Privacy Policy

Who we are

1.1 TaxCare is run by Overseas Apps Private Limited ("TaxCare", "we", "us"). For the Digital Personal Data Protection Act, 2023 ("DPDP Act"), we are the Data Fiduciary for the personal data described here.

1.2 Office: NX One Tower, Tech Zone IV, Greater Noida, Uttar Pradesh 201318, India. Registered office: Sri Ganganagar, Rajasthan, India.

1.3 This policy covers TaxCare wherever you use it: app.taxcare.in, the TaxCare mobile app, www.taxcare.in, and any partner web address that runs TaxCare for a partner company (see section 9).

1.4 Our Grievance Officer and Data Protection Officer is Monish Kumar — grievance@taxcare.in. See section 15.

This policy in short

• We collect what we need to prepare your Income Tax Return and run your account. Nothing more.
• Your data is stored in India (AWS Mumbai). A few service providers outside India handle small, limited data. We name each one in section 8.
• We do not sell your personal data. We do not show ads. We use no tracking or advertising cookies.
• We do not store your Aadhaar number. Your Aadhaar OTP goes to the Income Tax portal and is never stored.
• Your Income Tax portal password is stored encrypted. It is needed to run the service, and it is used only to fetch your tax documents and status. You can revoke it and ask us to erase it.
• We keep filed returns and tax records for 6 years from filing. We keep most other data for up to 8 years. Section 10 has the full table.
• You can see, correct and ask us to erase your data, withdraw consent, name a nominee and complain. Section 11 explains how, and what each request does today.

What we collect

3.1 We do not store your Aadhaar OTP. It is typed once and passed to the Income Tax portal.

3.2 Aadhaar number. We do not store your Aadhaar number. If the Income Tax portal returns it with your PAN profile, we do not keep it; the app shows at most its last four digits, taken from the portal's reply at that moment. Any Aadhaar number stored before this version of the policy is erased from our records.

3.3 We do not collect data from your phone's contacts, and we never ask you to give us a friend's number.

Why we use it, and on what basis

4.1 We use your data only for the purposes in section 3 and these:

1. To run your account and keep it secure.
2. To fetch your tax documents and prepare your return.
3. To give you the return file to upload on the Income Tax portal, only after you approve it (see the Terms of Service).
4. To deliver Tax Expert services you order.
5. To take payment, issue invoices and refund.
6. To send you the messages described in section 7.
7. To answer support requests and complaints.
8. To meet our legal duties, and to answer lawful requests from authorities.
9. To keep TaxCare working and safe: fixing faults, stopping fraud and abuse.

4.2 Basis. We rely on your consent for each purpose, given separately where the purposes are separate. Where the DPDP Act allows processing without consent for a "legitimate use" — for example to meet a legal duty — we rely on that instead.

4.3 We do not use your data to build advertising profiles. We do not use automated decisions that have legal effects on you. TaxCare's tax calculations are tools you review; you decide what is filed.

Consent

5.1 We ask for each consent separately. None is pre-ticked.

5.2 The consents we record are: agreeing to this policy and the Terms of Service; confirming you are 18 or older; Tax Expert services (when you place an order); capital-gains statements (when you upload one); sharing a sample broker statement to help us support more brokers (optional); and marketing messages (optional — we do not send marketing today).

5.3 Each consent is stored with the time and how it was given (directly, or through a partner's sign-in).

5.4 You can see and withdraw each consent in Profile → Privacy & Data. Withdrawing is as easy as giving. What happens when you withdraw:

• Tax Expert, capital-gains or sample-sharing consent: we stop that processing from then on.
• Marketing: we stop marketing messages (none are sent today).
• This policy and the Terms of Service: we cannot run your account without them. We will ask you again at your next sign-in, and you can delete your account instead.
• Withdrawal does not undo processing already done, and does not end records we must keep by law (section 10).

Your Income Tax portal password

6.1 To fetch your documents, TaxCare resets your Income Tax portal password with you, using the portal's own Aadhaar OTP. You set the new password.

6.2 Why we must store it. TaxCare is an approved e-Return Intermediary (ERI) of the Income Tax Department for Type 1, Type 2 and Type 3 filing. Type 3 filing needs your e-filing portal password. Storing it is therefore a required part of the service, not an optional extra. If you do not want us to store it, we cannot fetch your data or provide the service.

6.3 We store it encrypted (AES-256). Our systems use it only to sign in to the Income Tax portal for your PAN to fetch your documents and status. We use it for nothing else.

6.4 You can revoke this at any time (6.5 and 6.6).

6.5 You can view it in the app at any time. You can change it on the Income Tax portal at any time; TaxCare will then stop being able to fetch until you reconnect.

6.6 Disconnecting a PAN. When you remove a PAN, we stop using it at once and erase the encrypted portal password we stored for it. If you add the PAN again, you sign in to the portal again and a new password is stored. The record of any return already filed is kept for the period in section 10.

6.7 Your Aadhaar OTP is never stored, and we do not store your Aadhaar number (section 3).

Messages we send you

7.1 Always sent (needed to run your account): sign-in OTPs, security alerts (for example a new sign-in, a changed email, a PAN moved to another account), and confirmation of your account.

7.2 Service updates, sent without a switch: messages about your payments, your return's status, e-verification reminders, and your Tax Expert order. These tell you about a service you asked for. You can stop them on a device through your phone's or browser's settings.

7.3 Optional, only if you switch them on: family & tax-profile updates, referral updates, and support-ticket updates — per channel (push, WhatsApp, SMS, email), in Profile → Notifications. Nothing is on until you turn it on.

7.4 WhatsApp messages use templates approved by WhatsApp. SMS is used for security alerts only as a last resort. Optional push messages are held between 22:00 and 08:00 IST.

Who we share data with

8.1 We do not sell your personal data. We share it only as below, and each recipient gets only what it needs.

8.2 Our internal back-office. Our own support systems receive account events (for example "account created" or "account deleted") to help you. They are under the same rules as this policy.

8.3 Measuring our ads. We advertise on Google, Meta (Facebook, Instagram) and through Airbridge. When you use TaxCare, our servers tell them which screen or step you reached (for example "signed up" or "return filed") and the campaign code of the ad you came from (such as gclid, fbclid, utm values or Airbridge link parameters). They never receive your PAN, Aadhaar, name, phone, email, income, amounts or any tax details, and no tracking script or cookie of theirs runs in TaxCare. This is on by default; you can turn it off at any time under Profile → Privacy & Data. Only if you switch it on there do we also send a hashed (scrambled) copy of your email and mobile so they can match an ad to your account. Nothing is sent for anyone under 18. These companies may process this outside India.

Partner web addresses

9.1 Some companies run TaxCare under their own web address. Your data is still held by TaxCare on our own systems. The partner does not receive your tax data from us.

9.2 If you arrive through a partner's app, the partner tells us a mobile number it has verified. We may also receive your consent through it, and we record that it came through that partner. If no consent came through, we ask you ourselves.

9.3 If you first arrived through a partner, we record that partner on your account to pay it its share of what you pay us. That record does not change later.

How long we keep data

10.1 At the end of the periods above, we erase or anonymise the data: a daily job removes names, mobile numbers, PANs, addresses and saved devices from accounts deleted more than 8 years ago, anonymises payment records, and clears old notifications. Filed returns follow their own 6-year period.

10.2 When you delete your account. Your account is deactivated at once. You are signed out on every device and nobody can sign in to it. The encrypted portal password and any Aadhaar value, saved devices, notification tokens, your notification feed, your nominee and any return you had not filed are erased. Records that the retention periods above require us to keep (filed returns, payments and invoices, support tickets, chat, Tax Expert orders, logs, and your consent history) are kept securely, are not used for anything else, and are erased or anonymised when their period ends. You can ask the Grievance Officer to confirm what we still hold.

10.3 Your consent history is kept as proof of consent, for the same period as the records it supports.

Your rights

You can use these rights from your account. You can also write to the Grievance Officer (section 15). We answer within the time on the Grievance Redressal page.

1. Access. Profile → Privacy & Data → Download my data. The download includes your account, consents, nominee, requests, notification choices, support tickets and chats. For a full summary — including tax profiles, returns, payments, Tax Expert orders and who we have shared data with — write to the Grievance Officer.
2. Correction. You can change your email, address and contact details in the app. Your name, PAN and date of birth come from the Income Tax portal; to correct them, correct them with the Income Tax Department and reconnect. For anything else, write to the Grievance Officer.
3. Erasure. Profile → Danger Zone → Delete account. This deletes the whole account as described in 10.2. To erase only some data, write to the Grievance Officer. We cannot erase records the law requires us to keep; we will tell you which and until when.
4. Nominee. You can name one person in Profile → Privacy & Data to use your rights if you die or cannot act.
5. Withdraw consent. See section 5.4.
6. Grievance. See section 15 and the Grievance Redressal page.
7. Data Protection Board of India. If you are not satisfied with our answer, you may complain to the Data Protection Board of India.

Security

12.1 Data is encrypted in transit (TLS) and at rest. Portal passwords are encrypted again at field level. Access is role-based and checked on every request. Every service checks the identity of every other service that calls it. Files are in private storage, opened only through short-lived links. Significant actions are recorded in an audit log.

12.2 No system is perfectly secure. If something goes wrong, section 13 applies.

If there is a personal data breach

13.1 We have a written breach-response plan.

13.2 If a breach affects your personal data, we will tell you without delay, in plain language: what happened, what data, the likely effect, what we have done, what you should do, and whom to contact.

13.3 We will report it to the Data Protection Board of India within the time the law requires.

Children

14.1 TaxCare accounts are only for people aged 18 or older. You confirm this when you sign up.

14.2 A parent or guardian may add a child's PAN as a family member to file for the child. In that case the adult acts for the child. We do not track, profile or show ads based on a child's data.

Contact, Grievance Officer and DPO

Monish Kumar — Grievance Officer and Data Protection Officer

Email: grievance@taxcare.in

Overseas Apps Private Limited, NX One Tower, Tech Zone IV, Greater Noida, Uttar Pradesh 201318, India

General support: support@taxcare.in · +91 78785 52624, WhatsApp only (Mon–Sat, 09:00–19:00 IST)

Response times are on the Grievance Redressal page.

Other notices

• Cookies and device storage: see the Cookie & Storage Notice.
• Shri assistant: see the AI Assistant Disclaimer.

Changes to this policy

17.1 If we change this policy in a way that matters to you, we will tell you in the app and by email at least 15 days before the change takes effect, and ask for fresh consent where the law needs it.

17.2 Each version shows its number and effective date. Earlier versions are available on request.