Privacy Policy

This Privacy Policy explains how Xentury Solutions Private Limited ("tr/be", "we", "us", or "our") collects, uses, stores, shares, and protects your personal data when you access or use the tr/be website at tribemoney.ai, our applications, and related services (collectively, the "Platform"). This Policy is also published at https://tribemoney.ai/legal/in/PrivacyPolicy.

tr/be is a company incorporated in India. For the purposes of the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 (together, the "DPDP Law"), tr/be is a Data Fiduciary, and you are a Data Principal.

Please read this Policy carefully. By creating an account, connecting Gmail, or using the Platform, you confirm that you have read and understood this Policy. Where the law requires your consent, we will ask for it separately and clearly before we process your data.

Beta notice. The Platform is currently offered as a beta product. Features, data flows, and this Policy may change as the product evolves. We will notify you of material changes as described in the "Changes to this Policy" section below.

tr/be is a technology platform to help you analyse and manage your finances.

If you have any questions, requests, or complaints about your personal data, please contact us at support@tribemoney.ai or legal@tribemoney.ai.

This Policy applies to personal data we process about:

• Visitors to tribemoney.ai
• Users who register for and use the Platform
• Users who connect a Google account and grant read-only Gmail access
• Individuals who contact us or take part in research, interviews, or the beta programme

This Policy does not cover the privacy practices of third parties whose services you access through the Platform, including Google. Those third parties have their own privacy policies, which we encourage you to read. The Platform is intended for personal (consumer) use, not enterprise email monitoring or third-party surveillance.

• Personal data: any data about an individual who is identifiable by or in relation to such data.
• Data Principal: the individual to whom the personal data relates (you).
• Data Fiduciary: the entity that decides the purpose and means of processing personal data (tr/be).
• Data Processor: a third party that processes personal data on our behalf and under our instructions.
• Consent Manager: an entity registered with the Data Protection Board of India through which you may give, manage, review, and withdraw consent.
• Processing: any operation performed on personal data, including collection, storage, use, sharing, and erasure.

4.1 Data you give us directly

• Account and identity data: name, email address, mobile number, and login credentials.
• Google account email and basic profile: used to identify and authenticate your tr/be account when you sign in with Google.
• Profile and preferences: financial goals, risk preferences, and settings you configure.
• Communications: messages, feedback, survey responses, and support requests.

4.2 Financial data we access with your authorisation

To provide spend analysis and personalised financial insights, and only after you authorise it, we access and read financial information contained in:

• Your Gmail account (optional, read-only): finance-related messages such as merchant receipts, bank e-statements, broker and SIP confirmations, and similar transaction mail. Access is granted through Google OAuth using the read-only Gmail scope https://www.googleapis.com/auth/gmail.readonly (described by Google as permission to view your email messages and settings), plus basic identity scopes (email/profile) as needed to identify your account.
• Your SMS messages: bank, card, and wallet transaction alerts and similar financial messages.

From these sources we extract and store details such as transaction amounts, dates, merchant or counterparty names, account and card references (in masked form where available), balances, fees and charges, and subscription or recurring payments. We access only the information reasonably needed to deliver the Platform's features.

Why message-body access is needed. Amounts, merchants, and statement details typically live in email message bodies, not metadata alone. Narrower Gmail scopes are not sufficient for this purpose. tr/be is not an email client: we do not send, delete, or modify your mail.

You can withdraw this authorisation at any time (see Section 10), including by disconnecting Gmail in the Platform where available and by revoking access in your Google Account settings. Withdrawal stops future access, though it does not affect processing already carried out lawfully before withdrawal.

4.3 Data from third parties

When you use a partner service through the Platform, we may receive transaction status and related account information from that partner so we can reflect it in your dashboard.

4.4 Technical and usage data

• Device and connection data: IP address, device type, operating system, browser, and identifiers.
• Usage data: pages viewed, features used, actions taken, and timestamps.
• Cookies and similar technologies: as described in Section 12.

We use your personal data to:

• Provide the spend management product: capture, categorise, and analyse your financial transactions and present insights and recommendations.
• Derive finance insights from Gmail (if connected): identify finance-related mail and extract amounts, dates, merchants, and statement or investment signals solely to show a personal finance snapshot and next-step recommendations in the Platform.
• Personalise the Platform: tailor recommendations (such as reducing avoidable charges, unused subscriptions, or better payment methods) to your financial context and goals.
• Enable partner products: facilitate services such as fixed deposits offered through our partner.
• Operate and improve the Platform: run, maintain, secure, debug, and improve our features and models.
• Communicate with you: send service messages, respond to requests, and share product updates you have opted into.
• Protect the Platform: detect, prevent, and respond to fraud, abuse, and security incidents.
• Comply with law: meet legal, regulatory, and audit obligations.

We rely on your consent as the primary legal basis for processing your financial, email, and SMS data, including Gmail access. Before Gmail is connected, you initiate Google OAuth, review Google's consent screen, and receive in-app disclosure about the purpose of access. For certain limited purposes, we may rely on other lawful bases permitted under the DPDP Law, such as compliance with a legal obligation.

We do not use your personal data to make solely automated decisions that produce legal or similarly significant effects on you without a meaningful review path.

Connecting Gmail is voluntary and user-initiated through Google's OAuth consent screen. Scope is read-only Gmail (gmail.readonly) plus identity (email/profile) as needed to identify your tr/be account.

We do not:

• Sell mailbox data or Google user data.
• Use email content to build advertising profiles or serve ads from email content.
• Read unrelated personal conversations as a product goal. Our product focus is finance-related mail.
• Share Gmail content with unrelated third parties for their marketing.
• Send, delete, or modify your email messages.
• Offer enterprise email monitoring or third-party surveillance.

We use Google user data only to provide or improve user-facing features that are prominent in the Platform's user interface, consistent with Google's API Services User Data Policy, including the Limited Use requirements applicable to Gmail.

You may revoke access at any time in Google Account → Security → Third-party access, at https://myaccount.google.com/permissions, and/or via in-app controls where available. Revoking Gmail consent may limit or disable finance-insight features that depend on Gmail.

We do not sell your personal data. We share it only as described here:

• Google: OAuth authentication and Gmail API access. You remain subject to Google's terms and privacy policy.
• Service providers and processors: cloud hosting, infrastructure, analytics, and support providers that process data on our behalf under contract and under our instructions.
• Partner financial services: where you choose a partner product, we share the data needed to complete that service. The partner processes your data under its own privacy policy.
• Professional advisers and auditors: where reasonably needed and under confidentiality obligations.
• Legal and regulatory disclosure: where required by law, court order, or a lawful request from a competent authority.
• Corporate transactions: in connection with a merger, acquisition, financing, or reorganisation, subject to appropriate safeguards and continuity of this Policy's protections.

We do not share Gmail content with third parties for their independent advertising or marketing use.

We implement reasonable security safeguards to protect your personal data, including access controls, encryption in transit, and internal policies limiting access to authorised personnel. No system is perfectly secure, and we cannot guarantee absolute security.

We store personal data on servers that may be located in India or in other jurisdictions through our cloud providers, including where Google's APIs operate. Where personal data is transferred outside India, we do so in accordance with the DPDP Law and any conditions the Central Government may prescribe.

In the event of a personal data breach, we will notify the Data Protection Board of India and affected Data Principals in the manner and within the timelines required under the DPDP Law.

We keep your personal data only for as long as needed to fulfil the purposes set out in this Policy, to provide the Platform to you, and to meet legal, accounting, or reporting obligations.

• Google OAuth tokens: retained while Gmail remains connected to your tr/be account; deleted or invalidated within 30 days after you disconnect Gmail, revoke Google access, or delete your account.
• Raw email content accessed via the Gmail API: used to extract finance signals. We do not keep a permanent full-mailbox archive. Raw message content we store (if any) is retained for up to 90 days for processing, quality, and security, then deleted or irreversibly anonymised, unless you request earlier deletion.
• Derived insights and account profile data: retained while your account is active; deleted within 90 days after account deletion (except backups that roll off on a delayed schedule, or where law requires longer retention).
• Security, audit, and support logs: typically up to 12 months, or longer if needed for a legal hold.

When the purpose is no longer served, for example because you withdraw consent, delete your account, or remain inactive for the period specified under the DPDP Law, we will erase your personal data, unless retention is required or permitted by law. We may retain limited data in de-identified or aggregated form that can no longer be linked to you.

Subject to the DPDP Law, you have the right to:

• Access a summary of the personal data we process about you and the processing activities.
• Correction and updating of inaccurate or incomplete personal data.
• Erasure of your personal data where it is no longer needed and retention is not legally required.
• Withdraw consent at any time, with the same ease as giving it. This includes revoking our access to your email, Gmail, and SMS data, without affecting the lawfulness of processing before withdrawal.
• Nominate another individual to exercise your rights in the event of death or incapacity.
• Grievance redressal through our Grievance Officer, and escalation to the Data Protection Board of India if you are not satisfied with our response.

Under the DPDP Law, you agree to provide accurate information, not to impersonate another person, and not to suppress material information when sharing personal data with us.

We use cookies and similar technologies to keep you signed in, remember preferences, measure usage, and improve the Platform. You can control cookies through your browser settings. Disabling some cookies may affect how the Platform works.

The Platform is intended for users who are 18 years or older. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, please contact our Grievance Officer so we can take appropriate action.

The Platform may link to or integrate with third-party websites and services, including Google (OAuth and the Gmail API). We are not responsible for their content or privacy practices. Please review their policies before using them.

We may update this Policy from time to time. When we make material changes, we will update the "Last updated" date, post the revised Policy at https://tribemoney.ai/legal/in/PrivacyPolicy, and, where appropriate, notify you through the Platform or by email. Your continued use of the Platform after an update means you accept the revised Policy, subject to obtaining fresh consent where the law requires it.

For any privacy questions, requests, or complaints:

Privacy and legal: legal@tribemoney.ai

Support: support@tribemoney.ai

Related Terms: https://tribemoney.ai/legal/in/TermsConditions