Data Policy
Cashflow Evaluator — a product of Optywise Business Solutions LLP
Effective Date: 9 July 2026 · Last Updated: 9 July 2026
1. Purpose and Scope
This Data Policy sets out how Optywise Business Solutions LLP ("Optywise") classifies, owns, uses, retains, and disposes of data processed through the Cashflow Evaluator platform (the "Service"), supplementing our Privacy Policy and Data Security Policy. It applies to all data uploaded, generated, or stored in connection with the Service, whether by registered business Users, their authorised team members, or end customers of Users ("Customer Data").
2. Data Classification
| Category | Examples | Sensitivity |
|---|---|---|
| Account Data | Name, email, phone, org details | Personal Data |
| Uploaded Source Documents | Bank statement PDFs/XLS | Sensitive Financial Data / Personal Data |
| Derived/Processed Data | Parsed transactions, categorisation tags, charts | Sensitive Financial Data (derived) |
| Technical/Log Data | IP addresses, device logs, API logs | Personal Data (technical) |
| Billing Data | Invoices, transaction references | Personal Data |
| Aggregated/Anonymised Data | Statistical, de-identified data | Not Personal Data |
3. Data Ownership
3.1 As between Optywise and the User, the User retains all ownership rights in the Customer Data they upload, including original bank statements and any personal or business information therein.
3.2 The User grants Optywise a limited, non-exclusive, royalty-free licence to host, copy, process, transmit, and display Customer Data solely to provide, maintain, secure, and improve the Service, and as otherwise permitted under this Policy and applicable law.
3.3 Optywise owns all rights in the Service itself, including its parsing engines, categorisation logic, algorithms, models, templates, and any aggregated or anonymised data derived from Customer Data that does not identify any individual or business.
4. Permitted Uses of Aggregated/Anonymised Data
Notwithstanding Clause 3.1, Optywise may extract, compile, and use data in anonymised or aggregated form — from which no individual or business is identifiable — for improving parsing accuracy across banks, benchmarking, product analytics, refining classification logic, and generating industry insights, without further consent, since such data does not constitute personal data under the DPDP Act.
5. Sub-Processors and Third-Party Service Providers
Optywise engages the following categories of sub-processors, each bound by written data-processing agreements incorporating security and confidentiality obligations consistent with the DPDP Rules:
- Cloud infrastructure / hosting providers
- Payment gateway providers
- Email/SMS/notification delivery providers
- Application performance monitoring and logging tools
- Customer support/helpdesk tools
A current, itemised list of sub-processors and their locations is available on request at consulting@optywise.com.
6. Data Localisation and Cross-Border Transfer
Data may be hosted at India. Optywise complies with Section 16 of the DPDP Act regarding cross-border transfer and does not transfer personal data to any country or territory restricted by the Central Government of India.
7. Data Retention Schedule
| Data Type | Retention Period |
|---|---|
| Active account data | Duration of active subscription + 90 days post-closure |
| Uploaded bank statements & derived reports | Duration of active subscription + 90 days post-closure, or until erasure request |
| Billing/invoice records | 8 years per applicable tax/accounting law |
| Processing logs, access logs, traffic data | Minimum 1 year, as mandated under the DPDP Rules |
| Backups (encrypted) | Rolling 30 days, purged in ordinary rotation |
8. Data Portability and Export
Users may export their categorised transaction data and reports in CSV / Excel (XLSX) at any time during an active subscription via the Service's export functionality.
9. Data Deletion on Account Closure
On termination or non-renewal of a subscription, Optywise will, within the timeline prescribed by the DPDP Rules (ordinarily 90 days) or such longer period as required for legal/tax retention, permanently delete or anonymise the User's Customer Data from live systems. Encrypted backups age out per the rotation schedule in Clause 7.
10. Data Accuracy
Optywise takes reasonable measures to ensure parsed and categorised data reflects the content of uploaded source documents, but does not warrant complete accuracy given the automated nature of document parsing (see Privacy Policy, Clause 6, and Data Security Policy, Clause 9, on AI/automation disclaimers). Users are responsible for reviewing and, where necessary, correcting categorisation before relying on any output.
11. Data Processing Agreements (for Business/Enterprise Users)
Where a User qualifies as a Data Fiduciary in its own right in respect of Customer Data belonging to its own customers, Optywise acts as a Data Processor for such User and will enter into a separate Data Processing Addendum on request, consistent with Section 8 of the DPDP Act.
12. Changes to this Policy
We may amend this Data Policy from time to time; material changes will be communicated as described in our Privacy Policy.
13. Contact
For data governance queries, contact consulting@optywise.com or +91 7498832918.