Privacy Policy.

Effective date: 1 October 2026 · Version 1.1

This policy explains what personal data Nishchint collects, why we process it, how it is handled, and how you can contact us and exercise your rights. It also forms part of our notice under the Digital Personal Data Protection Act, 2023 (DPDP Act). When we ask for your consent in the app, at signup and when you connect Gmail, we show you a short itemised notice that links to this policy.

1. Who We Are

Nishchint (nishchint.ai) ("Nishchint", "we", "us", or "our") is a personal AI-powered document vault operated by Xposure Media Consulting Private Limited, a company based in India. This Privacy Policy applies to nishchint.ai, the Nishchint web and mobile applications, and related services.

We act as the data fiduciary for the personal data described in this policy, since Nishchint is a consumer product used directly by individuals (not a B2B tool processing data on a business's instructions).

Nishchint is currently available to users in India only.

Privacy questions and requests: admin@nishchint.ai

Language: this policy and our in-app notices are available in English. You can ask for them in any language listed in the Eighth Schedule to the Constitution of India by writing to admin@nishchint.ai.

2. What Nishchint Does

Nishchint helps you organize your important personal documents in one place. In short: Gmail → AI reads your documents → an organized vault with smart insights and chat.

• You sign up via phone OTP or Google Sign-In.
• You may connect your Gmail account, giving Nishchint read-only access to scan your inbox for important documents (insurance policies, bank statements, KYC documents, mutual fund statements, medical records, and similar attachments).
• You can also manually upload documents (PDF, JPEG, PNG).
• Every document is processed by AI to extract key fields (e.g. policy number, expiry date, premium amount).
• Nishchint generates actionable insights and alerts (e.g. "Your car insurance expires in 15 days").
• You can chat with your documents — asking questions like "When does my policy expire?" or "What balance is shown in this statement?"

3. What Data We Collect & Why

For each category below, we explain the information and its purpose. We process personal data on the basis of the consent you give in the app, or for a legitimate use the DPDP Act permits, such as complying with a law, a court order or statutory recordkeeping. We do not rely on a general "legitimate interest" basis, and we do not treat fraud prevention or security as a blanket exemption from consent requirements.

• Signup data — your name, phone number, email address, and country. Purpose: to create and administer your account.
• Authentication data — phone number (for OTP login) and, if you use Google Sign-In, your Google account identifier and basic profile info (name, email, profile photo) as shared by Google. Purpose: to verify your identity and secure account access.
• Gmail data — read-only access to scan your inbox for emails containing relevant document attachments (insurance, banking, KYC, investment, medical). Google's read-only permission technically covers your whole mailbox, but we only process the emails needed to identify and retrieve these documents, and we store only the relevant attachments and basic details of the emails they came from (sender, subject, and date). Processed with your consent. See Section 4 for details specific to Gmail access. Purpose: to find and import your documents, and to improve how accurately Nishchint identifies them for you.
• Uploaded & synced documents — the actual files you upload or that are fetched from Gmail (insurance policies, bank statements, KYC documents, mutual fund/investment statements, medical records, and similar), stored securely on AWS S3. Processed with your consent, to provide the vault service.
• Information about other people — documents you store may contain personal data of family members or others (for example, a spouse's insurance policy or a parent's medical record). You should only add such documents where you are entitled to manage them, for example as the policyholder or as someone the person has asked to manage their papers. We process this data only to provide the Service to you. Anyone whose information appears in your documents can contact us to exercise their rights (Section 9). Children's documents are covered separately in Section 14.
• AI-extracted data — structured fields extracted from your documents (e.g. policy numbers, expiry dates, premium amounts, account balances, diagnoses or medical details where present in medical records), using AWS Textract (for scanned/image documents) and PyMuPDF (for digital PDFs) for text extraction, and AWS Bedrock to generate insights and power the chat feature. Processed with your consent.
• Chat queries and AI responses — your questions and the answers generated about selected documents are used to provide the chat feature. Nishchint does not use your chats, documents or Gmail data to train generalised AI models.
• Billing data — where you subscribe to a paid plan, subscription payments are processed through Razorpay. Nishchint uses subscription status and relevant transaction details to administer access, payments and support. Payment information is handled through Razorpay; Nishchint does not store complete card numbers or CVVs.
• Technical data — IP address, device information, browser/app version, and cookies (web) or device identifiers (mobile). Purpose: to keep the service secure, prevent fraud and fix errors. You consent to this when you create an account, because the service cannot be run safely without it.
• Communications — messages you send to support. Purpose: to respond to and resolve your queries.

4. Gmail Access & Google API Services Disclosure

If you choose to connect your Gmail account, Nishchint requests read-only access to your inbox for the sole purpose of identifying and retrieving emails and attachments that appear to be important documents (such as insurance, banking, KYC, investment, or medical documents), so they can be added to your vault.

Nishchint's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In line with this policy, Nishchint:

• Does not use Gmail data to serve advertisements.
• Does not use Gmail data for any other purpose — than providing the user-facing document-vault feature you have requested, including fixing errors and improving how accurately it finds and reads your documents.
• Does not use Gmail data to develop, improve, or train generalised AI or machine-learning models.
• Does not allow humans to read your Gmail data, except: (a) with your explicit consent, for a specific purpose (e.g. troubleshooting a support request); (b) to comply with applicable law; or (c) where necessary for security purposes (e.g. investigating abuse).
• Does not transfer Gmail data to third parties, except to service providers who need it to operate the service on our behalf (see Section 5), who are contractually bound to the same restrictions, or where required by law.

You can revoke Nishchint's access to your Gmail at any time via your Google Account permissions page or from within the Nishchint app settings. Revoking access stops future scanning; documents already imported remain in your vault until you delete them.

5. Third-Party Services We Use

Nishchint uses the services below for the functions described. Providers may act as processors or have their own responsibilities for particular activities. We do not sell your personal data. Where a provider processes information on our behalf, its use is governed by the applicable service and data-processing terms.

6. How We Store & Protect Data

• Document storage — all uploaded and synced documents are stored on AWS S3 with AES-256 server-side encryption, with access controls restricting access to authenticated systems and personnel only.
• Database — account information and structured document information are stored in AWS RDS (PostgreSQL), with access controls.
• Credentials — access credentials and authentication tokens are handled as security-sensitive information, with safeguards intended to restrict unauthorised access.
• Authentication — access to your account is protected via JWT-based session tokens, alongside Google OAuth 2.0 or phone OTP verification at login.
• In transit — encrypted connections protect information transmitted between your device and the service.
• Access — access to personal data is restricted to authorised purposes and personnel. No storage or transmission system can be guaranteed completely secure.
• Sensitive documents — health, financial and identity documents are handled using the safeguards described above and for the purposes explained in Section 13.

7. Will Your Information Be Shared With Anyone?

In short: we only share information with your consent, to comply with law, to provide you the service, to protect rights, or to fulfil legal obligations. We never sell, rent, or trade your information.

• Vendors and service providers — listed in Section 5. Those processing information on our behalf do so for the agreed service purposes under applicable terms.
• Business transfers — if Nishchint is involved in a merger, acquisition or sale of assets, personal data may be transferred subject to applicable law and notice requirements. For Google API data covered by Limited Use requirements, we will obtain your explicit prior consent before transferring it as part of such a transaction.
• Legal compliance — where required by law, court order, or governmental authority, or to protect the rights, property, or safety of Nishchint, our users, or others.

We do not share your information with third parties for promotional or advertising purposes.

8. Data Retention

• Account data — retained while your account is active, deleted on request.
• Documents & extracted data — retained until you delete them or delete your account.
• Chat history — your questions and the AI answers are kept with the related documents, and deleted when you delete those documents or your account.
• Gmail access — we stop scanning immediately if you disconnect Gmail; previously imported documents remain until you delete them or delete your account.
• Billing records — retained for the periods required by applicable accounting, tax and other recordkeeping laws.
• Support communications — retained as needed to address your request, maintain relevant records and meet applicable legal requirements.
• Security and access logs — kept for at least one year, as the DPDP Rules, 2025 require, and longer only where needed for an investigation or another legal requirement.
• Backups — removal from active systems and expiry of backup copies are separate processes. Backup copies may remain until they expire under the applicable backup cycle, subject to legal retention requirements. Contact us for information about the treatment of a particular deletion request.
• Withdrawn consent — if you withdraw consent for a purpose, we stop that processing and erase the related personal data within a reasonable time, unless a law requires us to keep it.

You can request deletion of your account and all associated data at any time from within the app or by emailing admin@nishchint.ai. We aim to action deletion requests within 30 days, subject to legal retention obligations (e.g. billing records).

Deletion requests cover related personal information, including extracted data and associated conversations, subject to lawful retention. Upon receiving a valid request for account deletion or data erasure via the app settings or email, we will initiate the erasure process. In strict compliance with the Digital Personal Data Protection Rules, 2025, Nishchint will issue an automated 48-hour pre-erasure warning notice to your registered email address or mobile number via SMS/OTP before any personal data, AI-extracted fields, or document vault contents are permanently deleted from our active production databases.

This 48-hour window serves as a final confirmation period. During this time, you may halt or cancel the erasure request by logging back into the app or contacting support. If no counter-instruction is received within 48 hours of the notice, the data will be rendered completely inaccessible and permanently erased from our active systems within the statutory 30-day timeline.

9. Your Rights

You can exercise the following rights from Settings › Privacy in the app, or by emailing admin@nishchint.ai:

• Access — a summary of the personal data we hold about you and how we process it, the identities of the service providers and other data fiduciaries we have shared it with, and a description of the data shared.
• Correction — fix inaccurate or incomplete data.
• Erasure — delete your account, documents, and personal data.
• Withdraw consent — you can withdraw consent as easily as you gave it. Disconnect Gmail or turn off AI processing from Settings › Privacy in the app (Gmail can also be disconnected from your Google Account permissions), or email admin@nishchint.ai. Withdrawal may stop features that depend on that data; we will tell you what changes and what happens to data we already hold. It does not affect processing carried out before you withdrew.
• Grievance redressal — raise a complaint with our Grievance Officer (Section 16).
• Nominate — nominate another individual to exercise your rights on your behalf in the event of your death or incapacity.

We aim to respond to privacy requests within 30 days. We may need information to verify your identity or authority before acting. If your information appears in someone else’s documents, you may also contact us through this route.

10. Cookies

Our website does not use analytics tools, advertising cookies or tracking tools. We only use essential cookies or similar browser storage needed for authentication and security.

11. Where Your Data Is Processed

Core document storage and application databases use AWS infrastructure in India. Google services operate globally, and some service-provider processing may take place outside India. AI processing through AWS Bedrock may use India or other Asia-Pacific locations depending on the service configuration. We do not represent that all processing takes place exclusively in India. Overseas processing is subject to applicable legal restrictions. The DPDP Act permits transfers outside India except to countries the Government of India restricts by notification. If a country used by one of our providers is restricted, we will stop transfers there.

12. Data Protection and Applicable Rights

Nishchint is developing its privacy practices with India’s Digital Personal Data Protection Act, 2023 and its rules in mind. Statutory obligations and complaint routes apply according to their commencement and applicability. The controls and contact routes described in this policy are available as stated, subject to applicable law.

• We process personal data for the purposes described in this policy, on consent or another basis permitted under applicable law.
• We collect only what's needed (data minimisation) and apply the safeguards in Section 6.
• You may access, correct, and request erasure of your personal data, and you have the right to grievance redressal (Section 16).
• You may nominate another individual to exercise your rights on your behalf in case of death or incapacity.

Personal data breaches — Nishchint maintains a comprehensive incident response plan to address any accidental, unauthorized, or unlawful processing, alteration, disclosure, erasure, or loss of personal data. In the event of a confirmed personal data breach, Nishchint will act with immediate urgency. In strict compliance with Section 8(6) of the Act read alongside the applicable Digital Personal Data Protection Rules, we will notify the Data Protection Board of India (DPBI) and all affected users within seventy-two (72) hours of confirming the occurrence of such a breach.

Our notification to you will be sent directly via your registered email or phone number and will clearly detail:

• The nature and extent of the personal data breach
• The estimated consequences or potential risks resulting from the incident
• The immediate remedial measures and technical fixes deployed by Nishchint
• Proactive steps you can take to mitigate risks, including changing credentials or monitoring account sessions.

If you are not satisfied with how we handle a request, please first raise it with our Grievance Officer (Section 16). If you are still not satisfied, you may use the complaint routes available under applicable law, including the Data Protection Board of India once its complaint mechanism applies.

13. Sensitive Data — Health, Financial & Identity Documents

Nishchint processes categories of data that deserve extra care:

• Medical/health records — treated as sensitive data. We process this only with your explicit consent, solely to provide the vault and insight features you requested, and never for advertising or profiling unrelated to the service.
• KYC/government ID documents — (e.g. Aadhaar, PAN, passport) are stored with the same access controls as all documents and are never shared with third parties except as required to provide the service (e.g. AI extraction) or by law.
• Financial documents — bank statements, mutual fund statements, and similar are used only to generate the insights and chat features you use; we do not sell or share this data for marketing purposes.

14. Children's Data

Nishchint accounts are for adults aged 18 or above. Many users keep documents about their children, such as school records or a child's medical report. Under the DPDP Act, we need the verifiable consent of a parent or lawful guardian before we process a child's personal data.

• Verification — before a document relating to a child is added or imported from Gmail, we ask you to confirm that you are the child's parent or lawful guardian, and verify this [using reliable identity details or a DigiLocker-based check].
• Documents held back — until verification is complete, documents we identify as relating to a child are held back and are not processed by AI.
• No tracking — we do not track or monitor children's behaviour, or use their data for advertising or targeted content.

If you believe a child's information has been added without proper authority, contact admin@nishchint.ai and we will assess it and delete it where appropriate.

15. Changes to This Policy

We may update this Privacy Policy and post the revised version here. For material changes, we will notify you through the app or website before they take effect. Where a change requires fresh consent, including a new consent-based processing purpose, we will obtain that consent before starting the changed processing. Continued use alone does not constitute consent to a new processing purpose.

16. Contact & Grievance Officer

For any privacy question, data request, or grievance under the Indian DPDP Act, 2023:

The Service is currently offered only to users in India.