Privacy Policy

1. Introduction

Tax One Advisory (OPC) Pvt. Ltd. ("we", "us", "our") operates Your AI Accountant ("the Service"). This Privacy Policy explains how we collect, use, store, and protect your personal and financial information when you use the Service.

For your own account data — such as your login, billing, and profile information — Tax One Advisory (OPC) Pvt. Ltd. acts as the "Data Fiduciary" under the Digital Personal Data Protection Act, 2023 ("DPDPA"). For Client Data (defined below) that you upload to the Service, you are the Data Fiduciary and Tax One Advisory acts only as a data processor, processing that data on your instructions to deliver the Service. See Section 15 for how this applies to Client Data. We process all data in accordance with the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules").

2. Definitions

• Personal Data: Any data about an individual who is identifiable by or in relation to such data.
• Sensitive Personal Data (SPDI): Financial information such as bank account details, statements, and related records, as defined under the SPDI Rules.
• Data Fiduciary: The entity that determines the purpose and means of processing personal data. We are the Data Fiduciary for your account data; you are the Data Fiduciary for Client Data you upload (see Section 1 and Section 15).
• Subprocessor: A third-party service provider engaged by us to process data on our behalf.
• Client Data: Financial or personal data of third parties (e.g., your clients) that you upload to the Service.

3. Data We Collect

3.1 Account Information

• Full name, email address, and phone number (optional) provided during registration.
• Google account information if you sign up via Google OAuth.
• Hashed password — plaintext passwords are not stored.

3.2 Financial Data

• Bank statements (PDF, Excel, CSV) you upload for processing.
• Transaction details extracted from uploaded statements.
• Ledger names, voucher details, and categorisation data.
• GSTIN, PAN, and other tax identifiers associated with your clients.
• Tally company data requested through the Chrome extension at your direction.

3.3 Usage Data

• Voucher-credit reservations, consumption, and releases for billing purposes.
• Login timestamps, IP addresses, and session information for security.
• Chrome extension connection and error metadata used for diagnostics.

4. How We Use Your Data

• Service Delivery: Processing bank statements and registers, and Tally synchronisation. PDF invoice conversion is not yet available.
• Billing: Recording plan and voucher-credit usage when final, reviewable vouchers are created.
• Security: Detecting unauthorised access, fraud prevention, and abuse monitoring.
• Communication: Sending password reset emails, verification emails, and critical service updates.
• Improvement: improving extraction and matching accuracy. Data you upload about your clients is used to improve suggestions only within your own account; it is never pooled across customers.

5. AI Processing & Automation

The Service primarily uses deterministic extraction and matching. AI may also be used for difficult statement extraction, cross-verification, and ledger suggestions when the deterministic workflow cannot produce a sufficiently reliable result. PDF invoice conversion is planned to use AI as well but is not yet available.

• Relevant document content or transaction fields, such as text, amounts, party names, and line items, may be sent to our AI provider for the requested processing. Passwords and login credentials are not sent.
• We use API-based AI services (currently OpenAI) through an account covered by the provider's data processing addendum, on API endpoints where customer content is not used to train the provider's models and is not retained beyond the period needed to serve the request.
• Automated processing: AI-extracted fields and suggestions are not final accounting or tax decisions. You should review them before relying on them.
• Accuracy limitation: AI-generated outputs may contain inaccuracies and should be independently reviewed by a qualified professional before filing, reporting, or financial reliance.

6. Legal Basis for Processing

This section describes our own lawful bases for processing your account data. For Client Data, the lawful basis is yours to establish as the Data Fiduciary; we process it on your instructions under Section 15.

We process your personal data on one or more of the following lawful bases:

• Consent: Consent you provide when you create an account and upload data.
• Performance of contract: Processing necessary to deliver the Service you have subscribed to.
• Legal obligation: Compliance with applicable Indian law, including tax and record-keeping requirements.
• Legitimate interests: Fraud prevention, security, and abuse monitoring, balanced against your rights.

7. Data Sharing & Subprocessors

We do not sell your personal or financial data. We engage the following subprocessors:

These providers process data under contractual confidentiality and security obligations. We may also share data with:

• Team Members: If you use team features, your admin and staff members can access shared client data as configured.
• Client upload links: If you send a client a one-time upload link, that link lets them submit documents to you. It is not a login and gives no access to transaction data held in the Service.
• Legal Requirements: We may disclose data if required by Indian law, court order, or government authority.

8. Security Measures

Under the SPDI Rules, financial information is classified as Sensitive Personal Data. We apply commercially reasonable safeguards, including:

• TLS on every connection. Uploaded files are encrypted at rest by the storage provider; phone numbers and client contact emails are additionally encrypted at the application layer; database backups are encrypted before they leave the server.
• Passwords hashed using bcrypt with salt.
• Two-factor authentication (2FA) available for accounts, using a one-time code sent to the registered email address.
• Role-based access control (RBAC) and the principle of least privilege.
• Audit logging of sensitive operations.
• Encrypted backups and secure secret management.
• Periodic access reviews of authorised personnel.
• The Chrome extension may exchange data with Tally only for operations initiated from the authenticated application. Diagnostic logs are limited to what is needed to operate and secure the connector.

9. Where Your Data Is Processed

The application and its database run on a dedicated server hosted in India (Mumbai), and uploaded files are stored in Google Cloud Storage's Mumbai (asia-south1) region. Some subprocessors process limited data outside India under their own safeguards and terms; which of them are involved depends on the features you use.

Data processed outside India is handled in the United States and the European Union under each provider's contractual data-processing terms. Document content sent to OpenAI is sent through an account covered by OpenAI's data processing addendum, on API endpoints where content is not used to train the provider's models and is not retained beyond the period needed to serve the request.

We will update this register before a new subprocessor begins processing your data. To be notified of changes, email youraiaccountant@taxoneadvisory.com.

10. Data Retention

11. Breach Notification

In the event of a confirmed personal data breach affecting your information, we will take commercially reasonable measures to investigate, mitigate, and notify affected users and applicable authorities as required under applicable law.

Where a breach affects Client Data, we will notify you — the Data Fiduciary for that data — without undue delay and in any event within 24 hours of confirming it, so that you can make the notifications the law requires of you. We will not notify your clients directly unless you ask us to. For your own account data we will notify you and the Data Protection Board of India as required, and we will report incidents to CERT-In within six hours of becoming aware of them, as the CERT-In Directions of 28 April 2022 require.

12. Your Rights

Under the DPDPA 2023, you have the right to:

• Access: View the personal data we hold about you, as a machine-readable export, immediately from Settings.
• Correction: Update your personal information at any time through your account settings.
• Deletion: Settings > Security > Danger Zone > Delete Account deactivates your account and starts a 30-day grace period, then erasure or anonymisation — sign back in during that window to cancel and reactivate. For immediate, irreversible erasure of your personal data instead, use Settings > Data Compliance > Data Retention > Erase my data. Either way, issued GST invoices and related financial records are retained only for the period required by Indian law; their legally required identity fields are not deleted or anonymised.
• Withdraw Consent: You can withdraw consent at any time. For your account data, use Settings > Data Compliance > Data Retention > Erase my data, or email our grievance contact. Withdrawal does not affect processing already carried out, and we may continue to hold records the law requires us to keep (Section 10). For Client Data, a withdrawal by one of your clients should be directed to you; tell us and we will act on your instruction.
• Data Portability: You may export your transaction data at any time.
• Nomination: You may nominate another individual to exercise these rights on your behalf in the event of your death or incapacity. Email our grievance contact with the nominee's name and email address.
• Grievance Redressal: You may contact our grievance contact for any data-related complaints (see Section 18).
• Requests about client data: If you are an individual whose data a chartered accountant has uploaded to the Service, that firm is the Data Fiduciary for your data and is the right place to send an access, correction or erasure request. If you contact us, we will direct you to them and assist them in responding; we cannot act on that data without their instruction.

13. Cookies & Local Storage

Analytics and Advertising cookies are not currently set at all — we have switched them off site-wide rather than ask you to manage them. Only the essential cookies above are used. We do not sell your data. Disabling essential cookies will prevent sign-in and core functionality.

14. Children's Privacy

The Service is not intended for individuals under 18. We do not knowingly collect personal data from children, and we do not track, behaviourally monitor, or direct advertising at children. If you believe a child has provided data, contact us and we will take appropriate steps to remove it.

15. Enterprise & Team / Client Data

• For Client Data, you (the user) are the Data Fiduciary under the DPDPA and remain responsible for the lawfulness of that processing. Tax One Advisory processes Client Data solely as a data processor acting on your instructions, to deliver the Service — not as the Data Fiduciary for that data.
• Users uploading third-party financial or personal data (e.g., client data) represent that they have obtained all necessary permissions, authorisations, or lawful basis required to process such data through the Service.
• Users are responsible for ensuring that uploaded data does not violate applicable laws, confidentiality obligations, or third-party rights.
• Users should avoid uploading passwords, OTPs, or unrelated sensitive personal information.
• For team accounts, the admin is responsible for managing staff access to shared client data.

16. Limitation of Outputs & Service

• No professional advice: The Service provides software-assisted automation, data extraction, and categorisation suggestions only. It does not constitute legal, tax, audit, accounting, or financial advice.
• Review required: AI-generated outputs may contain inaccuracies and should be independently reviewed by a qualified professional before filing, reporting, or financial reliance.
• Backups: While we implement backup and disaster recovery measures, you are encouraged to maintain independent backups of critical accounting records.

17. Changes to This Policy

We may update this Privacy Policy from time to time and will notify registered users of material changes by email. The version number above changes only when a change requires your fresh consent; every revision, consent-triggering or not, is listed in the table below with the date it took effect.

18. Contact & Grievance Contact

In accordance with the IT Act 2000, SPDI Rules, and DPDPA 2023, our grievance contact can be reached at: