SastaFinance Back home

Privacy Policy

Last updated: August 1, 2026

1. Introduction

SastaFinance (“SastaFinance”, “we”, “us”, or “our") is a personal finance management application designed to help users track transactions, manage budgets and savings goals, organize spending, and optionally use AI-powered features such as transaction extraction from bank or UPI statements.

This Privacy Policy explains what information is processed when you use SastaFinance, how it is used and protected, and the choices available to you.

By using SastaFinance, you acknowledge the practices described in this Privacy Policy.

2. Information We Process

Depending on how you use SastaFinance, we may process the following categories of information.

Account Information

When you create an account, we may process information such as:

  • Name
  • Email address
  • Authentication identifiers
  • Profile information associated with your account

Authentication may be provided through third-party authentication services such as Google and Supabase.

Financial Information

Information you choose to enter, import, or manage may include:

  • Income and expenses
  • Transaction amounts and dates
  • Transaction descriptions
  • Categories
  • Budgets
  • Savings goals
  • Account or payment-related descriptions contained in imported statements

SastaFinance is a personal finance tracking application and is not a bank, payment processor, investment adviser, or financial institution.

Uploaded Financial Statements

If you use the AI statement import feature, you may upload bank, UPI, wallet, or similar transaction statement files. These files may contain sensitive financial information.

Uploaded statements are processed for the purpose of extracting transaction information. Extracted transactions are presented for review before being added to your account where supported by the application.

SastaFinance does not intentionally use uploaded financial statements for advertising or unrelated profiling.

AI API Keys

SastaFinance may allow you to provide your own API key for supported AI providers, such as Google Gemini.

Where this feature is enabled, API keys are encrypted server-side before being stored. SastaFinance currently uses AES-256-GCM encryption for this purpose.

API keys are decrypted only when required to perform an authorized AI operation on your behalf.

Your encryption keys and other server-side secrets are not intended to be exposed to browser/client-side code.

3. How We Use Information

Information processed through SastaFinance may be used to:

  • Provide and operate the application
  • Authenticate users
  • Store and display financial records
  • Calculate budgets, balances and savings progress
  • Categorize and organize transactions
  • Import transactions from supported statements
  • Perform AI-assisted extraction and categorization
  • Maintain application security
  • Diagnose technical problems
  • Prevent abuse or unauthorized access
  • Improve application reliability and functionality

We do not sell your personal or financial information.

4. AI Processing

Certain SastaFinance features may use third-party artificial intelligence services.

When you initiate an AI-powered feature, information necessary to perform the requested operation may be transmitted to the applicable AI provider.

For example, using statement extraction may require relevant statement content to be processed by an AI service.

The handling of information by an external AI provider may also be governed by that provider's own privacy policy and terms.

You should avoid uploading documents containing information that is unnecessary for the feature you are using.

5. Data Storage and Supabase

SastaFinance uses Supabase infrastructure for features such as authentication and database storage.

Financial records associated with your account may be stored in Supabase databases used by SastaFinance.

Where implemented, Supabase Row Level Security (RLS) policies are used to restrict access to records based on the authenticated user and applicable authorization rules.

RLS is one component of application security and should not be interpreted as an absolute guarantee against every possible security incident.

6. Data Security

We use reasonable technical measures designed to protect information processed through SastaFinance.

Depending on the feature, these measures may include:

  • Authentication and authorization controls
  • Database Row Level Security policies
  • Encryption of stored AI API keys
  • Server-side handling of sensitive application secrets
  • HTTPS-encrypted network communication
  • Access controls for backend resources

However, no application, database, transmission method, or storage system can guarantee absolute security.

You are responsible for maintaining the confidentiality of your account credentials and any API credentials you use with the service.

7. Third-Party Services

SastaFinance may rely on third-party services, including services for:

  • Database hosting
  • Authentication
  • AI processing
  • Application hosting
  • Analytics or error monitoring, where enabled

These providers may process limited information as necessary to provide their services. Their processing is governed by their respective privacy policies and terms.

8. Data Retention

Account and financial information may be retained for as long as your account remains active or as necessary to provide the service.

Information may also be retained where reasonably necessary for security, fraud prevention, dispute resolution, legal obligations, or enforcement of our agreements.

Where account deletion functionality is available, deleting your account may permanently remove or schedule the removal of associated information, subject to legitimate backup, security, and legal retention requirements.

9. Your Choices

Depending on the functionality available in SastaFinance, you may be able to:

  • View and modify your financial records
  • Delete transactions and other records
  • Modify your profile
  • Add, replace, or remove your AI API key
  • Choose whether to use AI-powered features
  • Request deletion of your account and associated information

AI-powered features are optional unless explicitly stated otherwise.

10. Cookies and Local Storage

SastaFinance may use cookies, browser storage, or similar technologies where necessary for:

  • Authentication
  • Maintaining sessions
  • Security
  • Remembering application preferences
  • Providing core application functionality

Additional analytics or non-essential tracking technologies, if introduced, should be disclosed separately where required.

11. Children's Privacy

SastaFinance is not intended for children under the minimum age required to independently consent to online services under applicable law.

We do not knowingly seek to collect personal information from children in violation of applicable law.

12. Changes to This Privacy Policy

We may update this Privacy Policy as SastaFinance evolves.

When material changes are made, we may update the “Last updated” date and provide additional notice where appropriate or legally required.

Continued use of SastaFinance following an update constitutes acknowledgment of the revised policy to the extent permitted by law.

13. Contact

For privacy questions, data-related requests, or concerns regarding SastaFinance: