Privacy Policy
1. Who we are
MunimIQ is operated by FutureFist Tech Solutions LLP, Thane, Maharashtra, India ("we", "us"). For the purposes of the Digital Personal Data Protection Act, 2023 ("DPDP Act") we are the Data Fiduciary for your account data. For the business data you sync from Tally, you (the business) decide what is processed and we process it on your instructions.
2. What we collect
- Account data: name, email, password (stored only as a scrypt hash), optional 2-step verification secret (encrypted), organisation name, team invitations and roles.
- Tally data you choose to sync: company name and state, ledgers and groups, stock items, voucher types, godowns, vouchers (date, type, number, party, amounts, line items) and narration. Ledger phone, email, GSTIN and address, voucher narration and company GSTIN are encrypted with a key unique to each company.
- Entries you create in MunimIQ (to be posted into Tally) and their approval history.
- Security and usage logs: login times, IP address, browser/device name, actions such as "company data exported" or "device revoked". Error reports from the app contain the screen and the error message, not your business data.
- Feedback you send from the app.
- Payment details are handled by Razorpay; we receive only the payment status and reference, never your card or bank details.
3. Why we use it
- To show your dashboards, reports, ledgers and AI answers, and to post entries into your Tally when you allow it.
- To keep your account secure (login, 2-step verification, lockouts, suspicious-activity checks, audit log).
- To send service emails: email verification, password reset, security notices, billing.
- To fix problems and improve MunimIQ (aggregated, without reading your books unless you ask us to help).
We do not sell your data, show ads, or use your business data to train AI models.
4. AI features
When you use "Ask MunimIQ", the question and the needed figures are sent to our AI provider (Anthropic Claude) to generate the answer. Before sending, party and company names are replaced with tokens (Party-1, Party-2…) and phone numbers, GSTINs and addresses are never sent. If you don't want this, don't use the AI feature — every report works without it.
When you use the MunimIQ Help chat, your messages and the support details the assistant checks for you (sync status, Connector version, recent entries with their party name, amount and Tally error, plan status) are sent to the same AI provider to answer you. The chat is saved with your account so the MunimIQ team can help if you ask for a person. Never type passwords or OTPs in the chat. The AI provider may process data outside India and does not use it to train models.
5. Who can see your data
- You and the team members / CA firm you invite, limited to the companies and roles you give them. Access can be revoked at any time.
- Our service providers, only as needed to run MunimIQ: hosting (servers in India), encrypted off-site backups (encrypted before upload; the provider cannot read them), email delivery, payments (Razorpay) and the AI providers described above.
- Authorities, only when required by Indian law.
6. Security
Encryption in transit (HTTPS) and at rest for sensitive fields; database row-level security so one customer's query can never return another's rows; per-device signed connector with a key that never leaves your PC; mandatory 2-step verification for CA accounts; full audit log. No system is perfectly secure — if a breach affects your data we will inform you and the Data Protection Board as required by the DPDP Act.
7. How long we keep data
While your account and companies exist. When you delete a company, its synced data, entries and devices are deleted immediately from the live database and disappear from our backups within 30 days. When you delete your account, your name, email, password and 2-step secret are erased; security logs are kept for up to 1 year for fraud prevention, without your name or email.
8. Your rights
You can at any time: see and download your data (Settings → Security → "Download my data", and Company → "Download all data"), correct your name, delete a company or your whole account from the app, and withdraw consent by deleting your account. You can also contact our Grievance Officer.
9. Grievance Officer
Sunny Racharla, FutureFist Tech Solutions LLP, Thane, Maharashtra · Email: sunny@futurefist.com. We reply within 7 days and resolve within 30 days. If you are not satisfied, you may approach the Data Protection Board of India.
10. Changes
If we change this policy in a way that matters, we will tell you by email or in the app before it applies.