Privacy policy

RubricRise (rubricrise.com) is operated from India. This policy explains what we collect, why, and your rights under the Information Technology Act 2000 (SPDI Rules 2011) and the Digital Personal Data Protection Act 2023.

Your bank statements

• Digital PDFs are processed in your browser. The file, its password and the extracted transactions stay on your device. They are not uploaded to our servers.
• Scanned pages (AI extraction) are optional. If you click “Extract with AI”, the page image or text is sent over TLS to our server and to our AI provider (Anthropic), processed in memory, and discarded. It is not stored, logged or used to train models.
• Exports are generated on your device and downloaded directly.

What we do store

• Account data: your email address, sign-in tokens and timestamps.
• Billing data: orders, amounts, Razorpay order and payment identifiers, page-pack balances. Card and UPI details are handled by Razorpay and never reach us.
• Usage metadata: file name, page count, bank name detected, row count, success or failure, and a random visitor identifier used for the daily free allowance. Never the transactions themselves.
• A fingerprint of your network address, made with a secret key (never the address itself), used only to limit free AI pages per network. It changes every day and is deleted after a few days.
• Support messages you send us.
• Product analytics events (page viewed, file parsed, export clicked) tied to the visitor identifier. For a page view we keep the page, the name of the site that sent you (for example google.com, never the full address), campaign tags in the link you followed (such as an ad click identifier) and whether you are on a phone, tablet or computer.
• Layout details, only when a statement does not convert cleanly, so we can support more bank formats: the column headings, the date and amount formats (for example “99/99/9999”, never the dates or amounts themselves), where the columns sit on the page, the name of the software that made the PDF and the bank’s four-letter IFSC code. Never names, account numbers, descriptions, amounts or dates.
• Error reports: when something fails on our servers we record the error, the page and the visitor identifier so we can fix it. Errors during AI extraction are recorded without their message, so no statement content is ever kept.

Cookies and advertising measurement

We set a session cookie when you sign in and a visitor cookie for the free allowance. With your consent we load Google Ads conversion measurement so we know which adverts bring paying customers; when you buy, we share a hashed email with Google for enhanced conversions. You can decline in the cookie banner; the service works the same either way. We never share statement contents with any advertising service.

Sub-processors

Vercel (hosting), Neon (database), Razorpay (payments, India), Resend (transactional email), Anthropic (AI extraction, only for pages you submit), Google (ads measurement, with consent).

Retention

Account and billing records are kept for 8 years to meet Indian tax law. Usage metadata is kept for 24 months. Sign-in links and codes expire after 20 minutes. You can ask us to delete your account at any time; we will keep only what tax law requires.

Your rights

You can access, correct or erase your personal data and withdraw consent by emailing grievance@rubricrise.com. Our grievance desk is reachable at that address; complaints are acknowledged within 24 hours and resolved within 15 days. You may also approach the Data Protection Board of India.

Security

All traffic is encrypted with TLS. Secrets are stored in environment variables, access is limited to the operator, and payment signatures are verified server-side. Report security issues to grievance@rubricrise.com.

Children

The service is intended for professionals and is not directed at children under 18.

Changes

We will post changes here with a new date. Material changes will be emailed to account holders.