What we hold, why we hold it, and what you can ask us to do with it.

taxfilo is operated by Taxfilo Solutions, a company registered in India and recognised under the DPIIT Startup India initiative. Where this policy refers to “we” or “us”, it means that company.

For the purposes of the Digital Personal Data Protection Act, you are the Data Fiduciary in respect of your clients’ personal data, and we act as the Data Processor handling it on your instructions.

We collect only what the platform needs in order to work. There is no advertising business here, so there is no reason for us to collect anything beyond that.

Client and return data is used solely to deliver the service you have signed up for: preparing returns, generating portal files, computing due dates, and showing you and your team the state of the work.

We do not sell data, we do not share it with advertisers, and we do not use your clients’ data to train models. Aggregated, fully anonymised statistics may be used to understand which parts of the product are used, in a form that cannot identify any firm or client.

Data is stored on infrastructure located in India. It is encrypted in transit using TLS and encrypted at rest. Credentials used to connect to government portals are stored separately from client records and are encrypted with keys we hold apart from the primary database.

Backups are taken continuously, encrypted, and retained on the same India-resident infrastructure.

Within your firm, visibility is controlled by the roles you assign. A staff member sees the clients allocated to them; a partner sees the firm. Every material change is recorded against the user who made it.

On our side, access to production data is restricted to the small number of people who need it to operate the service, is logged, and is granted only for a specific support or incident purpose.

While your account is active, we keep your data so the historical record stays available to you — which matters, because a return filed three years ago can still be questioned.

If you close your account, you can export everything first. We then delete your data within ninety days, other than records we are legally required to retain, which are kept in a restricted archive for the statutory period only.

Under the DPDP Act you and the individuals whose data you hold have specific rights. We support all of them without charge.

The application uses cookies that are strictly necessary — keeping you signed in, remembering your last-used filters, and protecting against cross-site request forgery. We use no advertising cookies and no third-party tracking pixels on the application.

The marketing site uses privacy-respecting analytics to count page visits in aggregate. It does not build a profile of you.

If we make a change that materially affects how your data is handled, we will tell you inside the application and by email before it takes effect, not in a quiet edit to this page. The date at the top always reflects the current version.

For any question about this document, data requests, or grievances, write to privacy@taxfilo.com. We respond within the timelines the applicable law requires, and usually much sooner.