Privacy policy

We collect what is necessary to do the work you ask for, and nothing beyond it. That falls into three groups.

• Identity and contact details: your name, email address, phone number, and postal address where a filing requires one.
• Tax and financial information: PAN, Aadhaar where a filing requires it, Form 16, bank statements, investment proofs, GST returns, and whatever else the specific engagement needs.
• Usage information: pages visited, approximate location and device type, where analytics is switched on. This tells us which pages are useful; it does not identify you.

We do not collect payment card details. Bank transfers happen through your own bank, and where online payment is enabled it is handled by the payment gateway — card numbers never reach our servers.

Your tax documents are held to prepare and file your returns, and to answer any notice that follows from them. Contact details are held to reach you about your work and, where you have asked for it, to remind you about deadlines.

We do not sell your information, and we do not use your tax documents to build advertising profiles or to train models.

Inside the firm, only the person assigned to your engagement and the partners supervising it. Access is logged.

Outside the firm, your information is disclosed only in these circumstances:

• To the Income Tax Department, GST authorities or the Ministry of Corporate Affairs, as part of the filing you asked us to make.
• To the service providers that run our infrastructure — document storage, email delivery and analytics — under contracts that bind them to confidentiality.
• Where a law, a court order or a statutory authority compels disclosure.

We will tell you if we are compelled to disclose your information, unless the law forbids us from doing so.

Documents are stored encrypted in private storage that is not publicly readable. Every download is a signed link that expires within minutes, so a link that leaks is useless shortly afterwards.

Access to the portal is by a one-time code sent to your email — there is no password to be reused or guessed. Session tokens are held in cookies that JavaScript cannot read, which limits what a compromised script could take.

No system is perfect. If a breach affects your information we will tell you and the relevant authority, and we will tell you what was affected rather than issuing a general notice.

Tax records are kept for eight years from the end of the relevant assessment year. That is not a preference — the Income Tax Act allows assessments to be reopened within that window, and a record we have destroyed is one we cannot use to defend your position.

Marketing contact details are kept until you ask us to stop, which you can do at any time by replying to any email or messaging us.

When a retention period ends the records are deleted rather than archived indefinitely.

You can ask us for a copy of the information we hold about you, ask us to correct anything wrong, ask us to delete anything we are not legally required to keep, and withdraw consent for anything you previously agreed to.

Write to us and we will respond within thirty days. There is no charge for a reasonable request.

Where a request conflicts with a statutory retention obligation we will say so and explain which obligation applies, rather than refusing without a reason.

Where analytics is enabled, this site uses Google Analytics — and, where advertising is running, the Meta pixel — to understand which pages people find useful. These record broad usage: pages viewed, approximate location, device type. They do not record anything that identifies you personally, and they never see your tax documents.

Where session analytics is enabled, we also use Microsoft Clarity, which records how pages are used — where a cursor moves, what is clicked, how far a page is scrolled — so we can see where the site is confusing and fix it. Clarity masks text input by default, so what you type into a form is not captured. We may also use Cloudflare Web Analytics, which is cookieless and stores no identifier at all.

These are all controlled by configuration rather than being permanently baked in, and Google Consent Mode is implemented, so a refusal is passed on to the provider rather than merely honoured on our side.

The client portal sets two cookies that are strictly necessary: they hold your signed-in session and cannot be switched off without making sign-in impossible. They are not used for analytics or advertising.

You can clear cookies for this site in your browser at any time, and you can block analytics entirely with any standard content blocker — nothing on the site stops working if you do.

When this policy changes the date at the top changes with it. Where a change materially affects how we handle your information we will tell existing clients by email rather than relying on you to notice.