Privacy Policy

1. Information we collect

• Account information: name, email address, phone number, authentication details, and account preferences.
• Financial information: portfolio, holdings, transactions, goals, and information contained in documents you choose to upload or import.
• Google account information: your Google email address, OAuth credentials, and the Gmail data described in Section 5 when you choose to connect Gmail.
• Usage and technical information: device, browser, IP address, diagnostic logs, feature usage, and security events.
• Communications: information you provide when you contact support or otherwise communicate with us.

2. How we use information

We use information to:

• provide, operate, secure, and improve Corpus;
• authenticate users and maintain account access;
• import and organize financial information at your request;
• generate portfolio analysis and educational information;
• respond to support requests and service communications;
• prevent fraud, abuse, and security incidents; and
• comply with applicable law and enforce our agreements.

3. How we share information

We do not sell your personal information. We may share information only in the following circumstances:

• Service providers: vendors that help us provide authentication, cloud hosting, document processing, analytics, communications, customer support, and AI-assisted analysis. They may process information, including relevant Google user data, only to provide user-facing Corpus features and under contractual confidentiality and security obligations.
• Legal and safety reasons: when reasonably necessary to comply with law, protect rights and safety, investigate abuse, or respond to a lawful request.
• Business transfers: as part of a merger, financing, acquisition, reorganization, or sale of assets, subject to appropriate confidentiality protections.
• With your direction: when you ask us to share information or clearly consent to it.

4. AI-assisted features

Some Corpus features use AI service providers to generate portfolio explanations, inbox insights, or educational analysis. When you use those features, relevant financial information, selected message content, and prompts may be sent to those providers to generate the user-facing result. We do not use Google user data to train generalized AI models. AI output can be incomplete or inaccurate and should not be treated as investment, tax, or legal advice.

We do not permit service providers to use your personal information for their own advertising. Their handling of data is also governed by their terms and our agreements with them.

5. Gmail connection and Google API data

When you expressly choose to connect Gmail, Corpus requests read-only Gmail access to provide statement import and inbox-intelligence features inside Corpus.

• What we access: messages and attachments relevant to supported user-facing features. These can include CAMS or KFintech statements, mutual-fund and dividend updates, bank and credit-card alerts or statements, deposits, tax records, subscriptions, purchases, travel, and other supported financial or activity records.
• What we store: OAuth credentials; Gmail message and thread identifiers; sender, subject, snippet, labels, and received date; relevant message content or attachments; parsed records; and insights generated for your Corpus account.
• How we use it: to import portfolio records, organize supported activity, identify useful events, and create financial or activity insights that are visible to you in Corpus.
• AI processing: relevant message content may be sent to an AI service provider solely to create or improve the user-facing Corpus feature you requested. It is not used to train generalized AI or advertising models.
• Corpus does not send emails, modify messages, or delete messages from your Gmail account.
• Corpus does not sell Gmail data or use it for advertising, retargeting, lending, or determining creditworthiness.
• Humans do not read Gmail data except with your affirmative agreement to view specific data for support, when necessary for security, when required by law, or when data has been aggregated for permitted internal operations.
• We retain the OAuth token while your Gmail connection remains active. You can disconnect Gmail to revoke future access.

6. Retention and deletion

We retain personal information only for as long as reasonably necessary to provide the service, meet legal and security obligations, resolve disputes, and enforce agreements.

Disconnecting Gmail stops future access and initiates deletion of stored Gmail tokens, message metadata, parsed email artifacts, and Gmail-derived insights. Financial records already imported into your Corpus portfolio may remain part of your account until you delete them or request account deletion, because they may also have been uploaded or confirmed by you independently of Gmail.

7. Security

We use administrative, technical, and organizational safeguards designed to protect personal information. No method of storage or transmission is completely secure, so we cannot guarantee absolute security.

8. Your choices and rights

Depending on applicable law, you may request access to, correction of, or deletion of your personal information, withdraw consent, or raise a privacy concern. You can also disconnect Gmail through the product or your Google Account permissions.

To exercise a privacy right, contact us at contact@corpuslabs.in. We may need to verify your identity before completing a request.

9. Children

Corpus is not intended for anyone under 18 years of age. We do not knowingly collect personal information from children.

10. Changes to this policy

We may update this policy as our services or legal obligations change. We will post the updated policy here and revise the effective date. If a change materially affects your rights, we will provide additional notice where required.

11. Contact us