Privacy Policy

01Who we are

zeerow is a spend management platform operated by Zeerow Finovate Private Limited ("zeerow", "we", "us"), a company incorporated in India with its registered office at 105, Tulsi Tower, Geeta Bhawan Square, A.B. Road, Indore, Madhya Pradesh 452001.

This policy applies to our website, the zeerow web app (including each company's dedicated zeerow link), and any support or sales communication with us. It is written to meet the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023 and the rules made under it.

02Our role: controller and processor

zeerow serves businesses. When a business (our "Customer") signs up, it adds its own people, such as employees, approvers and accountants, and its payees, such as vendors and contractors.

• For Customer data (employee, payee and transaction data the Customer puts on zeerow), the Customer decides why and how that data is used. In that case zeerow acts as a data processor on the Customer's instructions, under our agreement with the Customer.
• For data we collect for our own purposes (website visitors, sales leads, account administration, billing, KYC and compliance), zeerow is the data fiduciary / controller.

03Data we collect

Data you or your company give us

• Account and contact data: name, mobile number, email, designation, company name, branch and department.
• Business KYC data: company PAN, GSTIN, CIN or registration documents, authorised signatory and beneficial owner details, as required for onboarding and anti-money-laundering checks.
• Payee data: payee name, bank account number and IFSC, UPI ID, PAN, GSTIN and contact details, used to make and verify payments.
• Transaction data: amount, date, purpose, category, project, approvals, comments, TDS and GST details.
• Bills and documents: photos or PDFs of invoices, receipts and supporting documents you upload.

Data collected by our regulated partners

To issue UPI wallets and RuPay employee cards, our PPI issuing partner carries out employee KYC, which can include PAN, date of birth, Aadhaar-based verification through DigiLocker, a selfie and a video check. This KYC is performed by and stored with the partner under its own privacy policy and RBI requirements. zeerow receives only the KYC status and the details needed to run the account.

Data collected automatically

• Device and log data: IP address, browser, device type, pages visited, time stamps and error logs, used for security, fraud prevention and to keep the service working.
• Cookies: see our Cookie Policy.

04How we use your data

• To create and run your account, and to show you your wallets, payments, bills and reports.
• To process payments through our banking and payment partners, and to verify payees before money moves.
• To read bills, match them with payments and flag compliance issues (for example duplicate bills, GST or TDS mismatches).
• To meet legal duties, including KYC, anti-money-laundering checks and reporting to the Financial Intelligence Unit (FIU-IND), tax laws and requests from authorities.
• To give support, send service messages (on SMS, email or WhatsApp) and alert you about approvals, failures and security events.
• To keep the platform secure, prevent fraud and improve our product.
• With your consent, to send product updates and marketing. You can opt out at any time.

We do not sell personal data.

05Consent and legal basis

We process personal data on the basis of your consent, given through a clear notice when you sign up or when your company invites you, or for legitimate uses allowed under the Digital Personal Data Protection Act, 2023, such as meeting a legal obligation, responding to a request from a government authority, or using data you have voluntarily provided for a specified purpose.

You can withdraw consent at any time by writing to us. Withdrawal does not affect processing already done, and some data must still be kept to meet legal obligations, as explained under Retention.

06AI features

zeerow uses AI to read bills, categorise spends, spot patterns and answer questions about your spending. AI outputs are assistive: they help your team check and decide, and they do not replace your own review.

• Bill and transaction data is processed by AI models only to provide these features to your company.
• If your company chooses to connect zeerow to an AI assistant such as Claude or ChatGPT, the data you ask for is shared with that provider when you use it, under that provider's terms. Your administrator controls whether this connection is switched on.
• We do not use one Customer's data to make reports or recommendations for another Customer.

Our AI service providers are bound by contract to use this data only to provide the service to zeerow, and not to train their own models on it.

07Who we share data with

The current list of our regulated partners is on our Regulatory Disclosures page. Every service provider is bound by a contract to protect your data and use it only for the purpose we share it for.

08Where data is stored

Data is stored on secure cloud servers. Payment system data is stored in India, as required by the Reserve Bank of India.

If any data is processed outside India, for example by an AI provider your company chooses to connect, we do so only as permitted under Indian law.

09How long we keep data

• KYC and transaction records: at least five years after the business relationship ends or the transaction is completed, as required by the Prevention of Money-laundering Act, 2002 and its rules, or longer if another law requires it.
• Bills and accounting records: for as long as your company's account is active, and then as required by tax and company law.
• Account and contact data: while your account is active, and deleted or anonymised within 90 days after closure, unless the law needs us to keep it.
• Logs: as required by CERT-In directions and for security investigations.

10How we protect data

We follow an information security management system certified to ISO/IEC 27001:2022. Our safeguards include a separate database for every company, role-based access, PIN-protected payment release, maker-checker approvals, encryption in transit, a complete audit trail and regular vulnerability assessment and penetration testing (VAPT). Read more on our Security & Trust page.

If a personal data breach happens, we will inform affected users, our Customers and the authorities as required by law.

11Your rights

Under the Digital Personal Data Protection Act, 2023, you have the right to:

• get a summary of the personal data we process about you and how we use it;
• ask us to correct, complete, update or erase your personal data, subject to legal retention duties;
• withdraw consent;
• have a quick way to raise a grievance; and
• nominate another person to exercise your rights in case of death or incapacity.

To use these rights, write to us using the contact details below. We may need to verify your identity first.

12Children

zeerow is a business service and is not meant for anyone under 18. We do not knowingly collect personal data of children.

13Changes to this policy

We may update this policy from time to time. If the changes are important, we will tell you by email, in the app or on this page before they take effect. The "Last updated" date above shows the latest version.

14Contact and grievances

For any question, request or complaint about your personal data, contact our Grievance Officer:

We will acknowledge your complaint within 24 hours and aim to resolve it within 15 days. If you are not satisfied, you may approach the Data Protection Board of India. See our Grievance Redressal page for the full process.