Privacy Policy

TaxWala (taxwalaai.com) ("we", "us", "our") is a tax preparation workspace for salaried Indian taxpayers. We act as the data fiduciary under the Digital Personal Data Protection Act, 2023 (DPDP Act) for personal data you provide while using our services. Our registered correspondence address and grievance contact are listed in Section 12 below.

We collect data in the following categories:

• Directly from you — account registration, form inputs, document uploads, manual salary entry
• PDF extraction — AI/OCR processing of Form 16 PDFs you upload
• Third-party authentication — Google OAuth (if you choose to sign in with Google), which provides name and email address
• Automatically — cookies, server logs, and analytics tools for platform performance

We process your data under the following lawful bases (DPDP Act 2023, Section 4):

For SPDI (financial and tax data), we collect your explicit consent at the point of:

• Account registration (checkbox acceptance of these Terms and Privacy Policy)
• Form 16 upload (in-product consent prompt before processing)
• CA handoff (explicit confirmation before sharing your draft with a CA)

You may withdraw consent at any time by contacting us at [email protected]. Withdrawal may prevent you from using certain features.

We do not sell your personal or financial data. We share data only in the following limited circumstances:

• Account data — Retained as long as your account is active plus 3 years after deletion (for legal/audit compliance).
• Tax data and documents — Retained for the filing season (April to September of the relevant AY) plus 3 years. You may request earlier deletion (see Section 10).
• Form 16 PDFs and investment proofs — Deleted automatically 6 months after the ITR filing deadline for that Assessment Year, unless you request earlier deletion.
• Payment records — Retained for 8 years under the Companies Act and GST Act requirements.
• Technical logs — Retained for 90 days for security and debugging purposes.

We implement security measures proportionate to the sensitivity of the data processed:

• Transit encryption — All data in transit uses TLS 1.2+ (HTTPS enforced; HSTS enabled).
• At-rest encryption — Database and file storage encrypted using AES-256.
• Access control — Row-level security (RLS) ensures each user can only access their own data. CA Professionals see only cases explicitly assigned to them.
• Authentication — Supabase Auth with email/password or Google OAuth. Passwords hashed using bcrypt.
• Infrastructure security — Hosted on SOC 2 Type II certified cloud providers (AWS via Supabase, Vercel).
• PAN masking — PAN is stored and displayed in masked format (AXXXXXX1234) except where required for CA handoff.

Despite our security measures, no system is perfectly secure. You are responsible for keeping your account credentials confidential.

In the event of a personal data breach that is likely to cause harm to affected data principals, we will:

• Notify the Data Protection Board of India (when constituted under DPDP Act 2023) within 72 hours of becoming aware, as required by applicable rules.
• Notify affected users via email to their registered address without undue delay, describing the nature of the breach, data affected, and steps taken.
• Maintain an internal breach log and take remediation steps promptly.

Under the DPDP Act 2023 and IT (SPDI) Rules, you have the following rights:

• Right of access — Request a summary of personal data we hold about you.
• Right of correction — Request correction of inaccurate or incomplete data.
• Right of erasure (deletion) — Request deletion of your account and associated data, subject to retention obligations under applicable law.
• Right to grievance redressal — Lodge a complaint with our Grievance Officer (Section 12) and, if unresolved, with the Data Protection Board of India.
• Right to withdraw consent — Withdraw consent for processing at any time (this may affect service availability).
• Right to nominate — Nominate another individual to exercise your rights in the event of death or incapacity.

To exercise any of these rights, email [email protected] with your account email and the specific request. We will respond within 30 days.

We use the following types of cookies:

• Essential cookies — Authentication sessions and security tokens. Required for the platform to function. Cannot be disabled.
• Analytics cookies — Aggregated usage data (e.g., page views) using privacy-safe analytics. No individual profiling.
• Preference cookies — Language and locale preferences.

We do not use third-party advertising cookies or behavioural tracking for ad targeting.

In accordance with the Information Technology Act, 2000 (Section 43A), IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023, the Grievance Officer for TaxWala is:

TaxWala is intended for individuals 18 years of age and older. We do not knowingly collect personal data from minors. If we learn that we have collected data from a person under 18, we will delete it promptly.

We may update this Privacy Policy periodically. When we do, we will revise the "Last updated" date. For material changes (e.g., new categories of data collection, new sharing with third parties), we will notify registered users by email and display a prominent notice on the platform at least 14 days before the changes take effect.

For privacy-related questions, data requests, or to exercise your rights, contact:

• General enquiries: [email protected]
• Grievance / data rights: [email protected]