Draft for legal review. Replace every [bracketed] detail and have a lawyer check this page before launch.

Privacy Policy

Last updated: 9 November 2026 · Applies to TaxNavic (taxnavic.com and the TaxNavic app)

सार (हिंदी में)

Calculator में डाले आँकड़े आपके browser में ही रहते हैं। Plan save करने पर ही हमारे पास आते हैं।
Account के लिए हम सिर्फ़ email और नाम रखते हैं; राज्य, शहर और उम्र का समूह आप चाहें तो ही देते हैं। कोई password नहीं रखते।
My CAS की file और उसका password कभी हमारे पास नहीं आते। सब आपके browser में ही पढ़ा जाता है।
हम आपका data बेचते नहीं, और कोई विज्ञापन या tracking नहीं करते।
आप कभी भी अपनी जानकारी देख, बदल या पूरा account delete कर सकते हैं।

1. Who we are

TaxNavic is run by [legal entity name], [registered address] ("we", "us"). For this policy we are the Data Fiduciary under India's Digital Personal Data Protection Act, 2023 (DPDP Act) and its Rules.

Questions or requests: privacy@taxnavic.com. Grievance Officer: [name], privacy@taxnavic.com, [address].

2. What we collect and why

Data	When	Why
Figures you type into a calculator	Every use	To show your result. They stay in your browser and reach us only if you save a plan.
Email address	When you log in	To create your account and log you in with a one-time code or link. We never store a password.
From Google sign-in: name, email, profile photo link, Google account ID	If you choose Google	To log you in. We never receive your Google password and cannot read your Gmail, Drive or contacts.
Full name; and, only if you choose to add them, state, city and age group	Registration (name) and My account (the rest)	To run your account, and, only as totals that name no one, to understand who uses TaxNavic.
Date you accepted the Terms, and your language	Registration	To record your consent and show the app in your language.
Plans you save	When you press Save	So you can open them again.
Your agreement to the Terms and Refund policy at checkout (policy version and time), and the dates and times you used paid features (PDF, Excel, My CAS, year-by-year table)	When you buy, and when you use a paid feature	To show the service was agreed and delivered if a payment is disputed. Shared with Razorpay and your bank only for that dispute.
Plan and billing you pick on the Standard or Premium list	If you join	To email you once when payments open.
Subscription tier and payment references	When paid plans start	To give you the features you paid for, and for tax and accounting records.
Technical logs: IP address, browser type, time of login	Automatically, kept by our providers	Security, abuse prevention and fixing faults.

My CAS: your Consolidated Account Statement and its password are read only inside your browser. They are never sent to us or anyone else, and nothing from them is stored. Closing the page or pressing Clear removes them.

We do not collect PAN, Aadhaar, bank or card numbers, and we never ask for them.

3. Consent

We process your account data on the basis of your consent, which you give by ticking the box when you register. You may withdraw consent at any time by deleting your account or writing to us. Withdrawing does not affect processing done before it. Calculator use without an account needs no personal data.

4. Who processes your data for us

We share data only with service providers who process it on our instructions:

Supabase: database and login. Your account data is stored in its Mumbai (India) region.
Google: Google sign-in, if you choose it, and web fonts (your browser asks Google for the font files).
Netlify and Cloudflare: hosting the website and its domain.
[Email provider, e.g. Resend / Zoho]: sending login codes and replying to support emails.
Razorpay (Razorpay Payments Private Limited): payments for paid plans. Card, UPI and bank details go directly to Razorpay, which may save a card as a secure token only if you agree at checkout; we never see or store card numbers, CVV, expiry or UPI PIN. We keep only the payment reference, amount, date and plan.

Some providers may process data outside India. We use only providers bound by contract to protect it, and we will follow any restriction the Government of India notifies under the DPDP Act. We do not sell your data or share it for advertising.

5. Browser storage (no tracking cookies)

We use no advertising or analytics cookies. Your browser stores only what the app needs:

your language and last calculator (kg-lang, kg-mode), and whether you closed the welcome card (kg-welcome);
a plan you tried to save before logging in, for up to one hour (kg-resume);
your login session, while you are logged in.

6. How long we keep it

Account data and saved plans: until you delete them or your account.
Payment and invoice records, including the checkout agreement: as long as tax and accounting laws require, currently up to 8 years, even after you delete your account (they are then no longer linked to your login).
Records of when you used paid features: deleted with your account.
Technical logs: kept by our providers for a limited period, usually up to 90 days.
After you delete your account, its data is removed at once from our live database and from backups within [30] days.

7. How we protect it

All traffic is encrypted (HTTPS, with HSTS).
Database rules let each person read and change only their own rows; nobody can change their own subscription tier.
No passwords are stored: login uses Google or a one-time code.
The website blocks outside scripts and framing (Content Security Policy).
Access to our provider accounts is protected with two-step verification.

If a personal data breach happens, we will inform the Data Protection Board of India and the people affected, as the DPDP Act and Rules require.

8. Your rights

Under the DPDP Act you may:

get a summary of the personal data we hold about you and who we shared it with;
correct, complete or update it (most of it from My account → Edit my details);
erase it (My account → Delete account);
withdraw consent;
nominate someone to exercise these rights if you die or cannot act;
complain to our Grievance Officer, and if not resolved, to the Data Protection Board of India.

Write to privacy@taxnavic.com from your account email. We reply within [7] days and resolve grievances within the time the Rules set.

9. Children

TaxNavic is for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has an account, write to us and we will delete it.

10. Changes

If we change this policy in a way that matters, we will tell you in the app or by email before it applies, and ask for consent again where the law requires.