DPDP Notice

This notice is provided under the Digital Personal Data Protection Act, 2023 ("DPDP Act") and explains, specifically, what personal data we process as your "Data Fiduciary", the purposes for each category of consent we collect, and how you exercise your rights as a "Data Principal". It supplements — and does not replace — our broader Privacy Policy.

1. Consent Categories

We track your consent separately for each of the following purposes. You can view, grant, and withdraw each of these individually from Workspace → Privacy once logged in — nothing here is an all-or-nothing switch.

• Account Terms & Conditions — required to use the Platform at all.
• Privacy Policy — acknowledgement of our data practices, required to use the Platform.
• KYC Verification — processing your identity documents to verify who you are, as required for regulated financial/tax services.
• AI Processing of Documents — optional; allows our AI-assisted extraction tool to pre-fill data from documents you upload, always reviewed by our team before use.
• Data Sharing with Integrations — optional; allows sharing relevant data with third-party tools we integrate with to deliver a service you've requested.
• e-Invoice Authorization — required only if you use our e-invoicing service; authorizes us to generate e-invoices on your behalf via the government e-invoice portal.
• ERI Authorization (ITR filing) — authorizes us to file your Income Tax Return as your e-Return Intermediary / on your behalf.
• Account Aggregator Consent — optional; authorizes pulling your financial data via the RBI Account Aggregator framework, only if you choose to use this feature.
• Marketing Emails — optional; opt in/out any time.
• WhatsApp Marketing Messages — optional; opt in/out any time.
• Analytics & Cookies — optional; used to understand Platform usage and improve it.

2. Withdrawing Consent

You may withdraw any optional consent at any time from Workspace → Privacy. Withdrawal does not affect the lawfulness of processing carried out before withdrawal, and does not affect consents required to continue using services you have an active engagement for (e.g. withdrawing ERI Authorization while we are actively filing your return will pause that filing until you either re-consent or the engagement is cancelled).

3. Right to Erasure

You may request erasure of your personal data from Workspace → Privacy → Request Data Erasure. Every erasure request is reviewed by our team, who will check whether any of your documents or records are still within a mandatory retention window (for example, records the Income Tax Act or ICAI professional standards require us to retain for a specific number of years after filing). Where a record is still within its retention window, it is preserved and you will be notified why; everything else is erased. This review-then-act process — rather than instant deletion — exists specifically so we don't inadvertently destroy a record that we are legally required to keep.

4. Right to Access Your Processing History

Workspace → Privacy → Access Log shows a record of accesses to your data by our staff, so you can see who has looked at your information and when, consistent with the DPDP Act's transparency requirements.

5. Data Retention Policy

We maintain documented retention periods per document/record category, reflecting statutory requirements under the Income Tax Act, Companies Act, and ICAI professional standards. Documents past their retention window are flagged for staff review rather than being retained indefinitely by default.

6. Grievance Redressal

If you have a grievance regarding how your personal data has been processed, contact our Grievance Officer (see Privacy Policy, Section 9) — we aim to acknowledge grievances within a reasonable period and resolve them promptly.

7. Children's Data

Our services are intended for adults engaging tax/compliance services in their own capacity or on behalf of a registered business entity. We do not knowingly collect personal data of children as defined under the DPDP Act without verifiable parental/guardian consent.

8. Cross-Border Transfer

Where any of our service providers process data outside India (e.g. certain cloud infrastructure or email delivery providers), we take reasonable steps to ensure they maintain data protection standards consistent with the DPDP Act.