1. Introduction
FINKRAFT AI LIMITED is a company registered in the Dubai International Financial Centre (DIFC), Dubai, United Arab Emirates (UAE), under Registration No. 12916 and Licence CL12916, together with our Indian affiliate, Travel Input Consultant Private Limited. We provide e-invoicing, tax reclaim and invoice-linked payment services to businesses. All references in this policy to “Finkraft.ai”, “our”, “us” or “we” refer to FINKRAFT AI LIMITED and Travel Input Consultant Private Limited, as the context requires.
We are committed to protecting and safeguarding the Personal Information of all users of our Website and Services, including customers, account users, prospects, job applicants and individuals named in our customers’ records (“users”, “you”, “your”). “Personal Information” means any information that identifies you directly, such as your name or work email, or that can reasonably be linked to you, such as an account ID or an Internet Protocol (IP) address.
This Privacy Policy is published in compliance with, among others:
- DIFC Data Protection Law No. 5 of 2020, as amended by DIFC Laws Amendment Law No. 1 of 2025, and the DIFC Data Protection Regulations;
- the UAE Electronic Invoicing System framework under Ministerial Decisions No. 243 and No. 244 of 2025, and Federal Decree-Law No. 28 of 2022 on Tax Procedures, for e-invoicing and tax records we handle for UAE customers;
- for our Indian operations, Section 43A of the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023 (DPDP Act); and
- the EU General Data Protection Regulation (GDPR), where it applies to you.
2. Applicability of this Privacy Policy
This Privacy Policy applies to anyone using, accessing or browsing our website at finkraft.ai (the “Website”), our web application and platform (the “Services”), and any other interactions you have with us, such as demo requests, support enquiries, live chat or job applications.
This Privacy Policy does not apply to third-party applications, websites or services that integrate with or link from our Services, where we are not the controller of your Personal Information. Those are governed by their own privacy policies.
Where we process data on behalf of a business customer under a contract, the terms of that contract also apply. If the contract and this policy differ on how that customer’s data is handled, the contract prevails.
By using, accessing or browsing the Website or Services, or by otherwise giving us your information, you confirm that you have read and understood this Privacy Policy and our Terms of Service. Where we rely on your consent, we will ask for it separately and clearly.
3. How we handle your data
We collect only the minimum Personal Information needed for you to use our Services, and we use it only as this Privacy Policy describes.
3.1 Information from website visitors
What do we collect? If you browse our Website, we collect the same basic information most websites collect, using common internet technologies such as web server logs. This includes your browser and device type, language preference, referring site, the date and time of each visit, and your IP address.
Why do we collect it? To keep the Website secure, understand how it is used, and show content relevant to your country and likely use of our Services.
3.2 Information from users who upload or connect records
What do we collect? If you log in and upload files, forward invoices, or connect a data source such as an email inbox, Enterprise Resource Planning (ERP) system or travel booking platform, we collect your email address, contact details and location, together with the file names or sources and their contents. These may include invoice, vendor, booking and payment records that name individuals, such as a vendor contact or a traveller.
Why do we collect it? To provide our Services to you. Without this information we cannot read your invoices, reclaim tax credits, file e-invoices or reconcile payments on your behalf.
3.3 Information from users with accounts
What do we collect? When you create an account, we ask for your full name, a valid work email, your role, and a password you create. For billing, we collect a billing address, payment references and, where applicable, your business’s Value Added Tax (VAT) or Goods and Services Tax (GST) registration number. Card details are entered directly with our payment provider; we do not store card numbers or security codes.
Why do we collect it? To set up and manage your account, provide the Services you have requested, and send you important system, security and account notices. We do not use your email for marketing unless you have specifically agreed to it, and we never sell or share your email address with third parties for their own purposes.
3.4 People who contact us with enquiries
What do we collect? If you contact us with a sales or support enquiry or request a demo, we collect what you share with us, such as your name, company, country, email address, telephone number and message.
Why do we collect it? To answer your enquiry, run a demo you asked for, and deal with any questions about how we handle your Personal Information.
3.5 Job applicants
What do we collect? Your CV, contact details, work history and anything else you choose to send us.
Why do we collect it? To assess your application and contact you about it.
3.6 Information we do not collect
We do not request or intentionally collect special categories of personal data, such as health, biometric, genetic, religious or political data, or information revealing racial or ethnic origin. If a customer uploads files that contain such data, we process it only on that customer’s instructions, as a processor under our agreement with them. The customer is the controller of that data and is responsible for having a lawful basis to share it with us.
3.7 How we use your information and our legal basis
If we need to use your Personal Information for a new purpose, we will tell you first and, where the law requires, ask your permission.
| Purpose | Legal basis |
|---|---|
| Provide, update, maintain and improve the Services | Performance of our contract with you or your organisation |
| Respond to requests, support and sales enquiries, and demos | Steps taken at your request before a contract |
| Billing, account management and administration | Performance of contract |
| Keep the Website and Services secure, and investigate and prevent abuse | Our legitimate interests |
| Assess job applications | Steps at your request, and our legitimate interest in hiring |
| Meet tax, accounting, e-invoicing and anti-money-laundering obligations | Legal obligation |
| Enforce our agreements and respond to legal claims | Our legitimate interests |
| Send product news and marketing email | Your consent, which you can withdraw at any time |
3.8 Cookies
Our Website uses essential cookies needed for it to work. We set analytics or marketing cookies only after you accept them, and you can change your choice at any time. For details, see our Cookie Policy.
4. How we share data
4.1 Sharing your information
We do not sell, rent or trade your Personal Information, and we do not share your email address with any third party for its own commercial purposes. We share Personal Information only as follows:
- Service providers (sub-processors). A limited number of vendors that run parts of our Services for us, such as hosting, email delivery, product analytics and support tools. They are bound by written contracts to use the data only to provide services to us and to protect it to a standard consistent with this policy. When we transfer your data to them, we remain responsible for it. A current list is available on request.
- Accredited Service Providers (ASPs) and Pan-European Public Procurement On-Line (PEPPOL) access points. Where a customer instructs us to exchange or report e-invoices under the UAE Electronic Invoicing System or a similar regime.
- Tax authorities. Including the UAE Federal Tax Authority and the Indian GST authorities, where a customer instructs us to file or submit records on its behalf.
- Professional advisers. Auditors, lawyers and accountants, under duties of confidentiality.
- Business transfers. If we are involved in a merger, sale, acquisition or restructuring, Personal Information may pass to the successor on terms that keep it confidential and subject to this policy. We will notify you on the Website or by email before any such transfer.
4.2 Third-party websites and advertising
Our Website may link to third-party websites, and third-party advertising or analytics partners may set their own cookies when you accept them. Their use of your information is governed by their own privacy policies, not this one, and we have no control over those cookies. You can disable cookies through your browser settings or our cookie banner.
4.3 Legal disclosures
We may disclose Personal Information in response to a valid court order, subpoena, warrant or similar request from a competent authority, including a DIFC, UAE or Indian authority. We release it only if we believe in good faith that the law requires it, and we tell you first unless we are legally prohibited from doing so. We may also disclose Personal Information where reasonably necessary to enforce our agreements, respond to claims, prevent fraud or illegal activity, or protect the rights, property or safety of Finkraft.ai, our users or the public.
5. Where we process data
UAE customer data is processed and stored in the UAE, including e-invoice records that UAE law requires to be kept within the country. Indian customer data is processed and stored in India. Our support and engineering teams in Dubai and Bengaluru may access data to run and support the Services, under the controls in section 6.
Where Personal Information is transferred out of the DIFC, we do so only to jurisdictions the DIFC Commissioner of Data Protection recognises as adequate, or with appropriate safeguards such as standard contractual clauses, as permitted under DIFC Data Protection Law No. 5 of 2020. Transfers out of the European Economic Area (EEA) follow the GDPR, and transfers out of India follow any restrictions notified under the DPDP Act.
6. How we manage data
6.1 Security
Finkraft.ai takes the security of your data seriously and uses appropriate organisational and technical measures to protect it from loss, misuse and unauthorised access or disclosure. Our security is independently audited: we are certified to International Organization for Standardization / International Electrotechnical Commission (ISO/IEC) 27001, 27017 and 27018, audited to System and Organization Controls 2 (SOC 2) Type 2, and regularly penetration tested. At a minimum we apply the following measures:
- Physical security. Our infrastructure is hosted only in data centres with controlled perimeter and building access, video surveillance and intrusion detection.
- Data transfer integrity. All traffic to and from our servers is encrypted using Transport Layer Security (TLS), and stored data is encrypted at rest using Advanced Encryption Standard 256-bit (AES-256).
- Password protection. Account passwords are salted and hashed before storage and are never kept in readable form.
- Operational access controls. Staff access to production systems requires multi-factor authentication, is role-based and is granted on least privilege.
- Software updates. We apply security patches to our production infrastructure on a regular cycle.
- Audit trails. Every action taken in the platform is logged.
6.2 Data retention and deletion
We keep Personal Information only for as long as the purpose requires, then delete or anonymise it.
| Data | Retention period |
|---|---|
| Enquiry and marketing contacts | 3 years from your last contact with us |
| Job applications | 12 months after the role closes |
| Customer data | For the life of the contract. When it ends, the account is suspended and data is held for 6 months for export, then permanently deleted |
| UAE tax and e-invoice records | At least 5 years after the relevant tax period, or longer where UAE tax law requires, under Federal Decree-Law No. 28 of 2022 on Tax Procedures |
| Indian tax records | The period required under applicable Indian GST and income tax laws |
| Files uploaded to try the Services without an account | Not stored after the trial session ends |
6.3 Data breaches
If we become aware of a breach that is likely to put your Personal Information at risk, we will notify the DIFC Commissioner of Data Protection, the Data Protection Board of India, affected customers and you, as the applicable law requires, so you can take protective steps.
7. Automated processing and AI
The Services use artificial intelligence (AI) agents to read invoices, find missing fields, match records and flag exceptions. They prepare work for people to review. We follow the DIFC Data Protection Regulations on processing through autonomous and semi-autonomous systems. These agents do not make decisions about you that have legal or similarly significant effects without human review, and we do not use Personal Information to profile individuals.
8. Your rights
If you have an account, you can review and edit most of the Personal Information you have given us in your user profile. For anything else, email support@finkraft.ai. Depending on where you are, DIFC Data Protection Law No. 5 of 2020, the GDPR or the DPDP Act gives you the following rights.
8.1 Right to be informed
You have the right to know what data we hold, how we process it, whether we transfer it outside the DIFC, India or the EEA, and how we safeguard it. This policy is our main way of telling you.
8.2 Right of access
You may ask for a copy of the Personal Information we hold about you.
8.3 Right to rectification
You may ask us to correct inaccurate, out-of-date or incomplete Personal Information that you cannot update yourself in the Services.
8.4 Right to erasure
You may ask us to erase your Personal Information and close your account where we no longer need it or you withdraw consent. We may keep information we are legally required to retain, such as tax records, until that period ends.
8.5 Right to object and restrict processing
You may ask us to stop or limit processing based on our legitimate interests, including direct marketing. We will stop unless we have compelling legitimate grounds, or the processing is needed to establish, exercise or defend legal claims.
8.6 Right to data portability
You may ask for Personal Information you gave us in a structured, machine-readable format, or ask us to send it to another organisation where technically feasible.
8.7 Right to withdraw consent
Where we rely on your consent, you may withdraw it at any time. This does not affect processing already carried out.
8.8 Right to nominate
Where the DPDP Act applies, you may nominate another person to exercise your rights if you die or become unable to do so.
8.9 Right to go to court
Under the DIFC Data Protection Law, you may bring a claim for compensation directly in the DIFC Courts if your rights have been breached, in addition to complaining to the DIFC Commissioner of Data Protection.
We respond to all requests within one month and may ask you to verify your identity first. We do not charge a fee unless a request is clearly unfounded or excessive.
9. Other important information
9.1 Data subject requests
Finkraft.ai is the controller of Personal Information about website visitors, prospects, account users and job applicants. For data we process on behalf of a customer, the customer is the controller and we act as its processor. If your request concerns such data, we will pass it to that customer and help them respond.
9.2 Complaints
If you are not satisfied with how we have handled your concern, you may complain to the Commissioner of Data Protection at the DIFC, to the Data Protection Board of India, or, in the EEA or United Kingdom, to your local data protection authority.
9.3 Children
Finkraft.ai is a business product and is not directed at children. We do not knowingly collect Personal Information from anyone under 18. If you believe a child has given us Personal Information, contact us and we will delete it.
9.4 Changes to this Privacy Policy
We may amend this Privacy Policy from time to time as laws, regulations, industry standards or our business change. We will post changes on this page and update the “Last updated” date. If a change materially affects you, we will tell customers in the product or by email before it takes effect. Earlier versions are available on request.
9.5 Disclaimer
We are not responsible for the privacy practices of third-party websites, integrations or applications you choose to use with our Services, or for information you disclose to them. Please read their privacy policies before sharing information with them.
9.6 Governing law
This Privacy Policy is governed by the laws of the DIFC, and the DIFC Courts have jurisdiction over any dispute arising from it. For Personal Information processed by Travel Input Consultant Private Limited in India, the laws of India apply. This does not limit any right you have to complain to a data protection authority or bring a claim where you live.
9.7 Grievance Officer and contact
For any question about this Privacy Policy, a complaint, or a request to exercise your rights, contact us at:
- FINKRAFT AI LIMITED, Level 3, Innovation One, DIFC, Dubai, United Arab Emirates. Email: connect@finkraft.ai. Phone: +971 4 898 7292
- Travel Input Consultant Private Limited. Email: support@finkraft.ai. Phone: +91 92226 66999
- Grievance Officer: Email: support@finkraft.ai. Phone: +91 92226 66999
© 2026 FINKRAFT AI LIMITED (DIFC Reg. No. 12916 · Licence CL12916)