Privacy Policy
Last updated: 21 May 2026 (v2.1)
Introduction
This Privacy Policy ("Policy") applies to ArigaMoney India Private Limited ("Company", "we", "our", or "us"), the owner and operator of the mobile application and platform GoalSeek (the "Platform"), and its website https://usegoalseek.com ("Website"), along with all related services (collectively, the "Services").
We believe you have the right to know exactly what data we collect, why we collect it, and how it is used. This Policy is written in plain English so you can make informed decisions about your data. We do not sell your personal data to any third party, ever.
This Policy should be read together with our Terms and Conditions of Use, available at https://www.usegoalseek.com/policy-pages/terms-and-conditions. By using our Services, you agree to the practices described in this Policy. If you do not agree, please do not use our Services.
Who This Policy Applies To
This Policy applies to all people who interact with our Services:
Visitors: People who browse our Website or Platform without registering.
Customers: Individuals or entities who register for or use our Services.
Users: Employees, agents, or representatives acting on behalf of a Customer.
What Data We Collect
We only collect data that is necessary to provide you with our Services.
If you are a Visitor:
Your general location (country/city level)
How you interact with our Website (pages visited, time spent, etc.)
Device details (model, operating system, browser type)
Cookie and web beacon data (see Section 7 for details)
Name and email, only if you voluntarily submit them
If you are a Customer or User:
Name and email address
Payment information, handled entirely by a third-party payment processor; we do not store your card details, UPI credentials, or any other payment information on our servers
How you use and interact with the Platform and its features
Device details (model, operating system)
Cookie and web beacon data
A note on government IDs (PAN/Aadhaar):
GoalSeek uses the Account Aggregator framework as mandated by the Reserve Bank of India (RBI). As part of this process, you may be required to provide your PAN or Aadhaar to the relevant regulated entities. We facilitate this process but we do not store your government ID data on our servers. This data flows directly to the regulated institution as required by law.
A note on financial account data:
Where you choose to connect your financial accounts through the RBI-regulated Account Aggregator framework, GoalSeek receives a read-only view of your financial data for display purposes within the app. We do not store raw transaction data beyond what is necessary to display it to you, and we cannot initiate any transaction on your behalf.
How We Collect Your Data
Directly from you: when you fill out forms, create an account, or contact us.
Automatically: through cookies, analytics tools, and system logs when you use our Services.
From third-party tools: only after you have given your explicit consent for a specific integration.
From the Account Aggregator ecosystem: read-only financial data fetched with your explicit consent through RBI-licensed Account Aggregators.
How We Use Your Data
We use your data only for the following purposes:
To provide, maintain, and improve our Services
To set up and manage your account
To process payments securely
To display your financial data back to you within the app
To send you important service-related notices and updates
To respond to your support requests
To detect and prevent fraud and security threats
To analyse usage patterns and improve the product experience
To comply with our legal and regulatory obligations
To send you marketing communications, only with your explicit consent, and you can opt out at any time
We Do Not Sell Your Data
We do not sell, rent, trade, or otherwise transfer your personal data to any third party for commercial purposes. All data is stored within India on secure cloud infrastructure.
We will only share your data with third parties in these limited situations:
Service providers: Companies that help us operate our Services (e.g., payment processors, cloud hosting, analytics, email delivery). These providers are contractually bound to use your data only to perform services on our behalf and for no other purpose.
With your consent: When you explicitly authorise a specific third-party integration (e.g., connecting your bank via Account Aggregator), we will share only the data necessary for that integration. We will always ask for your consent before enabling any such connection.
Legal requirements: If we are required to share data in response to a valid legal process (such as a court order, subpoena, or regulatory request), or to protect the safety of our users or the public.
Business transactions: In the event of a merger, acquisition, or sale of assets, your data may be transferred to the successor entity. We will give you at least 30 days written notice before any such transfer, during which time you may delete your account and data if you choose not to continue.
We will never share your data with advertisers, data brokers, or any third party for marketing purposes without your explicit consent.
7. Cookies and Tracking Technologies
We use cookies and similar technologies to improve your experience on our platform. Cookies are small text files stored on your device when you visit our website. Here is what we use and why:
Essential Cookies: Required for the website to function. You cannot opt out of these.
Analytical Cookies: Help us understand how users interact with our product so we can improve it. Data is collected anonymously.
Marketing Cookies: Used to show relevant content and limit ad frequency. These are only activated with your consent.
Cookie data is retained for between 180 and 365 days depending on the type, after which it is automatically deleted.
You can manage or disable non-essential cookies at any time through your browser settings. Where required by law, we will ask for your consent before placing non-essential cookies on your device.
8. Your Rights
You are in control of your data. Under the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000, you have the following rights:
Access: Request a copy of the personal data we hold about you.
Rectification: Ask us to correct inaccurate or incomplete data.
Erasure: Ask us to delete your personal data. Please note that even after erasure, we will retain your opt-out preference permanently to ensure we do not contact you again.
Restrict Processing: Ask us to stop processing your data, temporarily or permanently.
Withdraw Consent: Revoke any consent you have given at any time. We will stop processing your data for that purpose immediately, unless we have a legal obligation to continue.
Nominate: You may nominate another individual to exercise your data rights on your behalf in the event of your death or incapacity, as provided under the DPDPA 2023.
To exercise any of these rights, contact our Grievance Officer using the details in Section 15. We will acknowledge your request within 48 hours and respond fully within 30 days, as required under applicable Indian law.
9. Data Security
We take the security of your data seriously and use industry-standard measures to protect it:
Encryption in transit: Data is protected using SSL/TLS 1.3 (cipher suite TLS_AES_256_GCM_SHA384).
Encryption at rest: Sensitive data is encrypted using AES-256.
Access controls: Only authorised personnel can access personal data, on a need-to-know basis. All access is logged and monitored.
Regular security audits: We conduct periodic Vulnerability Assessment and Penetration Testing (VAPT) and hold ISO 27001 and SOC 2 Type II certifications.
Incident response: In the event of a data breach, we will notify the Data Protection Board of India and affected users within 72 hours of becoming aware of the breach, as required under applicable law.
You are responsible for keeping your account credentials secure. Please do not share your password with anyone. Notify us immediately at support@goalseek.co.in if you suspect any unauthorised access to your account.
10. How Long We Keep Your Data
We keep your personal data only for as long as necessary to provide our Services or as required by law. Our retention schedule is as follows:
Active accounts: Data is retained for the duration of your use of the Services.
After account termination (individual subscribers): Your data will be deleted within 90 days of account termination, unless we are legally required to retain it longer.
After contract termination (corporate clients): Client data and associated user data is deleted within 90 days of contract termination, or as specified in the applicable client contract.
Trial accounts: Data is deleted within 30 days of the end of the trial period.
Financial and invoicing records: Retained for 7 years as required under Indian tax and financial regulations.
Marketing opt-out records: Retained indefinitely to ensure we honour your opt-out preference and do not contact you again.
Cookie data: Retained for 180 to 365 days.
Even if you request erasure of your data, we may be required to retain certain records to comply with legal obligations, resolve disputes, or enforce our agreements. We will inform you if this applies to your request.
11. Children’s Privacy
Our Services are not intended for anyone under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with their data without parental consent, please contact our Grievance Officer immediately, and we will delete it as quickly as possible.
12. Third-Party Websites and Links
Our Platform or Website may contain links to third-party websites or services. We are not responsible for the privacy practices of those sites. Once you leave our Services, this Policy no longer applies. We encourage you to review the privacy policy of any third-party site you visit.
13. Changes to This Policy
We may update this Policy from time to time. When we make material changes, we will notify you via email or an in-app notice at least 14 days before the changes take effect, and update the effective date at the top of this document.
Your continued use of our Services after the changes take effect constitutes your acceptance of the revised Policy. If you do not agree, please stop using our Services before the effective date of the changes.
14. Legal Basis for Processing
We process your personal data under the following legal grounds:
Consent: Where you have given us explicit, informed consent (e.g., marketing emails, third-party integrations).
Contractual necessity: To deliver the Services you have signed up for.
Legal obligation: To comply with applicable laws and regulatory requirements in India, including SEBI, RBI, and DPDPA 2023.
Legitimate interests: For fraud prevention, security, and service improvement, only where these do not override your rights.
You may withdraw consent at any time by contacting us. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
This Policy is governed by the laws of India. Any disputes will first be attempted to be resolved through good-faith negotiation within 30 days. If unresolved, disputes will be referred to arbitration under the Arbitration and Conciliation Act, 1996, with the seat of arbitration in Delhi, India.
15. Grievance Officer and Contact
In accordance with the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023, we have designated a Grievance Officer who is also responsible for data protection compliance:
Name: Ajit Kumar Singh Chauhan
Role: Grievance Officer and Data Protection Officer
Email: support@goalseek.co.in
Phone: +91 90588 85646
Website: https://usegoalseek.com
If you have a complaint or concern about how we have handled your personal data, please contact the Grievance Officer. We will acknowledge your complaint within 48 hours and resolve it within 30 days of receipt.
If you are not satisfied with our response, you may escalate your complaint to the Data Protection Board of India once it is constituted under the DPDPA 2023.