MYHISAAB PRIVACY POLICY

Last updated: August 2, 2026

This Privacy Policy explains how Digital Miles ("MyHisaab," "we," "us," or "our") collects, uses, shares, and protects information when you use the MyHisaab website, mobile application, WebView application, AI assistant, and related services (collectively, the "Services").

If you do not agree with this Policy, please do not use the Services. For questions or privacy requests, contact us at contactus@myhisaab.pk.

1. INFORMATION WE COLLECT

Account and contact information

Name, phone number, email address, authentication PIN or verification information, consent records, profile information, and account preferences.
We do not offer social-media login and do not collect social-media friends lists or social-profile data for authentication.

Financial and service information

Expenses, income, budgets, balances, transaction dates, categories, merchants, financial goals, account names, reports, and related records you create or ask MyHisaab to process.
Reminder settings, recurring-payment information, notification history, and interactions with notifications.
Shared-account invitations, membership, roles, and financial entries made available to members of a shared account.

AI and user content

Text sent to AI Chat, including transaction descriptions and questions.
Receipt, invoice, bank-transfer, or other images that you choose to upload or share with MyHisaab.
Voice recordings that you choose to send, their transcriptions, and AI-generated responses.
Feedback and support communications.

Device, notification, analytics, and diagnostic information

Firebase Cloud Messaging tokens, platform type, optional device identifier, notification-delivery status, and last-seen timestamps used to deliver and maintain push notifications.
IP address, browser and operating-system information, app and device characteristics, language, referring page, pages or screens viewed, feature interactions, timestamps, performance measurements, and error or diagnostic events.
A pseudonymous analytics user identifier may be associated with your MyHisaab account so we can understand product usage without sending your phone number, chat content, receipt content, or account name as analytics parameters.

Information we do not intentionally collect

MyHisaab does not request biometric data, student data, precise GPS location, social-media friends lists, or social-login credentials.
We may infer an approximate country or region from an IP address for security, analytics, or service operation, but we do not request continuous or precise device location.

2. HOW WE USE INFORMATION

We use information to:

Create, authenticate, secure, and manage accounts.
Record and categorize transactions; calculate balances, budgets, summaries, projections, and reports; and provide financial insights.
Process user-authorized text, images, and voice through AI features.
Deliver reminders, notification-inbox items, and push notifications, and navigate users to relevant app screens.
Create and operate shared accounts, invitations, and member permissions.
Respond to support requests and feedback.
Detect misuse, prevent fraud, troubleshoot errors, monitor service reliability, and protect users and the Services.
Measure feature usage, diagnose usability issues, and improve the Services.
Comply with legal obligations and enforce our agreements.

MyHisaab provides organizational tools and AI-generated information, not professional financial, investment, tax, accounting, or legal advice. AI output and financial projections may contain errors and should be reviewed before you rely on them.

3. AI PROCESSING AND CONSENT

AI Chat is optional. Before MyHisaab sends chat content to a third-party AI provider, the app asks for explicit AI-processing consent.

When you consent and use AI features, your text, uploaded images, voice recordings or transcriptions, and relevant financial context may be sent to OpenAI to categorize transactions, transcribe audio, interpret images, and generate responses. We share only information reasonably needed to provide the requested AI feature. Declining AI consent prevents AI Chat processing but does not prevent access to non-AI features that can operate without it.

You may withdraw AI consent by contacting contactus@myhisaab.pk. Withdrawal does not affect processing that occurred before consent was withdrawn.

4. ANALYTICS

MyHisaab uses analytics to understand product usage, performance, and usability. When you use the app, Google Analytics and Hotjar may process the limited usage information described below. This processing is disclosed through this Privacy Policy and the privacy notice presented during account creation.

Google Analytics receives permitted product-interaction, screen, performance, and diagnostic events, along with a pseudonymous analytics identifier after authentication.
Hotjar may receive page and screen interactions, navigation behavior, and usability-session information.

On the separate public marketing website, Google Tag Manager, Google Ads, Hotjar, and Meta Pixel may load only after the visitor accepts optional analytics and advertising cookies. These tools may measure visits, conversions, and advertising performance across websites. We configure analytics events to exclude phone numbers, email addresses, chat messages, search queries, receipt content, account names, and raw financial amounts. Essential server logs used for security, authentication, fraud prevention, and service reliability are separate from product analytics.

We do not authorize analytics providers to use MyHisaab financial or user content for cross-app advertising, sell personal information, or act as data brokers. If our practices change in a way that constitutes tracking under Apple's rules, we will request the required system permission before tracking.

5. WHEN AND WITH WHOM WE SHARE INFORMATION

We do not sell personal information. We share information only as needed to provide, secure, support, and improve the Services, with the following categories of recipients:

OpenAI: AI processing of user-authorized text, images, voice/transcriptions, and relevant financial context.
Google Firebase: push-token management and push-notification delivery.
Google Analytics: product-usage and performance measurement as described above.
Hotjar: usability and session-interaction measurement as described above.
Google Tag Manager, Google Ads, Hotjar, and Meta Pixel: optional public-website analytics, usability, conversion, and advertising measurement after cookie consent.
Amazon Web Services and MongoDB Atlas: cloud hosting, storage, databases, backups, queues, and service operation.
Zendesk and Slack: customer support, operational alerts, and feedback workflows where applicable. We limit the information included in operational alerts and do not intentionally include Firebase tokens.
Professional advisers, authorities, or transaction counterparties: when reasonably necessary to comply with law, protect rights and safety, investigate abuse, or complete a merger, financing, acquisition, or sale of assets.

Our service providers may process information only to perform services for us or as otherwise disclosed to you, and must protect it in accordance with their contractual and legal obligations.

6. SHARED ACCOUNTS

When you create or join a shared account, financial entries and related activity in that shared account may be visible to its owner and authorized members. Personal-account records are not intentionally shared with shared-account members unless you add or move them to the shared account. Account owners can manage invitations and member access. Do not add information to a shared account unless you are comfortable sharing it with its authorized members.

7. DATA RETENTION AND DELETION

We retain account and financial records while your account is active and as needed to provide the Services. We retain AI chat history, reminders, notifications, shared-account records, and support records for as long as needed for their stated purpose, unless you delete them or your account or a longer period is legally required.

Push tokens are retained while enabled for an account and are removed or disabled when invalid, unregistered, or associated with a deleted account. Analytics information is retained according to our configured provider-retention settings. Security and diagnostic logs are kept only for a period reasonably necessary for security, fraud prevention, troubleshooting, and legal compliance.

When an account is deleted, MyHisaab deletes or anonymizes associated active data that we are not legally required to retain. Data in encrypted backups may remain for a limited backup-rotation period and is not restored for ordinary product use. Information required for fraud prevention, disputes, accounting, or other legal obligations may be retained only for the required purpose and period.

8. YOUR RIGHTS AND CONTROLS

Depending on applicable law, you may request access to, correction of, deletion of, or a copy of your personal information, or object to or restrict certain processing.

You can:

Update available profile and account settings within the app.
Disable push notifications in iOS or Android system settings.
Leave or manage shared accounts through shared-account settings, subject to your role.
Delete your account from Profile > Manage Account > Delete Account. The app requires confirmation before deletion.
Contact contactus@myhisaab.pk to withdraw AI consent or make another privacy request.

9. SECURITY AND INTERNATIONAL PROCESSING

We use administrative, technical, and organizational safeguards designed to protect information. No system can guarantee absolute security.

MyHisaab and its service providers may process information in Pakistan, Singapore, the United States, or other countries where they operate. Where required, we use appropriate safeguards for international transfers.

10. CHILDREN

The Services are intended for people aged 18 or older. We do not knowingly collect personal information from anyone under 18. If you believe a person under 18 has provided information, contact contactus@myhisaab.pk so we can investigate and delete it where required.

11. CHANGES TO THIS POLICY

We may update this Policy as our Services or legal obligations change. We will update the date above and provide additional notice when required.