Privacy Policy

Last updated: 18 June 2026

1. Who We Are

This Privacy Policy explains how Trenx Digital (“we”, “us”, “our”), the operator of MunshAI at www.munshai.com (the “Service”), collects, uses, shares, and protects your personal data. We are the Data Fiduciary under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) in respect of the personal data we process about you.

Registered office for notice: Trenx Digital, Plot no 29, Road A-14, Near DLF Phase 1 Metro Station, DLF Phase 1, Gurugram, Haryana 122002, India.

2. What Data We Collect

2.1 Data you provide directly

• Account data: full name, email address, password (hashed), phone number (optional), Google OAuth identifier (if you sign in with Google)
• Workspace data: organisation name, role, invitation relationships
• Financial data: transactions, parties, loans, EMIs, receivables, payables, attached files, transaction notes, privacy flags
• Payment data: billing name, billing address, GSTIN (optional). Card data is collected and stored by our payment gateway (Razorpay), not by us.
• Support data: any information you share in support emails or chat

2.2 Data we collect automatically

• Technical data: IP address, browser type, device identifiers, language, session timestamps
• Usage data: pages visited, features used, error logs, API requests
• Authentication data: session cookies, login history

2.3 Data we do NOT collect

• We do not buy personal data from data brokers
• We do not run third-party advertising or tracking cookies
• We do not collect biometric data
• We do not collect data about children below 18

3. Lawful Basis and Purpose of Processing

We process your personal data under the following lawful bases as defined in the DPDP Act:

• Your consent (Section 6, DPDP Act) — for creating your account, sending you marketing emails (you can opt out anytime), and AI processing by the CFO Assistant
• Legitimate use for performance of the Service — for delivering the features you signed up for, billing, support, security, and fraud prevention
• Compliance with law — for retaining tax invoices and responding to legal requests

4. How We Share Your Data

We share your data only with the following categories of recipients, strictly for the purposes described:

4.1 Service providers (Data Processors)

Each processor is bound by contractual confidentiality and data-protection terms. We perform reasonable due diligence on each before engagement.

4.2 Within your workspace

Members of your workspace can see your data based on their role. The workspace owner has full visibility. Other roles have limited visibility based on the permissions you grant. Data marked as “private” by the workspace owner is hidden from all roles except the Owner and Co-Owner.

4.3 Legal disclosures

We may share data if required by Indian law, a court order, or a request from a competent authority. Where lawful, we will notify you first.

4.4 Sale / merger

If Trenx Digital is acquired, merges, or transfers MunshAI to another entity, your data may be transferred to the new operator under the same privacy commitments.

5. Cross-Border Data Transfer

Some of our service providers (Supabase, Vercel, Anthropic, Resend) are located outside India. By using the Service, you consent to your data being transferred to and processed in those countries. We rely on contractual safeguards with each provider to maintain the protections required under the DPDP Act.

6. Data Retention

• Active accounts: retained while you use the Service
• Closed accounts: User Content deleted within 30 days of closure, except as required by law
• Tax invoices: retained for 8 years (required under Indian tax law)
• Audit logs and security logs: retained for 12 months
• Backups: rolling 30-day window, automatically purged

7. Security Measures

We take reasonable technical and organisational measures to protect your data, including:

• TLS encryption in transit
• Encryption at rest for the database
• Role-based access controls (RBAC) within the Service
• Row-level security (RLS) enforced at the database layer
• Password hashing with industry-standard algorithms
• Audit logging of sensitive operations
• Quarterly security review of access privileges

No system is perfectly secure. If a breach occurs that materially affects your personal data, we will notify the Data Protection Board of India and affected users without undue delay, as required by Section 8(6) of the DPDP Act.

8. Your Rights Under the DPDP Act

You have the following rights:

• Right of access: request a summary of personal data we hold about you
• Right of correction: request correction of inaccurate data
• Right of erasure: request deletion of your data (subject to legal retention)
• Right of grievance redressal: contact our Grievance Officer (below) with concerns
• Right to nominate: nominate someone to exercise these rights on your behalf in the event of death or incapacity
• Right to withdraw consent: withdraw any consent you previously gave, where applicable

To exercise any right, email privacy@munshai.com. We will respond within 30 days.

9. Grievance Officer

In accordance with Rule 5 of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 and Section 8(9) of the DPDP Act:

Name: Guruansh Chanana
Designation: Grievance Officer, Trenx Digital
Email: grievance@munshai.com
Address: Plot no 29, Road A-14, Near DLF Phase 1 Metro Station, DLF Phase 1, Gurugram, Haryana 122002, India
Response time: within 7 business days of receipt

10. Cookies

We use only essential cookies required for authentication and session management. We do not use third-party analytics, advertising, or tracking cookies. Our cookie notice appears on your first visit; dismissing it records your acknowledgement.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified to you by email and via the Service at least 14 days before they take effect. The “Last updated” date at the top reflects the current version.

12. Contact

Privacy questions: privacy@munshai.com

Grievance Officer: grievance@munshai.com

General support: support@munshai.com