Your money data, handled with care.

Kosh is a product of Primedepth Labs (“we”, “us”), a partnership firm registered in India. For the personal data described in this policy, we are the Data Fiduciary under the Digital Personal Data Protection Act, 2023 (the “DPDP Act”).

Registered name

PRIMEDEPTH LABS

GSTIN

03ABGFP4193E1ZD

Principal place of business

Floor 4, R1 of D180-C, Industrial Area, Phase 8B, Sector 74, Mohali, SAS Nagar, Punjab 160055, India

Privacy questions

contact@trykosh.com

Information you give us

• Account details: your name and email address, plus either a password (we store only a salted hash, never the password itself) or, if you continue with Google, the name, email address, profile photo link and account ID Google shares with us. We never receive your Google password or access to your Gmail, Drive or contacts.
• Profile: anything you tell us during onboarding or later, such as age, city, occupation, monthly income, dependents, risk appetite, financial priorities, and tax details like salary structure, rent and deductions.
• Statements and documents: bank, credit card, investment, loan or salary documents you upload, and their contents: transactions, balances, holdings, account labels, the last four digits of account or card numbers, and the account holder's name as printed.
• Conversations: the questions you ask Kosh and its answers.
• Newsletter: your email address, if you sign up for updates.

Information Kosh creates from it

Categorised transactions, monthly summaries, net worth, recommendations, goals, reminders, tax estimates, the screens Kosh designs for you, and the emails it writes to you.

Information collected automatically

• A single session cookie that keeps you signed in (see Cookies).
• Your IP address, used only in hashed form to limit abuse such as repeated sign-up or sign-in attempts.
• Basic technical logs (time, page or endpoint, errors) kept by our hosting provider to run and secure the service.

What we never collect

Internet-banking credentials, OTPs, UPI or card PINs, full card numbers or CVVs. Payment details are entered directly with our payment partner, Dodo Payments, and never reach us. Passwords for locked PDF statements are used only inside your browser to open the file; only the unlocked text is uploaded.

We use your personal data only for these purposes:

• To provide Kosh: reading your statements, organising your money, calculating tax under both regimes, designing your screens, answering your questions and tracking goals.
• To send the emails you've chosen: reminders, digests, statement reviews and, on Pro, the morning market brief. You can change these in Settings at any time.
• To run billing for paid plans through Dodo Payments.
• To keep Kosh secure, prevent fraud and abuse, and fix problems.
• To meet legal obligations, such as tax record-keeping and responding to lawful requests.

We do not sell or rent your data, use your financial data for advertising, share it with lenders or insurers for marketing, or use your statements to train AI models. If you allow it, we measure our own ads with Meta as described in Analytics and ads measurement. Kosh's recommendations are educational and are never used to make decisions about you that have legal or similar effects.

We process your personal data on the basis of the consent you give when you create your account and each time you upload a document (DPDP Act, section 6). Some processing is a legitimate use under section 7, for example keeping invoices to meet tax law or responding to a court order.

You can withdraw consent at any time by deleting documents or your account, or by writing to contact@trykosh.com. Withdrawing consent doesn't affect processing that happened before, but we won't be able to run Kosh for you without it.

Kosh is powered by large language models. To read a statement, write your review, design a screen, compose an email or answer a question, we send the relevant data (for example the statement's text or file, or a summary of your finances) to our AI provider, which returns a result to us.

• Current provider: DeepSeek (Hangzhou DeepSeek Artificial Intelligence Co., Ltd.), through its API. Its servers may be located outside India, including in the People's Republic of China.
• Web research: to keep tax rules and market briefs current, Kosh searches the public web through the same provider. These searches are about general topics (tax law, markets) and don't contain your statements; a search started from your question in chat may include words from that question.
• We send only what each task needs, over encrypted connections, and we don't permit our AI provider to use your data for advertising.

We may change AI providers to improve quality, cost or data location. We'll update this policy and tell you before a change that moves your data to a new country.

We share personal data only with service providers who process it on our behalf (Data Processors), under contract and for the purposes above:

We may also disclose data when required by law or by a lawful order of a court or government authority, to protect the rights and safety of our users or the public, or as part of a merger or acquisition, in which case this policy will continue to apply.

We advertise Kosh on Facebook and Instagram. To learn which ads help people find Kosh, and to show our ads to people more likely to find it useful, we use Meta's Pixel and Conversions API, only if you allow it in the banner shown on your first visit.

• What Meta receives: the pages you visit on our website and these milestones: creating an account, starting checkout, starting a trial, payments, and your first statement being read. With them we send your email address and account ID in hashed (scrambled) form, your IP address, browser type and Meta's own click and browser identifiers.
• Google Analytics: we use Google Analytics to count visits and see which pages and features help. Page addresses are sent without their query strings, so things like a question you type to your CFO never reach Google. Until you allow measurement, Google Analytics runs in a cookieless mode that sends anonymous pings without identifiers; once you allow it, it sets its _ga cookies and also receives the milestones above, without your email.
• What Meta and Google never receive: your statements, transactions, balances, tax details, conversations or anything else about your money.
• Campaign cookie: when you arrive from an ad or link, we store which campaign brought you (UTM parameters and click ID) in a first-party cookie, kosh_attr, for 90 days, so we can see which campaigns lead to sign-ups.
• Changing your mind: clear the kosh_consent cookie for our site to see the banner again, or write to contact@trykosh.com and we'll stop sending your events.

Meta and Google process this data under their own terms and privacy policies. Declining doesn't change anything about how Kosh works for you.

As the table shows, some processing happens outside India. The DPDP Act permits this except to countries the Central Government restricts by notification. We monitor these notifications and will move processing if a country we use is restricted. By using Kosh you consent to these transfers.

• Account, profile and financial data: for as long as your account is open.
• Statement files and what was read from them: until you delete the statement or your account.
• After you delete your account: we erase your personal data within 30 days, including statement files. Encrypted backups are overwritten in their normal cycle.
• Billing records: kept for as long as tax law requires (under GST law, generally six years from the relevant annual return), even after you leave.
• Security logs: up to 90 days.

Data is encrypted in transit and at rest. Statement files sit in private storage that browsers can't read, the database is closed to public access, and passwords are stored as salted hashes. Read the full picture on our Security page. No system is perfectly secure; if a breach affects you, we'll inform you and the Data Protection Board of India as the law requires.

Under the DPDP Act you have the right to:

• Access a summary of the personal data we process and the processing we do. Use Settings → Download my data for a complete copy.
• Correct, complete or update your data. Most of it is editable in the app; for anything else, write to us.
• Erase your data. Delete any statement from the Statements page, or everything with Settings → Delete my account.
• Grievance redressal through our Grievance Officer (below).
• Nominate someone to exercise these rights if you die or become incapable. Email us with their details.
• Withdraw consent at any time, as described above.

We respond to requests within 15 days. If you're not satisfied with how we handled a grievance, you may complain to the Data Protection Board of India.

Kosh is for adults aged 18 and over. We don't knowingly process the personal data of children. If you believe a child has created an account, write to contact@trykosh.com and we'll delete it.

If we make material changes, we'll tell you by email or in the app before they take effect. The date at the top shows when this policy last changed.

Questions, requests or complaints about your personal data can go to:

Grievance Officer

Harjaap Singh Dhillon, Partner and Grievance Officer

Email

contact@trykosh.com

Privacy requests

contact@trykosh.com

Post

Primedepth Labs, Floor 4, R1 of D180-C, Industrial Area, Phase 8B, Sector 74, Mohali, SAS Nagar, Punjab 160055, India

Response time

Acknowledged within 24 hours; resolved within 15 days