Privacy Policy

How we collect, use, and protect your personal data — and the rights you have over it under India's Digital Personal Data Protection Act, 2023.

1. Introduction

TaxCare, operated by Overseas Apps Private Limited ("TaxCare", "we"), helps you prepare and e-file your Income Tax Return, pay tax, work with a Tax Expert, and keep your filings, payments and messages with us in one place. We are the Data Fiduciary for the personal data described below.

This notice explains what personal data we collect, why, who receives it, how long we keep it, and the rights you have under the Digital Personal Data Protection Act, 2023 (DPDP Act). It applies on taxcare.in, on our other domains, in the TaxCare mobile app, and on a partner's own domain where you reached TaxCare through one. It is available in English and Hindi.

2. Information We Collect

We collect these categories of information, only for the purposes stated below:

• Identity and contact — your mobile number, used to create your account and verify you by OTP; and your email address once you verify it.
• Tax profile — for yourself and each family member you add: PAN, name, date of birth and the details the Income Tax portal returns for that PAN. Your portal password is stored encrypted, and only to fetch your documents and file your return.
• Tax and filing data — statements fetched from the Income Tax portal (Form 26AS or Form 168, AIS, TIS, past returns), what you enter or upload (deductions, broker statements, other documents), and the returns we prepare, file and download for you.
• Payments — the fee, coupons, invoices and status of what you pay us. Card and bank details go directly to our payment partner; we never see or store them.
• Tax Expert orders — your requirement, documents, messages, notice details and approvals, and the ratings you give.
• Support and assistant — messages, support tickets and their history. Questions you ask Shri are kept only on your own device.
• Preferences and consent — your notification choices, the consents you have given or withdrawn, and any nominee you name.
• Device and log data — device type, an approximate location derived from your IP address, sign-in times and actions on your account, collected for security, fraud prevention and diagnostics.

3. How We Use Your Information

We use your information to:

• Verify your identity and keep your account and devices secure.
• Fetch your statements, prepare your return, and file, verify and track it.
• Take payment, issue invoices and process refunds.
• Assign and run your Tax Expert orders.
• Answer your support tickets, messages and questions.
• Send transactional and security alerts, and other notifications only on the channels you have opted in to.
• Run referral rewards and offers you choose to use.
• Detect and prevent fraud and misuse, and meet our legal and tax obligations.

4. Sharing & Disclosure

We do not sell your personal data. We share it only in these circumstances, and only the minimum needed:

• The Income Tax Department and its systems, to fetch your statements and to file, verify and track your return — at your instruction.
• Processors who work for us under written obligations: cloud hosting and storage; our payment partner (payments); SMS, WhatsApp, email and push providers (alerts and OTP); and our logging and analytics tools, which receive redacted data only.
• Your Tax Expert, who sees only the documents and details of the order you place.
• A partner's own domain, where you reached TaxCare through one — the data we process does not change; the partner sees branding and, if you chose that route, that you came through them for revenue-share purposes.
• Authorities, courts and regulators, where the law requires it.

5. Data Security

We encrypt data in transit and at rest, apply role-based access control, and log every significant action on your account. Every internal service verifies who is asking on every request — nothing is trusted merely for being inside our network. Trusted devices can be reviewed and signed out by you at any time. Access to sensitive fields is limited to those who need it, and we run a documented breach-response process to notify you and the Data Protection Board of India within the periods the law requires.

6. Data Retention

Filed ITR and tax records are retained for 6 years from the date of filing, matching the Income Tax Act's reassessment window — even if you ask for erasure sooner, because the law requires it.

All other data — messages, support tickets, audit logs and uploaded documents — is kept for up to 8 years, then erased or anonymised, unless a legal hold applies or your account is still active. Documents of a cancelled or refunded Tax Expert order are erased after 30 days. When you delete your account we erase or anonymise everything not covered by a legal retention period.

7. Your Rights & Choices

Under the DPDP Act you can, from your account and without raising a ticket:

• Access a summary of the personal data we hold about you and who we share it with.
• Correct inaccurate or incomplete data.
• Request erasure, subject to the retention periods above.
• Nominate another person to exercise your rights if you die or become incapacitated.
• Withdraw any consent, as easily as you gave it — withdrawal does not affect what was done before it.
• Raise a grievance with our Grievance Officer (below) and, if unresolved, complain to the Data Protection Board of India.

8. Consent

We ask for consent separately for each purpose, in plain language, before acting on it — for example agreeing to this policy at sign-up, or allowing push notifications from a tap. None is pre-ticked, and none is a condition of an unrelated service. You can see and withdraw each from Privacy & Data at any time. Where we process data without consent, it is for a purpose the DPDP Act allows, such as complying with law.

9. Cross-Border Transfers

Your data is stored in India. A few providers process limited data outside India: push notification delivery (Google Firebase — a device token and message text), operational logging (redacted of personal identifiers), our Shri assistant (questions with PAN, Aadhaar, phone and email masked first), and referral-link creation (no personal data). We do not send taxpayer documents abroad, and we review each such provider against the Government's restricted-country notifications.

10. Cookies & Device Storage

We use a small number of first-party cookies and local storage that the app needs to work: your signed-in session, the trusted-device cookie that spares you a repeat OTP on this device for up to a year, and your language, theme and Shri conversation (kept on your device for 120 days). We do not use advertising or cross-site tracking cookies.

11. Children's Privacy

TaxCare is not directed at, and does not knowingly collect data from, anyone under 18 for their own account. A parent or guardian may add a minor's PAN as a family member to file on their behalf, and does so as that person's lawful guardian. We do not track, profile or advertise to children. If we learn we hold a minor's data without verifiable parental consent, we will erase it.

12. Changes to This Policy

We may update this notice as our practices or the law change. Material changes are shown in the app before they take effect — the version and date above always show the current one.

13. Contact Us