Privacy Policy

1. Introduction

NepFI ("we", "us", or "our") operates the NepFI platform, including the public website, accounts service, customer dashboard, and product workspaces. This Privacy Policy explains what personal data we process, why we process it, and the rights available to you under applicable law, including the EU General Data Protection Regulation (GDPR) where it applies.

Data controller: NepFI, Kathmandu, Nepal. For privacy enquiries contact [email protected].

2. Information we collect

We collect information you provide directly, information generated when you use NepFI, and limited information from third-party sign-in providers.

• Account data: name, email address, password hash, locale and security preferences.
• Authentication data: session identifiers, device metadata, IP address, and security logs.
• Google Sign-In data: when you choose Google, we receive your Google account identifier, name, email address, and profile picture URL from Google. We do not receive your Google password.
• Product usage data: workspace activity necessary to operate features you enable (for example portfolio holdings, ledger entries, or payroll records you enter).
• Support and communications: messages you send to us and records of support requests.
• Technical data: browser type, operating system, request timestamps, and diagnostic logs collected for security and reliability.

3. Legal bases for processing (GDPR)

Where GDPR applies, we rely on the following legal bases:

• Contract: to create and administer your account and provide the services you request.
• Legitimate interests: to secure the platform, prevent fraud, improve reliability, and understand aggregate usage — balanced against your rights.
• Consent: for optional marketing communications and non-essential cookies where required. You may withdraw consent at any time.
• Legal obligation: to comply with tax, accounting, anti-money-laundering, or lawful requests from authorities.

4. Google Sign-In

If you register or sign in with Google, Google provides us with basic profile information according to the permissions you approve on Google's consent screen. We use that information only to authenticate you, populate your NepFI profile, and communicate service-related notices.

Google's use of information collected through Google Sign-In is described in Google's Privacy Policy (Google's Privacy Policy). NepFI does not sell Google user data and does not use Google user data for advertising profiles.

• You can disconnect Google Sign-In by contacting support or, where available, removing the linked provider in account settings.
• If you revoke NepFI's access in your Google Account permissions, you may need another sign-in method to access NepFI.

5. Cookies and similar technologies

We use cookies and similar storage technologies to keep you signed in, remember preferences, and protect the service. Details are in our Cookie Policy. Essential authentication cookies are necessary for the service to function and do not require consent in most jurisdictions.

On the public marketing website (nepfi.com) we also use Microsoft Clarity for session replay, heatmaps, and click-pattern analytics, and Google Analytics (GA4) for page-view and engagement statistics. Neither service runs on authenticated surfaces. Both are consent-gated — scripts load only after you accept analytics cookies. See section 6 below and our Cookie Policy for details.

6. How we share information

We do not sell your personal data. We share information only with:

• Infrastructure providers that host databases, email delivery, and logging (bound by data-processing terms).
• Google LLC when you explicitly choose Google Sign-In.
• Microsoft Corporation for Clarity analytics on the public marketing website only (session replay, heatmaps, click data — no passwords or financial data). Microsoft processes this data under a Data Processing Agreement. See https://privacy.microsoft.com/en-us/privacystatement.
• Google LLC for Google Analytics (GA4) page-view and engagement statistics on the public marketing website only (no passwords or financial data). Google processes this data under a Data Processing Agreement. See Google's Privacy Policy.
• Payment processors when you purchase a paid plan (we do not store full card numbers).
• Professional advisers or authorities when required by law or to protect rights and safety.

7. International transfers

NepFI is operated from Nepal. If you access NepFI from the European Economic Area, United Kingdom, or other regions with data-transfer rules, we implement appropriate safeguards such as Standard Contractual Clauses with subprocessors where required.

8. Data retention

Account data is kept while your account is active.

When you request account deletion — from MyAccount settings or by contacting support — we do not erase your data immediately. Your account enters a 14-day cooling-off period during which it stays fully intact and you can cancel the deletion at any time with no data loss. We send a confirmation email when deletion is scheduled, a reminder near the end of the window, and a final confirmation once deletion completes.

Once the 14-day window elapses, we permanently and irreversibly delete your account, profile, and associated personal data across every NepFI service (accounts, dashboard, and product workspaces). This step cannot be undone and does not require a further request from you.

• Commercial, billing, and invoice records (purchase history, subscription changes, and payment metadata) are retained beyond account deletion in a separate, restricted archive, as required for tax, accounting, and anti-money-laundering (AML) recordkeeping obligations. This archive is never used to restore your account or for any other purpose.
• To prevent immediate re-registration abuse, we keep a one-way cryptographic hash of the email address (and phone number, if provided) tied to a deleted account. The hash cannot be reversed to recover your original contact details, but it lets us recognise and block a new signup attempt using the same email or phone number.
• Security and audit logs may be retained for up to 12 months.
• If your account is a member of an organization that is not solely yours, deleting your account does not affect the shared workspace or its other members — they receive a notice that you have left.

9. Your rights

Depending on your location, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Delete your account and associated personal data.
• Restrict or object to certain processing.
• Receive a portable copy of data you provided.
• Withdraw consent where processing is consent-based.
• Lodge a complaint with your local data protection authority.

To exercise these rights, email [email protected] or delete your account from MyAccount settings. For product support, email [email protected]. We respond within 30 days.

10. Security

We use encryption in transit (TLS), encryption at rest for sensitive credentials, access controls, and audit logging. No method of transmission over the Internet is 100% secure; we continuously improve our safeguards.

11. Children's privacy

NepFI is not directed to children under 16. We do not knowingly collect personal data from children. Contact us at [email protected] if you believe a child has provided personal data and we will delete it.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will post the revised version on this page with an updated date. Material changes will be notified by email or in-product notice where appropriate.

13. Contact

Questions about this Privacy Policy: [email protected]. Postal address: NepFI, Kathmandu, Nepal.