Privacy Policy

Effective 18 July 2026 · Version 2026-07-18

This Privacy Policy explains how iTaxCA (“we”, “us”, “our”) collects, uses, shares and protects your personal data when you use itaxca.com and related services (the “Service”). We act as a Data Fiduciary under India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”) and follow the applicable provisions of the Information Technology Act, 2000 and rules made under it. Please read this together with our Terms of Service.

1. Who we are & how to reach us

iTaxCA is a technology platform that helps individual taxpayers and Chartered Accountants (“CAs”) prepare and file Indian income-tax returns. For any privacy question or to exercise your rights, contact our Grievance Officer at support@itaxca.com.

2. The data we collect

• Account data — your name, email, mobile number, and a securely hashed password. For CAs: firm name, ICAI membership number, Certificate of Practice / firm registration number, and PAN.
• Tax & financial data you provide — the last four digits of your PAN, and documents you upload such as broker profit & loss / turnover statements, bank statements, Form 16, AIS / TIS / Form 26AS, capital-gains statements and similar records. These contain financial and other sensitive personal information.
• Computed data — the figures, schedules and draft return our engine derives from your documents.
• Technical data — session tokens (stored in your browser), and basic logs needed to run and secure the Service.

3. Why we use your data (purposes)

• To read your documents, apply the relevant year's tax rules, and prepare a draft return.
• To let you appoint a Chartered Accountant of your choice and share your data with them for preparation / filing, on your instruction.
• To communicate with you (verification codes, updates, support responses).
• To secure the Service, prevent misuse, and comply with legal obligations.

Our legal basis is your consent, which you give at sign-up and can withdraw at any time (see Section 8). Where you appoint a CA, processing also supports that engagement.

4. Automated document reading (AI)

To save you manual entry, documents you upload may be processed by third-party AI services (currently Google Gemini and Anthropic Claude) solely to extract figures for your return. We send only what is needed for this purpose. We do not use your data to train third-party AI models where the provider offers an option to opt out of such training, and we configure our use accordingly.

5. Who we share your data with

• Your appointed CA — only after you choose them, and only for as long as the engagement is active. You can revoke a CA’s access at any time.
• Service providers (sub-processors) — cloud hosting (Amazon Web Services, India region), email delivery (Google Workspace), and the AI providers named above, each acting on our instructions under confidentiality obligations.
• Legal / regulatory — where required by law, court order, or a lawful request from a government authority.

We do not sell your personal data, and we do not share it for third-party advertising.

6. Storage, transfer & retention

Your account data and documents are stored on servers located in India. Some sub-processors (e.g. AI providers) may process limited data outside India; such transfers are made in accordance with applicable law. We keep your data for as long as your account is active and as required to provide the Service and meet legal/record-keeping obligations. When you ask us to delete your data, we will do so unless we are required to retain it by law, after which it is deleted or anonymised.

7. How we protect your data

We use encryption in transit (HTTPS/TLS), hashed passwords, access controls limiting who can see your data, and an append-only activity log so you can see every action taken on your account. No method of transmission or storage is completely secure, but we work to protect your information and will notify you and the Data Protection Board of India of a personal-data breach as required by law.

8. Your rights

Subject to the DPDP Act, you have the right to:

• Access a summary of the personal data we process about you;
• Correct or complete inaccurate or incomplete data;
• Erase your data where it is no longer needed;
• Nominate another person to exercise your rights in the event of death or incapacity;
• Withdraw your consent at any time (this does not affect processing already done, and may limit our ability to provide the Service);
• Raise a grievance with us and, if unresolved, complain to the Data Protection Board of India.

To exercise any right, email support@itaxca.com. You can also delete documents and revoke CA access from within your account.

9. Children

The Service is intended for users aged 18 and above and is not directed at children. We do not knowingly collect data from children.

10. Changes to this policy

We may update this Privacy Policy from time to time. Where changes are material, we will notify you and, where required, ask for fresh consent. The version and effective date at the top show the current policy.

Questions? support@itaxca.com · Terms of Service · Home