Privacy Policy

Last updated: June 21, 2026

This Privacy Policy explains how GPL Ventures ("we", "us", "our") collects, uses, and protects your information when you use the Corpus application ("Service"). We are committed to protecting your privacy and handling your financial data responsibly.

1. Information We Collect

Information you provide:

• Account information: Name, email address, phone number (via Clerk authentication).
• Financial information: Income, expenses, assets, liabilities, insurance details, goals, and tax information that you share through conversations or uploads.
• Portfolio data: Mutual fund holdings, stock holdings, and transaction history from CAMS statements or Account Aggregator connections.
• Conversations: Messages you send to the Corpus AI assistant.

Information collected automatically:

• Device type, operating system, and browser information.
• Usage patterns (features used, session duration).
• Error logs for debugging and service improvement.

2. How We Use Your Information

• Financial analysis: To generate personalized financial plans, portfolio reviews, tax comparisons, and recommendations.
• AI processing: Your financial data is sent to AI models (OpenAI) to generate analysis. See Section 5 for details.
• Service improvement: To improve the quality of our AI responses and features.
• Communication: To send you financial nudges, check-in reminders, and service updates (you can opt out).

3. What We Do NOT Do

• We do not sell your personal or financial data to third parties.
• We do not share your financial data with advertisers.
• We do not execute financial transactions on your behalf.
• We do not access your bank accounts directly (Account Aggregator connections are read-only and consent-based).

4. Data Storage & Security

• Cloud infrastructure: Your data is stored on Google Cloud Platform (GCP) servers in the asia-south1 (Mumbai) region.
• Encryption: Data is encrypted in transit (TLS) and at rest.
• Authentication: We use Clerk for secure authentication. We never store your password.
• Access control: Only authorized team members can access production data, and only for debugging purposes.

5. Third-Party Services

We use the following third-party services:

• OpenAI: AI model provider. Your financial data is sent to OpenAI's API for analysis. OpenAI's API data is not used to train their models (per their API terms). OpenAI API Data Policy.
• Clerk: Authentication provider. Handles sign-in, phone/email verification.
• Google Cloud Platform: Infrastructure provider (Cloud Run, Cloud SQL, Firebase Hosting).
• Sarvam AI: Speech-to-text for voice features (audio processed, not stored).

6. Gmail Integration & Google API Limited Use Disclosure

If you choose to connect your Gmail account, Corpus requests read-only access to your Gmail to search for and retrieve CAMS/KFintech mutual fund statement emails. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• We only search for emails from CAMS and KFintech containing mutual fund statements.
• We do not read, store, or process any other emails.
• We extract only the PDF attachment (portfolio statement) and parse fund holdings and transactions from it.
• We do not use Gmail data for advertising, marketing, or any purpose unrelated to portfolio import.
• We do not share Gmail data with third parties.
• Gmail OAuth refresh tokens are stored securely and deleted immediately when you disconnect Gmail from Settings.
• You can revoke access at any time from Google Account Permissions or from Corpus Settings.

7. Account Aggregator Data

If you connect your financial accounts through an Account Aggregator:

• We access your data only with your explicit consent.
• Access is read-only — we cannot modify your accounts.
• You can revoke consent at any time.
• We comply with RBI's Account Aggregator framework guidelines.

8. Your Rights

Under the Digital Personal Data Protection Act (DPDP Act, 2023), you have the right to:

• Access: Request a copy of your personal data.
• Correction: Request correction of inaccurate data.
• Erasure: Request deletion of your data and account.
• Withdraw consent: Withdraw consent for data processing at any time.
• Grievance redressal: File a complaint about data handling.

To exercise these rights, email us at contact@corpuslabs.in.

9. Data Retention

• We retain your data for as long as your account is active.
• If you delete your account, we will delete your personal and financial data within 30 days.
• Anonymized, aggregated data may be retained for analytics.

10. Children's Privacy

Corpus is not intended for users under 18 years of age. We do not knowingly collect data from minors.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes through the app or email.

12. Contact & Grievance Officer

For privacy concerns or to exercise your data rights:

Grievance Officer: Ayush Gupta
Email: contact@corpuslabs.in
Entity: GPL Ventures