Privacy Policy

1. Introduction

This Privacy Policy (“Policy”) explains how Taxly (“we”, “us”, “our”) collects, uses, stores, shares, and protects your personal data when you use the Taxly website, mobile web experience, and related services (collectively, the “Service”).

We provide an income tax return preparation and filing assistance platform for users in India. We act as a Data Fiduciary under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) for personal data we determine the purpose and means of processing.

By creating an account, checking the consent box, or using the Service, you acknowledge that you have read this Policy. Where we rely on consent, you may withdraw it as described in Section 12 — however, withdrawal may limit features that require that data.

2. Scope

This Policy applies to:

• Taxpayers using Taxly to prepare or file income tax returns;
• Chartered Accountants (“CAs”) listed on or using the platform;
• Visitors to our website and landing pages;
• Users who contact us for support (including WhatsApp, email, or phone).

This Policy does not govern third-party websites or services you access through links on Taxly (including the official Income Tax e-filing portal, Razorpay checkout pages, or Google sign-in). Those services have their own privacy policies.

3. Personal data we collect

Depending on how you use the Service, we may collect the following categories of personal data:

3.1 Account and identity data

• Mobile number (for OTP sign-in and verification);
• Email address (optional profile or account verification);
• Google account identifier when you choose “Continue with Google”;
• Session metadata such as IP address and browser user-agent (stored with your login session).

3.2 Tax and KYC-related data

• Permanent Account Number (PAN);
• Aadhaar number (where required for your filing flow);
• Full name, father’s name, date of birth, gender;
• Residential address (flat, street, city, state, pincode, country);
• Bank account number, IFSC code, and bank name for refund credits;
• Income, deduction, exemption, TDS, TCS, and house property details you enter or import;
• Form 16 and other documents you upload;
• Capital gains statements and broker reports you upload;
• Tax computation results and exported ITR JSON files;
• Income Tax portal acknowledgement numbers and filing status where available.

3.3 Income Tax portal credentials

When you opt in to prefill, password reset, or automated filing features, you may provide your Income Tax e-filing portal password. We use it only to perform the action you request. Portal passwords are not stored in our primary database. When needed for filing or prefill, they are held in encrypted temporary storage (typically for a short period, such as up to 30 minutes) and then removed.

3.4 Payment data

• Payment status, amount, and Razorpay transaction identifiers;
• We do not store full credit or debit card numbers — payments are processed by Razorpay.

3.5 CA marketplace data

• Messages you send when booking a CA consultation;
• CA profile information (name, firm, membership number, bio, availability) for listed professionals.

3.6 Consent and audit records

• PAN-wise privacy consent acceptance and timestamp;
• Consent event history linked to your account.

3.7 Technical and analytics data

• Google Analytics data (if enabled), such as pages visited and device/browser type;
• Application logs needed for security, debugging, and fraud prevention (sanitized where possible).

4. Why we use your data (purposes and lawful basis)

We process personal data for the following purposes, primarily based on your consent and, where applicable, legitimate uses permitted under the DPDP Act:

• Creating and managing your Taxly account;
• Guiding you through ITR data entry, tax computation, and regime comparison;
• Importing pre-filled data from the Income Tax portal or Form 16 when you request it;
• Generating government-format ITR JSON and computation reports;
• Submitting your return to the Income Tax portal when you explicitly choose to file and authorize us;
• Processing payments for filing and CA consultations;
• Connecting you with listed CAs for paid consultations;
• Recording consent and maintaining audit trails;
• Providing customer support and responding to grievances;
• Improving the Service, fixing errors, and protecting against fraud or abuse;
• Complying with applicable laws, court orders, or lawful requests from authorities.

Important: Taxly is a preparation and filing assistant. You remain solely responsible for the accuracy and completeness of information in your return and for reviewing figures before submission. We are not the Income Tax Department, CBDT, or a government body.

5. Sensitive personal data

Certain data we process — including financial and tax information, bank account details, and government identifiers such as PAN and Aadhaar — may be treated as sensitive personal data under applicable law.

We collect such data only where necessary for the Service, with your consent, and apply additional safeguards including field-level encryption at rest for key identifiers and financial records.

You represent that you have the legal right to provide any third party’s data you enter (for example, dependant PAN or donee details) and that you have obtained any required consents.

6. How we share personal data

We do not sell your personal data. We may share data only as follows:

6.1 Service providers and processors

We use trusted third parties who process data on our instructions, including:

• Razorpay — payment processing;
• Google — optional OAuth sign-in and analytics (GA4);
• Cloud hosting and database providers — application and data storage;
• Redis — short-lived storage for portal credentials during filing flows;
• Email and SMS providers — OTP delivery and account notifications;
• Form 16 and document extraction services — parsing uploaded tax documents;
• Automation and JSON signing partners — including e-Tax Solutions and related automation APIs used to interact with the Income Tax portal when you request prefill or filing;
• Income Tax e-filing portal — when you authorize prefill, signing, or submission.

These providers are permitted to use data only to perform services for us and must protect it consistent with contractual obligations.

6.2 Chartered Accountants

If you book a consultation, we share the information needed for that booking (such as your message and contact details) with the CA you select. CAs are independent professionals; their use of your data is governed by their own obligations.

6.3 Legal and safety

We may disclose data if required by law, regulation, legal process, or government request, or when we believe disclosure is necessary to protect rights, safety, fraud prevention, or enforcement of our terms.

6.4 Business transfers

If Taxly is involved in a merger, acquisition, or asset sale, personal data may transfer subject to this Policy or notice to you as required by law.

7. Cross-border processing

We primarily host and process data in India. Some subprocessors (for example, Google or cloud infrastructure) may process data in other countries. Where personal data is transferred outside India, we take steps reasonably required under applicable law, including contractual safeguards with processors.

8. Data retention

We retain personal data only as long as necessary for the purposes described in this Policy:

• Account and tax profile data — while your account is active and for a reasonable period afterward to support re-filing, disputes, and legal obligations (typically up to 8 years for tax-related records unless a shorter period is required by law);
• Income Tax portal passwords — only in temporary storage for the minimum time needed (not in our main database);
• Payment records — as required for accounting, tax, and audit purposes;
• Consent logs — for as long as needed to demonstrate compliance;
• Session logs — for security monitoring for a limited period.

You may request erasure subject to Section 12. We may retain certain data where required by law or for legitimate legal claims even after an erasure request.

9. Security measures

We implement reasonable technical and organizational measures to protect personal data, including:

• Encryption at rest for sensitive fields (PAN, Aadhaar, bank details, and related tax records);
• HTTPS for data in transit;
• Access controls limiting employee and system access to personal data on a need-to-know basis;
• Session-based authentication with secure cookies;
• Not persisting Income Tax portal passwords in the primary database;
• Monitoring and logging for abuse detection.

No method of transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security. You are responsible for keeping your Taxly account credentials and Income Tax portal password confidential.

10. Cookies and analytics

We use essential cookies for authentication and session management. Where enabled, we may use Google Analytics to understand how visitors use our website. You can control non-essential cookies through your browser settings. Disabling cookies may affect sign-in and certain features.

11. Your rights under the DPDP Act

Subject to applicable law, you may have the right to:

• Access personal data we hold about you;
• Correction of inaccurate or incomplete data;
• Erasure of personal data when retention is no longer necessary and no legal exception applies;
• Withdraw consent for processing that relies on consent;
• Nominate another individual to exercise your rights in the event of death or incapacity;
• Grievance redressal as described below.

To exercise these rights, contact us at help@taxly.co.in. We may need to verify your identity before responding. We aim to respond within timelines prescribed under the DPDP Act.

12. Consent and withdrawal

When you check the privacy consent box at PAN login or portal-related steps, you consent to the processing described in this Policy for that PAN and the requested action (such as prefill or filing).

You may withdraw consent by contacting us or by ceasing use of features that require that processing. Withdrawal does not affect processing already performed lawfully before withdrawal. Deleting your account or specific profile data may be subject to retention requirements in Section 8.

13. Children

The Service is intended for individuals who can legally enter into a contract under Indian law and file income tax returns. We do not knowingly collect personal data from children under 18 without appropriate parental or guardian authorization. Contact us if you believe we have collected a child’s data in error.

14. Limitations and disclaimers

To the maximum extent permitted by applicable law:

• Taxly provides the Service on an “as available” basis for tax preparation assistance. We do not guarantee uninterrupted access to the Income Tax portal or successful filing in all cases;
• We are not responsible for errors arising from incorrect information you provide, outdated portal data, third-party service outages, or changes in tax law not yet reflected in the Service;
• Nothing in this Policy limits any non-waivable rights you have under the DPDP Act or other mandatory consumer protection laws;
• Our total liability for claims relating to personal data handling will be subject to applicable law and any separate Terms of Service you agree to when using paid features.

15. Changes to this Policy

We may update this Policy from time to time. The “Effective” date at the top will change when we do. Material changes will be communicated through the Service, email, or a prominent notice where appropriate. Continued use after the effective date constitutes acceptance of the updated Policy where permitted by law.

16. Grievance officer and contact

For privacy-related questions, complaints, or to exercise your rights, contact our Grievance Officer:

If you are not satisfied with our response, you may have the right to approach the Data Protection Board of India or other remedies available under applicable law.

17. Governing law

This Policy is governed by the laws of India. Courts at the place of our registered office in India shall have jurisdiction, subject to mandatory consumer protection and data protection remedies available to you.