Privacy Policy

This privacy notice for Bit-Er Devs ("we," "us," or "our") describes how and why we might collect, store, use, and/or share ("process") your information when you use our services ("Services"), such as when you:

• Download and use our mobile application, SmartFinBot, available on Android and iOS.
• Interact with the app through text or voice to manage your personal finances, including expenses, income, bills, loans, and budgets.
• Engage with us in other related ways, including feedback, support, or any other communication.

Questions or concerns? Reading this privacy notice will help you understand your privacy rights and choices. If you do not agree with our policies and practices, please do not use our Services. If you have any questions or concerns, please contact us at contact.bit.er@gmail.com.

This summary provides key points from our privacy notice. You can find more details by reviewing the full sections below.

• What personal information do we process? When you use SmartFinBot, we collect personal and financial information you provide directly, such as your name, email, and financial records (expenses, income, loans, and bills). We also automatically collect limited device and usage data.
• Do we process any sensitive personal information? We collect and process financial data which may be considered sensitive. We handle this data only to provide core app functionality and do not use it for advertising or profiling.
• Do we receive any information from third parties? If you choose to sign in using Google, we may receive basic profile information (name and email) from Google. We do not buy data from third-party data brokers.
• How do we process your information? We process your information to deliver the app's features, maintain security, send reminders and notifications, generate financial insights, and keep your account working properly.
• In what situations do we share personal information? We do not sell your data. We may share limited data with service providers (such as Firebase for notifications and cloud infrastructure for hosting) only to operate the app.
• How do we keep your information safe? We use JWT-based authentication, encrypted data storage in PostgreSQL, and HTTPS for all communications. No system is 100% secure, but we take reasonable steps to protect your data.
• What are your rights? You may access, update, or delete your account and data at any time through the app or by contacting us.

• 1. What information do we collect?
• 2. How do we process your information?
• 3. What legal bases do we rely on to process your information?
• 4. When and with whom do we share your personal information?
• 5. What is our stance on third-party services?
• 6. Do we use cookies and other tracking technologies?
• 7. How do we handle your social logins?
• 8. Is your information transferred internationally?
• 9. How long do we keep your information?
• 10. How do we keep your information safe?
• 11. Do we collect information from minors?
• 12. What are your privacy rights?
• 13. Controls for do-not-track features
• 14. Do we make updates to this notice?
• 15. How can you contact us about this notice?
• 16. How can you review, update, or delete the data we collect from you?

Personal information you disclose to us

In Short: We collect personal information that you provide to us directly.

We collect personal information that you voluntarily provide when you register an account on SmartFinBot, use the chatbot or manual entry features, or contact us for support. The personal information we collect includes:

• Account information: your name, email address, and password (stored in hashed form).
• Financial data: expenses, income records, loan details (amount, interest rate, due dates), bill records, budget limits, and transaction categories.
• Chatbot conversation input: the text or voice queries you type or speak to interact with the financial assistant.
• Reminder and notification preferences: dates and settings you configure for bill reminders, loan repayment alerts, and budget overspending warnings.

Sensitive Information

SmartFinBot processes financial data which may be considered sensitive personal information. This includes expense amounts, income records, loan balances, and bill payment statuses. We process this data solely to provide the app's core financial management features. We do not use this data for advertising, profiling, or any purpose outside the app.

Application Data

When you use the SmartFinBot mobile app, we may collect the following with your permission:

• Microphone access: We request microphone access on your device to enable voice input via Speech-to-Text (STT). This conversion happens on your device. We do not store raw audio recordings on our servers.
• Push notification permission: We request permission to send you push notifications for bill due dates, loan repayments, and budget alerts via Firebase Cloud Messaging (FCM).
• Mobile device data: We automatically collect your device ID, operating system version, app version, and basic device model information. This is used for troubleshooting and ensuring app compatibility.

Information automatically collected

In Short: Some information is collected automatically when you use the app, such as usage logs and device identifiers.

We automatically collect certain information when you use SmartFinBot. This includes:

• Log and usage data: server logs that record when you use the app, which features you access, timestamps of requests, and any error reports. This helps us maintain and improve the app.
• Device data: device type, operating system, app version, and Internet Protocol (IP) address used to connect to our servers.
• Session data: conversation context and session state stored temporarily in Redis cache to support multi-turn chatbot conversations. This session data is temporary and is not permanently retained.

All personal information that you provide to us must be true, complete, and accurate. You must notify us of any changes to such personal information.

In Short: We process your information to provide and improve the app, communicate with you, ensure security, and comply with applicable law.

We process your personal information for the following reasons:

• To create and manage your account: We use your email and password to authenticate you securely using JWT (JSON Web Token) based authentication.
• To provide the financial management features: We process the financial data you enter (expenses, income, loans, bills, budgets) to store, organize, retrieve, and display it within the app.
• To power the AI chatbot: We process your text and voice queries through our BERT-based NLP model to understand your intent and extract financial entities, so the chatbot can respond accurately and perform requested actions.
• To generate financial insights and predictions: We analyze your historical transaction data to generate spending summaries, trend analyses, budget comparisons, and spending predictions using our BiLSTM-based forecasting model.
• To send reminders and notifications: We use your bill due dates, loan repayment schedules, and budget configurations to send automated push notifications via Firebase Cloud Messaging.
• To export reports: We process your financial data to generate exportable PDF and CSV reports upon your request.
• To protect our services: We process usage logs and authentication tokens to detect and prevent unauthorized access, fraud, or abuse.
• To troubleshoot and improve the app: We use error logs and usage data to fix bugs and improve the performance of the app.
• To respond to your support requests: If you contact us, we use the information you provide to respond to your query.
• To comply with legal obligations: We may process your information when required by applicable law or a lawful government request.

In Short: We process your information only when we have a valid legal reason to do so.

The legal bases we rely on to process your personal information include:

• Consent: We process your information when you give us permission to do so, such as when you agree to this privacy notice at account registration, or when you grant the app microphone or notification permissions on your device. You may withdraw your consent at any time by contacting us or adjusting your device settings.
• Performance of a contract: We process your financial data to fulfill the core functions of the app that you signed up for, including tracking expenses, income, loans, and bills.
• Legitimate interests: We process limited usage and device data to maintain the security and reliability of the app, fix technical issues, and improve features. We only do this where our interests do not outweigh your privacy rights.
• Legal obligations: We may process or retain certain information if required by applicable law, regulatory authority, or court order in Nepal or the applicable jurisdiction.

If you are located in the European Economic Area (EEA) or United Kingdom (UK), the GDPR and UK GDPR also apply. We rely on the same legal bases described above. You may contact us for more details about the specific legal basis for any particular processing activity.

In Short: We do not sell your data. We may share limited information with third-party service providers who help us operate the app.

We do not sell, rent, or trade your personal information to third parties for commercial purposes. We may share your data only in the following limited situations:

• Cloud infrastructure and hosting providers: Our backend is hosted on cloud servers. These providers may have access to encrypted data stored in our PostgreSQL database as part of their hosting services. They are bound by data protection agreements.
• Firebase (Google): We use Firebase Cloud Messaging (FCM) to deliver push notifications to your device for bill reminders, loan alerts, and budget warnings. Firebase may process your device token and notification content. Please refer to Google's Privacy Policy at https://policies.google.com/privacy for more information.
• Google (for social login): If you choose to sign in with Google, we receive your name and email address from Google's authentication service. We do not receive your Google password or any other Google account data beyond what is needed for login.
• Business transfers: In the event of a merger, acquisition, or sale of all or part of the project, user data may be transferred to the new entity. We will notify users before such a transfer occurs.
• Legal requirements: We may disclose your information to government authorities, law enforcement, or regulators if required by applicable law, court order, or legal process in Nepal or the relevant jurisdiction.

We do not share your financial data (expenses, income, loans, bills, or budgets) with any third party for advertising, marketing, or analytics purposes.

We may use user data across services operated by Bit-Er Devs to improve our products, develop new features, conduct research, and enhance user experience.

In Short: We are not responsible for the privacy practices of third-party services that we link to or integrate with.

SmartFinBot integrates with a small number of third-party services to operate (Firebase for notifications, Google for optional social login). These third parties have their own privacy policies and we are not responsible for their data practices. We recommend reviewing their privacy policies directly.

The app does not display third-party advertisements. We do not use advertising networks, retargeting platforms, or affiliate marketing programs.

In Short: We use session tokens and caching to keep your app session working. We do not use advertising cookies or cross-site tracking.

SmartFinBot is a mobile application. We do not use browser cookies. However, we do use the following session and caching mechanisms:

• JWT tokens: When you log in, we generate a JWT access token and a refresh token. These are stored securely on your device and sent with each API request to authenticate you. They expire after a set period.
• Redis session cache: We use Redis to temporarily cache your conversation context during a chatbot session. This allows the chatbot to remember the current conversation flow (for example, to combine details shared across multiple messages into a single transaction). This cache is temporary and is cleared when the session ends.

We do not use tracking pixels, web beacons, advertising cookies, or any cross-app tracking technologies.

In Short: If you choose to log in with Google, we receive only your name and email from Google to create your account.

SmartFinBot offers the option to register and log in using your Google account. If you choose to do this, we will receive your name and email address from Google. We use this information only to create and maintain your SmartFinBot account.

We do not receive your Google password, contacts, calendar data, or any other Google account information. We do not post anything to your Google account on your behalf.

Please note that Google's use of your information is governed by Google's Privacy Policy, not this notice. We recommend reviewing Google's policy at https://policies.google.com/privacy.

In Short: Your information may be stored and processed on servers outside Nepal depending on our cloud hosting provider.

SmartFinBot is developed and maintained by Bit-Er Devs as a training and research project. Depending on the cloud infrastructure used, your data may be stored on servers located in other countries. Where this occurs, we take reasonable steps to ensure your data is protected in accordance with this privacy notice.

If you are accessing the app from outside Nepal, please be aware that your information may be transferred to and processed in Nepal or other countries where our servers are located.

If you are located in the European Economic Area (EEA), United Kingdom (UK), or any region with strict data transfer rules, we will take appropriate measures to protect your personal information in line with applicable data protection laws.

In Short: We keep your information for as long as your account is active or as needed to provide the service.

We keep your personal and financial data for as long as you maintain an active account with SmartFinBot. This includes your profile information, financial records, budgets, loans, and bill data.

If you delete your account, we will delete or anonymize your personal data within a reasonable period, unless we are required by law to retain it for a longer period (for example, for tax, legal, or compliance reasons).

Session data (stored in Redis cache during chatbot interactions) is temporary and is automatically cleared when the session ends or expires. It is not permanently retained.

Device tokens used for push notifications are retained for as long as you keep the app installed and notifications enabled. Removing the app or revoking notification permissions will result in the token being removed from our system.

In Short: We use technical and organizational measures to protect your information, but no system is 100% secure.

We have implemented the following security measures to protect your personal and financial data:

• Authentication: All users are authenticated using JWT (JSON Web Token) with short-lived access tokens and refresh tokens. Passwords are stored in hashed form and are never stored in plain text.
• Encrypted transmission: All communication between the app and our backend uses HTTPS/TLS encryption to prevent interception.
• Database security: Financial data is stored in a PostgreSQL database with access controls. Only authenticated API requests can access user data.
• Session security: Conversation context is stored in Redis with short expiry times to minimize exposure. Session data is not permanently retained.
• Access controls: Backend API access is restricted using role-based controls. Sensitive endpoints require valid JWT authentication.

However, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure. We cannot promise or guarantee that unauthorized third parties will never be able to defeat our security measures. You should only access the app within a secure network environment and keep your login credentials confidential.

In Short: We do not knowingly collect data from children under 18 years of age.

SmartFinBot is not intended for use by children under 18 years of age. We do not knowingly collect, solicit, or market to children under 18. By using the app, you represent that you are at least 18 years old.

If we learn that we have accidentally collected personal information from a user under 18, we will deactivate that account and delete the associated data promptly. If you become aware of any such data we may have collected, please contact us at contact.bit.er@gmail.com.

In Short: You have the right to access, correct, or delete your personal data, and to withdraw consent at any time.

Depending on your location, you may have the following rights regarding your personal information:

• Right to access: You can request a copy of the personal information we hold about you.
• Right to correction: You can update or correct inaccurate information in your account at any time through the app's profile settings.
• Right to deletion: You can request that we delete your account and all associated personal data.
• Right to restrict processing: You can request that we stop or limit how we process your personal information in certain circumstances.
• Right to data portability: You can request your financial data in a machine-readable format (the app supports CSV and PDF export).
• Right to withdraw consent: If we are processing your information based on your consent (for example, notification permissions or microphone access), you can withdraw your consent at any time through your device settings. This will not affect processing that already took place before the withdrawal.
• Right to opt out of notifications: You can turn off push notifications at any time in your device settings. This will not affect your ability to use the app's other features.

Account Information

To review or update your account information, log in to the app and go to your Profile settings. To delete your account entirely, contact us at contact.bit.er@gmail.com.

Upon receiving a deletion request, we will deactivate and delete your account and data from our active systems. We may retain some data in backup archives temporarily before it is purged.

For questions about your privacy rights, email us at contact.bit.er@gmail.com.

SmartFinBot is a mobile application and does not track your browsing activity across other apps or websites. We do not respond to Do-Not-Track (DNT) signals because we do not engage in cross-site or cross-app tracking in the first place.

If a uniform standard for responding to DNT signals is adopted in the future, we will update this notice to reflect our practices.

In Short: Yes, we will update this notice as needed to stay compliant with applicable laws and reflect changes to the app.

We may update this privacy notice from time to time. The updated version will be indicated by a revised date at the top of this notice. If we make material changes, we may notify you through a push notification or a prominent notice within the app.

We encourage you to review this privacy notice periodically to stay informed about how we are protecting your data.

If you have questions or concerns about this privacy notice, you may contact us at:

Bit-Er Devs
SmartFinBot — Training and Research Project
smartfinbot.biterdevs.com
contact.bit.er@gmail.com

We will respond to your request within a reasonable timeframe, typically within 14 business days.

You have the right to review, update, correct, export, or delete the personal information we collect and store about you.

You may review and update your account information directly within the SmartFinBot app by navigating to the Profile or Account Settings section. Depending on available features, you may update information such as your name, password, profile details, and notification preferences.

SmartFinBot also provides an in-app account deletion option. You may permanently request deletion of your account and associated personal data directly through the application settings.

After submitting an account deletion request, your account will be deactivated and scheduled for deletion. We may retain your data for up to thirty (30) days to allow account recovery if requested during that period. After the retention period expires, your account and associated personal data will be permanently deleted from our active systems, subject to applicable legal, regulatory, fraud prevention, security, and backup retention obligations.

You acknowledge that permanently deleted data may not be recoverable, and SmartFinBot shall not be responsible for any loss of data resulting from account deletion requests initiated by you.

Where available, you may export or download certain financial records, reports, or account data from within the app in supported formats such as PDF or CSV.

For additional privacy-related requests, support issues, or questions regarding your personal data, you may contact us at contact.bit.er@gmail.com.