Privacy Policy

1. Introduction

Tax One Advisory (OPC) Pvt. Ltd. ("we", "us", "our") operates Your AI Accountant ("the Service"). This Privacy Policy explains how we collect, use, store, and protect your personal and financial information when you use the Service.

For your own account data — such as your login, billing, and profile information — Tax One Advisory (OPC) Pvt. Ltd. acts as the "Data Fiduciary" under the Digital Personal Data Protection Act, 2023 ("DPDPA"). For Client Data (defined below) that you upload to the Service, you are the Data Fiduciary and Tax One Advisory acts only as a data processor, processing that data on your instructions to deliver the Service. See Section 15 for how this applies to Client Data. We process all data in accordance with the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules").

2. Definitions

• Personal Data: Any data about an individual who is identifiable by or in relation to such data.
• Sensitive Personal Data (SPDI): Financial information such as bank account details, statements, and related records, as defined under the SPDI Rules.
• Data Fiduciary: The entity that determines the purpose and means of processing personal data. We are the Data Fiduciary for your account data; you are the Data Fiduciary for Client Data you upload (see Section 1 and Section 15).
• Subprocessor: A third-party service provider engaged by us to process data on our behalf.
• Client Data: Financial or personal data of third parties (e.g., your clients) that you upload to the Service.

3. Data We Collect

3.1 Account Information

• Full name, email address, and phone number (optional) provided during registration.
• Google account information if you sign up via Google OAuth.
• Hashed password — plaintext passwords are not stored.

3.2 Financial Data

• Bank statements (PDF, Excel, CSV) you upload for processing.
• Transaction details extracted from uploaded statements.
• Ledger names, voucher details, and categorisation data.
• GSTIN, PAN, and other tax identifiers associated with your clients.
• Tally company data requested through the Chrome extension at your direction.

3.3 Usage Data

• Voucher-credit reservations, consumption, and releases for billing purposes.
• Login timestamps, IP addresses, and session information for security.
• Chrome extension connection and error metadata used for diagnostics.

4. How We Use Your Data

• Service Delivery: Processing bank statements and registers, and Tally synchronisation. PDF invoice conversion is not yet available.
• Billing: Recording plan and voucher-credit usage when final, reviewable vouchers are created.
• Security: Detecting unauthorised access, fraud prevention, and abuse monitoring.
• Communication: Sending password reset emails, verification emails, account notices (such as trial, credit and plan reminders), and critical service updates.
• Product news and offers (only if you opt in): Occasional emails about new features, tips and offers, sent only if you tick the optional box when you sign up or switch on “Product news and offers” in Settings > Notifications. Saying no never affects your use of the Service, and you can switch it off at any time from the same place.
• Improvement: improving extraction and matching accuracy. Data you upload about your clients is used to improve suggestions only within your own account; it is never pooled across customers.

5. AI Processing & Automation

Bank and loan statements, purchase and sales registers, and GST reports are processed with deterministic, rule-based extraction and matching, without AI. AI is used only for PDF invoice conversion: reading the invoice, checking the extracted fields, and suggesting ledgers for invoice lines. PDF invoice conversion is in limited internal testing and is not yet available to customers.

• For PDF invoice conversion, the invoice's content (its text and page images) and, for ledger suggestions, the invoice line descriptions with your client's ledger names are sent to our AI providers. Passwords and login credentials are not sent.
• We use API-based AI services under the providers' data-processing terms, on API endpoints where customer content is not used to train the providers' models. Requests go through the OpenCode Zen gateway to OpenAI's GPT-6 Luna model, and request content may be kept for up to 30 days to monitor for abuse, after which it is deleted. The AI providers currently in use are the ones named for AI processing in the sub-processor register in Section 9; a change of provider is disclosed there before the new provider receives any content.
• Automated processing: AI-extracted fields and suggestions are not final accounting or tax decisions. You should review them before relying on them.
• Accuracy limitation: AI-generated outputs may contain inaccuracies and should be independently reviewed by a qualified professional before filing, reporting, or financial reliance.

6. Legal Basis for Processing

This section describes our own lawful bases for processing your account data. For Client Data, the lawful basis is yours to establish as the Data Fiduciary; we process it on your instructions under Section 15.

We process your personal data on one or more of the following lawful bases:

• Consent: Consent you provide when you create an account and upload data, and — separately and only if you give it — your consent to receive product news and offers by email.
• Performance of contract: Processing necessary to deliver the Service you have subscribed to.
• Legal obligation: Compliance with applicable Indian law, including tax and record-keeping requirements.
• Legitimate interests: Fraud prevention, security, and abuse monitoring, balanced against your rights.

7. Data Sharing & Subprocessors

We do not sell your personal or financial data. We engage the following subprocessors:

These providers process data under contractual confidentiality and security obligations. We may also share data with:

• Team Members: If you use team features, your admin and staff members can access shared client data as configured.
• Client upload links: If you send a client a one-time upload link, that link lets them submit documents to you. It is not a login and gives no access to transaction data held in the Service.
• Legal Requirements: We may disclose data if required by Indian law, court order, or government authority.

8. Security Measures

Under the SPDI Rules, financial information is classified as Sensitive Personal Data. We apply commercially reasonable safeguards, including:

• TLS on every connection. Uploaded files are encrypted at rest by the storage provider; phone numbers and client contact emails are additionally encrypted at the application layer; database backups are encrypted before they leave the server.
• Passwords hashed using bcrypt with salt.
• Two-factor authentication (2FA) available for accounts, using a one-time code sent to the registered email address.
• Role-based access control (RBAC) and the principle of least privilege.
• Audit logging of sensitive operations.
• Encrypted backups and secure secret management.
• Periodic access reviews of authorised personnel.
• The Chrome extension may exchange data with Tally only for operations initiated from the authenticated application. Diagnostic logs are limited to what is needed to operate and secure the connector.

9. Where Your Data Is Processed

The application and its database run on a dedicated server hosted in India (Mumbai), and uploaded files are stored in Google Cloud Storage in Mumbai, India. Site and API traffic pass through Vercel, which terminates TLS and may proxy requests at edge locations outside India. Some subprocessors process limited data outside India under their own safeguards and terms; which of them are involved depends on the features you use.

Data processed outside India is handled under each provider's contractual data-processing terms, in the locations given for each provider in the register below. Document content sent for AI processing goes to the AI providers named for AI processing in that register, under their data-processing terms, on API endpoints where content is not used to train the providers' models. The AI model provider may keep request content for up to 30 days to monitor for abuse, after which it is deleted.

We will update this register before a new subprocessor begins processing your data. To be notified of changes, email youraiaccountant@taxoneadvisory.com.

10. Data Retention

11. Breach Notification

In the event of a confirmed personal data breach affecting your information, we will take commercially reasonable measures to investigate, mitigate, and notify affected users and applicable authorities as required under applicable law.

Where a breach affects Client Data, we will notify you — the Data Fiduciary for that data — without undue delay and in any event within 24 hours of confirming it, so that you can make the notifications the law requires of you. We will not notify your clients directly unless you ask us to. For your own account data we will notify you and the Data Protection Board of India as required, and we will report incidents to CERT-In within six hours of becoming aware of them, as the CERT-In Directions of 28 April 2022 require.

12. Your Rights

Under the DPDPA 2023, you have the right to:

• Access: View the personal data we hold about you, as a machine-readable export, immediately from Settings.
• Correction: Update your personal information at any time through your account settings.
• Deletion: Settings > Security > Danger Zone > Delete Account deactivates your account and starts a 30-day grace period, then erasure or anonymisation — sign back in during that window to cancel and reactivate. For immediate, irreversible erasure of your personal data instead, use Settings > Data Compliance > Data Retention > Erase my data. Either way, issued GST invoices and related financial records are retained only for the period required by Indian law; their legally required identity fields are not deleted or anonymised.
• Withdraw Consent: You can withdraw consent at any time. For your account data, use Settings > Data Compliance > Data Retention > Erase my data, or email our grievance contact. Withdrawal does not affect processing already carried out, and we may continue to hold records the law requires us to keep (Section 10). For Client Data, a withdrawal by one of your clients should be directed to you; tell us and we will act on your instruction. To stop product news and offers only, switch off “Product news and offers” in Settings > Notifications — your account is not affected.
• Data Portability: You may export your transaction data at any time.
• Nomination: You may nominate another individual to exercise these rights on your behalf in the event of your death or incapacity. Email our grievance contact with the nominee's name and email address.
• Grievance Redressal: You may contact our grievance contact for any data-related complaints (see Section 18).
• Requests about client data: If you are an individual whose data a chartered accountant has uploaded to the Service, that firm is the Data Fiduciary for your data and is the right place to send an access, correction or erasure request. If you contact us, we will direct you to them and assist them in responding; we cannot act on that data without their instruction.

13. Cookies & Local Storage

We do not show a cookie banner because we do not use analytics, advertising or other non-essential cookies. We use only the following:

We do not set Google Analytics, Google Ads or any other analytics or advertising cookies. We do not sell your data. Blocking the sign-in cookies will prevent sign-in and core functionality.

14. Children's Privacy

The Service is not intended for individuals under 18. We do not knowingly collect personal data from children, and we do not track, behaviourally monitor, or direct advertising at children. If you believe a child has provided data, contact us and we will take appropriate steps to remove it.

15. Enterprise & Team / Client Data

• For Client Data, you (the user) are the Data Fiduciary under the DPDPA and remain responsible for the lawfulness of that processing. Tax One Advisory processes Client Data solely as a data processor acting on your instructions, to deliver the Service — not as the Data Fiduciary for that data.
• Users uploading third-party financial or personal data (e.g., client data) represent that they have obtained all necessary permissions, authorisations, or lawful basis required to process such data through the Service.
• Users are responsible for ensuring that uploaded data does not violate applicable laws, confidentiality obligations, or third-party rights.
• Users should avoid uploading passwords, OTPs, or unrelated sensitive personal information.
• For team accounts, the admin is responsible for managing staff access to shared client data.

16. Limitation of Outputs & Service

• No professional advice: The Service provides software-assisted automation, data extraction, and categorisation suggestions only. It does not constitute legal, tax, audit, accounting, or financial advice.
• Review required: AI-generated outputs may contain inaccuracies and should be independently reviewed by a qualified professional before filing, reporting, or financial reliance.
• Backups: While we implement backup and disaster recovery measures, you are encouraged to maintain independent backups of critical accounting records.

17. Changes to This Policy

We may update this Privacy Policy from time to time and will notify registered users of material changes by email. The version number above changes only when a change requires your fresh consent; every revision, consent-triggering or not, is listed in the table below with the date it took effect.

18. Contact & Grievance Contact

In accordance with the IT Act 2000, SPDI Rules, and DPDPA 2023, our grievance contact can be reached at: