign cookie:** when you arrive from an ad or link, we store which campaign brought you (UTM parameters and click ID) in a first-party cookie, `kosh_attr`, for 90 days, so we can see which campaigns lead to sign-ups. - **Opting out:** use the button below or the notice on your first visit. If you're signed in, we also stop sending your account's events from our servers. You can also write to [contact@trykosh.com](mailto:contact@trykosh.com). Meta and Google process this data under their own terms and privacy policies. Opting out doesn't change anything about how Kosh works for you. ## 08Transfers outside India As the table shows, some processing happens outside India. The DPDP Act permits this except to countries the Central Government restricts by notification. We monitor these notifications and will move processing if a country we use is restricted. By using Kosh you consent to these transfers. ## 09How long we keep it - **Account, profile and financial data:** for as long as your account is open. - **Statement files and what was read from them:** until you delete the statement or your account. - **After you delete your account:** we erase your personal data within 30 days, including statement files. Encrypted backups are overwritten in their normal cycle. - **Billing records:** kept for as long as tax law requires (under GST law, generally six years from the relevant annual return), even after you leave. - **Security logs:** up to 90 days. ## 10How we protect it Data is encrypted in transit and at rest. Statement files sit in private storage that browsers can't read, the database is closed to public access, and passwords are stored as salted hashes. Read the full picture on our [Security](/legal/security) page. No system is perfectly secure; if a breach affects you, we'll inform you and the Data Protection Board of India as the law requires. ## 11Your rights Under the DPDP Act you have the right to: - **Access** a summary of the personal data we process and the processing we do. Use _Settings -> Download my data_ for a complete copy. - **Correct, complete or update** your data. Most of it is editable in the app; for anything else, write to us. - **Erase** your data. Delete any statement from the Statements page, or everything with _Settings -> Delete my account_. - **Grievance redressal** through our Grievance Officer (below). - **Nominate** someone to exercise these rights if you die or become incapable. Email us with their details. - **Withdraw consent** at any time, as described above. We respond to requests within 15 days. If you're not satisfied with how we handled a grievance, you may complain to the Data Protection Board of India. ## 12Children Kosh is for adults aged 18 and over. We don't knowingly process the personal data of children. If you believe a child has created an account, write to [contact@trykosh.com](mailto:contact@trykosh.com) and we'll delete it. ## 13Cookies Cookie Why How long kosh\_session Keeps you signed in. Strictly necessary; holds a random token, not personal data. 30 days kosh\_consent Remembers whether you opted out of measurement (Google Analytics and Meta). 1 year kosh\_attr Remembers which campaign or link brought you (see Analytics and ads measurement). 90 days \_ga, \_ga\_\* Google Analytics: tells visits apart so we can count visitors and see which pages help. Set only if you allow measurement; before that, Google receives cookieless pings without page query strings. Up to 2 years \_fbp, \_fbc Meta's browser and click identifiers. Set only if you allow ads measurement, or when you arrive from a Meta ad. 90 days ## 14Changes to this policy If we make material changes, we'll tell you by email or in the app before they take effect. The date at the top shows when this policy last changed. ## 15Contact and Grievance Officer Questions, requests or complaints about your personal data can go to: Grievance Officer Harjaap Singh Dhillon, Partner and Grievance Officer Email [contact@trykosh.com](mailto:contact@trykosh.com) Privacy requests [contact@trykosh.com](mailto:contact@trykosh.com) Post Primedepth Labs, Floor 4, R1 of D180-C, Industrial Area, Phase 8B, Sector 74, Mohali, SAS Nagar, Punjab 160055, India Response time Acknowledged within 24 hours; resolved within 15 days