Draft, last updated 24 October 2026. Questions: [email protected]
Who we are
FinNiki is run by Nikhil Varghese, Chartered Accountant. Contact: [email protected].
What we collect
- When you book: name, email, phone (optional), country, state (Indian clients), GSTIN (optional), your note, the time you chose and your time zone.
- When you pay: Razorpay processes the payment. We receive a payment reference and the amount; your card or bank details never reach us.
- When you buy a paid tool: the name, country, state (buyers in India) and GSTIN (optional) you give for the invoice, the price you paid and the payment reference. If you delete your account, the purchase and its invoice are kept, because GST law requires us to keep invoices; they are no longer linked to a FinNiki account.
- When you write to us through the contact form: name, email, organisation and your message.
- When you sign in to see a tool’s result or read a guide: your email address (and your name, if you use Google), when you joined and last signed in, which tool or guide you came from, which guides you opened and when you first opened each, and whether you asked for our email notes. A session cookie (fn_s) keeps you signed in for up to 90 days; it is not used for tracking or advertising. With Google sign-in we receive only your name and email, nothing else from your Google account.
- Technical data: Cloudflare, which protects the site, processes your IP address and browser details to block abuse.
The calculators on the Tools page run in your browser; the numbers you type into them are not sent to us.
We send email notes only if you ticked the box, and every note lets you stop them. You can untick it, or delete your account, at any time on your account page.
Why we use it
To hold your session, take payment, send you invoices required under GST law, reply to messages, and keep the site secure. We do not sell your data or use it for advertising.
Who processes it for us
- Razorpay (payments, India)
- Cloudflare (security and delivery)
- Vultr (our server, located in Mumbai, India)
- Google (Calendar and Meet): your booking is added to Nikhil’s calendar with your name and email, and Google sends you the calendar invite and the Meet link
- Resend (sends your booking emails, reminders and invoices)
- OpenRouter (United States) and the AI model it sends to, or Anthropic (Claude) through our own Claude account, with model training switched off: when we invoice a business, we may give an AI model its GST registration certificate or an earlier invoice so the details are typed in correctly. Through OpenRouter we only use providers that don’t keep or train on the document. We check what it reads before saving.
- YouTube and Instagram: video thumbnails load from YouTube’s image server (i.ytimg.com); the player and its cookies load only when you press play
Google user data
This part covers the Google accounts connected to FinNiki’s booking system, which today are only Nikhil’s own. Clients who book never sign in with Google.
- What FinNiki accesses: the list of calendars in the connected account, the busy times in the calendars chosen (only the times, not what the events are), and the booking events FinNiki itself creates, updates or deletes.
- Why: to stop the booking page offering a time when Nikhil is busy, and to put each confirmed booking, with its Google Meet link, in his calendar. Nothing else.
- Storage: the sign-in token Google issues is stored encrypted (AES-256-GCM) on our server in Mumbai. Busy times are held in memory for at most two minutes and are not saved. FinNiki does not read the content of other events.
- Sharing: Google user data is not sold, not shared with anyone else, and not used for advertising or to train AI models. No person reads it, except where needed for security or the law.
- Removing access: disconnecting an account in FinNiki’s admin revokes the token with Google and deletes it from our server. Access can also be removed at any time from myaccount.google.com/permissions.
FinNiki’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
How long we keep it
Booking and invoice records are kept for as long as Indian tax law requires (currently at least six years). Contact-form messages are deleted after two years.
Your rights
You can ask to see, correct or delete your data by emailing [email protected]. We reply within 30 days. Records we must keep for tax law are kept until that period ends. These rights apply under India’s Digital Personal Data Protection Act 2023, and under the GDPR if you live in the EU or UK.
Security
The site is served over HTTPS, the server accepts traffic only through Cloudflare, and access to booking records is limited to Nikhil.