Privacy Policy & Data Protection Charter

This Privacy Policy applies to all services, web portals, calculation tools, and mobile-optimized interfaces operated by Arthasaar Technologies Private Limited ("Arthasaar", "Company", "we", "our", or "us"), CIN: U12345RJ2020PTC012345, with registered offices at Jaipur, Rajasthan, India.

Under the Digital Personal Data Protection Act, 2023 (DPDPA 2023) and the Information Technology Act, 2000 (including the IT Rules 2011 and 2021 Intermediary Guidelines), Arthasaar functions as a Data Fiduciary in respect of personal, financial, and tax information submitted by registered taxpayers, guest users, and client entities ("Data Principals").

To provide accurate tax computation, optimize statutory deductions, prepare ITR schedules, and transmit e-Filing packets to the Income Tax Department (ITD), we collect the following categories of data:

We process personal and financial data only for lawful purposes explicitly authorized by you or mandated by statutory Indian regulations:

• Tax Calculation & Return Preparation: Parsing uploaded PDFs (Form 16 / AIS), computing gross income, applicable tax slabs (New vs Old Tax Regime), deductions, interest liabilities under Sections 234A/B/C, and refund entitlements.
• Statutory e-Filing Transmission: Packaging schema-compliant JSON/XML datasets and securely transmitting return filings to the ITD e-Filing Portal API gateway.
• Chartered Accountant (CA) Review: Enabling assigned empanelled tax professionals to review, verify, and validate complex capital gains, business returns (ITR-3/4), and audit schedules.
• Transaction & Invoicing: Generating tax invoices with applicable Goods & Services Tax (GST) and processing payments via regulated payment aggregators.
• Fraud Prevention & Security Audits: Detecting anomalous logins, safeguarding accounts against credential stuffing, and maintaining CERT-In statutory logs.

Under Section 6 of the DPDP Act 2023, personal data is processed solely on the basis of your free, specific, informed, unconditional, and unambiguous consent.

When you create an account, upload financial documents, or initiate an e-filing request, you grant Arthasaar explicit authorization to extract, compute, and assemble your return. You have the right to withdraw your consent at any time by contacting our Grievance Officer; however, withdrawal does not invalidate processing performed prior to the withdrawal or statutory retention required under the Income Tax Act, 1961.

We disclose your data only to the following trusted, strictly regulated recipients for fulfilling your tax filing:

Under Sections 149 and 153 of the Income Tax Act 1961, the Income Tax Department may initiate assessment, reassessment, or scrutiny of tax returns for up to six to ten assessment years.

To enable you to access past ITR-V acknowledgements, computation sheets, and Form 16 archives in case of departmental notices or audit inquiries, we securely retain filed return copies for a period of up to 7 years. You may request account deactivation; however, statutory e-filing audit trails are archived in cold encrypted storage until the statutory limitation period expires.

We implement comprehensive technical and organizational safeguards in accordance with ISO/IEC 27001 standards and RBI Cyber Security Framework:

• Encryption in Transit: All HTTP traffic is protected with Transport Layer Security (TLS 1.3 / 256-bit SSL) with HSTS enforcement.
• Encryption at Rest: Database tables, document object stores (Form 16 PDFs), and cryptographic keys are encrypted using AES-256 with automated key rotation.
• Indian Data Localization: All core databases and compute workloads reside strictly within physical Tier-IV data centres located inside the Republic of India (Mumbai / Pune / Hyderabad regions).
• Zero Permanent Storage of Raw Aadhaar: As per UIDAI circulars, Aadhaar numbers are never stored in plain text and are tokenized or masked.

Under Chapter III of the DPDP Act 2023, you possess the following enforceable rights:

We use strictly essential session cookies and anti-CSRF security tokens to maintain your authenticated login state and prevent cross-site request forgery. We do not use third-party invasive ad-tracking pixels or cross-site tracking scripts.

Our services are intended for individuals who have attained the age of majority (18 years). In situations where an Income Tax Return is prepared for a minor child possessing taxable income (e.g. under Section 64(1A) clubbing provisions or independent talent income), such filings must be authorized and submitted by the lawful parent or appointed legal guardian.

In accordance with Rule 3(2) of the Information Technology (Intermediary Guidelines) Rules, 2021 and the DPDP Act, 2023, you may address any concerns, data deletion requests, or grievances to our designated Grievance & Data Protection Officer: