Privacy Policy

TaxMedha is a product of Intime IT Services Private Limited(“we”, “us”, “our”), a company incorporated in India (CIN: U72900WB2013PTC192823, GSTIN: 19AADCI2235F1ZT), with its registered office at 3016, Mira Kunj, Rajdanga Main Road, 3rd Floor, Kasba, Kolkata – 700107, West Bengal, India. This policy applies to the TaxMedha public website, the Studio application, and every associated API.

• Account information — name, firm/organization name, email address, phone number (where provided), password (stored only as a salted hash, never in plain text), and role within your organization.
• Content you provide — queries you type or speak, documents and images you upload (notices, financial statements, client records), and any text you paste for research, drafting, or analysis.
• Billing information — plan, billing cycle, and transaction status. Card and UPI details are collected and processed directly by our payment processor, Razorpay; we do not store your full card number, CVV, or UPI PIN on our own servers.
• Usage and device data — pages visited, features used, approximate timestamps, IP address, browser/device type, and session identifiers, collected automatically to operate and secure the service.
• Communications — messages you send us through the Contact page, support requests, or a “Talk to a Human” request (including the contact details you provide for that request).

We do not knowingly collect more personal data than a feature actually needs to function.

• To operate Studio's features — Tax GPT, calculators, Notice Wizard, Knowledge Base, Talk To Human, and related modules.
• To authenticate you, maintain your session, and secure your account against unauthorized access.
• To process payments and send billing communications via Razorpay.
• To send you transactional email (one-time passcodes for sign-up/password reset, Notice Wizard dispatch, and similar account/service notices) via our email delivery provider.
• To respond to support requests and Talk To Human requests, including sharing your provided contact details with the finance practitioner you ask to be connected with.
• To maintain the audit trail described in our Audit Logs page.
• To improve product quality, debug issues, and prevent abuse.
• To meet legal, tax, accounting, and regulatory obligations.

Client personal data inside documents you upload is never used to train or fine-tune any AI model.

When you ask Tax GPT a question, upload a notice to Notice Wizard, or use another AI-assisted feature, the relevant text/document is sent to a large language model to generate a response. Some of this processing happens on infrastructure we operate in India; some of it is performed by third-party AI model providers who process the content as our sub-processors, strictly to generate the response you asked for:

• Anthropic (Claude models) — the primary model for most Tax GPT, Notice Wizard, and related answers.
• Amazon Web Services (Bedrock) — an alternate model-hosting route for some requests, run in AWS's Mumbai (ap-south-1) region.
• OpenAI — used for a small number of document-parsing/OCR features.
• Google (Gemini) — used only by the Research Council comparison feature, where comparing independent models' output is the explicit purpose of that feature.

Anthropic, OpenAI, and Google process data on infrastructure located outside India (principally the United States) — see “Cross-border data transfer” below. None of these providers may use the content you send them to train their own general-purpose models, under our agreements with them; always check a provider's own published policy for the current state of that commitment before sharing anything you would not want processed by a third party at all.

We do not sell personal data, and we do not share it for third-party advertising. We share it only with the service providers needed to run TaxMedha, each bound by a contract requiring them to protect it to a standard at least equivalent to this policy, and with authorities where required by law:

• Amazon Web Services (Mumbai, ap-south-1) — application hosting, database, file storage, and caching.
• Razorpay — payment processing for subscriptions.
• Mailtrap — transactional email delivery (one-time passcodes, Notice Wizard dispatch, account notices).
• The AI sub-processors listed above, for the specific content you submit to an AI-assisted feature.

Your core account data, documents, and chat history are stored on servers located in India. Some processing — specifically, calls to the AI sub-processors named above that are headquartered outside India — necessarily involves transferring the relevant query or document content to servers outside India for the time it takes to generate a response. Under Section 16 of India's Digital Personal Data Protection Act, 2023, such transfers are permitted except to countries the Central Government specifically restricts by notification; we review this list and our sub-processor agreements on an ongoing basis.

Our primary databases, document storage, and application servers run on Amazon Web Services' Mumbai (ap-south-1) region. Data is encrypted in transit (TLS) and at rest. Access to production systems and to your data is restricted by role (RBAC) and logged; firm accounts can enforce multi-factor authentication and single sign-on. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

We keep account and content data for as long as your account is active, and for a reasonable period after closure to allow reactivation and meet legal obligations. Specific categories have longer, statutorily-driven minimums:

• Audit logs (query/answer/citation trail) — a minimum of 8 years, append-only, matching statutory expectations for tax and audit work; see Audit Logs.
• Billing and invoice records — the period required under the Income-tax Act, 1961 and the Companies Act, 2013 (currently up to 8 years).
• Records relevant to an open legal, regulatory, or grievance matter — until that matter is resolved.

You may request earlier deletion of data outside these statutory minimums; see “Your rights” below.

Under the Digital Personal Data Protection Act, 2023, you have the right to:

• Access a summary of the personal data we hold about you and how it has been processed.
• Correct or update inaccurate or incomplete personal data.
• Erase personal data that is no longer necessary for the purpose it was collected for, subject to the statutory retention minimums above.
• Withdraw consent for a processing activity at any time, as easily as you gave it — this may limit or end your ability to use features that depend on that processing.
• Nominate another individual to exercise these rights on your behalf in the event of death or incapacity.
• Grievance redressal — raise a complaint with us first (see below), and, if unresolved, with the Data Protection Board of India.

To exercise any of these rights, contact us at [email protected] or via the Contact page. We will acknowledge your request within a reasonable time and respond substantively within 30 days. Firm admins can additionally manage organization-level retention and access policies from Settings.

TaxMedha is a professional tool for finance practitioners and is not directed at, or knowingly used by, children. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us personal data, contact us and we will delete it.

We use only strictly necessary cookies — to keep you signed in and maintain your session state. We do not currently use analytics or advertising cookies. See our Cookie Policy for the full detail.

In accordance with the Information Technology Act, 2000 and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, the Grievance Officer for TaxMedha is:

Sandip Tanti, IT Admin
Email: [email protected]

Complaints are acknowledged within 24 hours and resolved within 15 days of receipt, as required by Rule 3(2) of the above Rules.

We will post material changes here with an updated effective date, and notify firm admins by email for changes affecting how data is collected or shared.

Questions about this policy can be sent to [email protected] or via the Contact page.