Privacy Policy
Last updated: 29 August 2026
1. Who is responsible for your data
KarSahayta, a sole proprietorship registered in Mumbai (Udyam UDYAM-MH-19-0451942), is the Data Fiduciary for the personal data described here, within the meaning of India's Digital Personal Data Protection Act, 2023.
2. What we collect
| Category | Examples | Why |
|---|---|---|
| Identity and contact | Name, WhatsApp number, email if you give it, preferred language | To create your account and reply to you in your language |
| Tax documents | Form 16, salary details, deduction proofs, income tax notices you send us | To read them and calculate your tax position |
| Tax identifiers | PAN, and GSTIN if you are GST-registered | Required for tax computation and filing |
| Conversation history | Your messages to us and our replies | To keep context so you don't repeat yourself, and to improve the service |
| Payment records | Transaction ID, amount, date, plan | Required by tax law; we never see or store your card details |
We do not ask for and do not want your bank passwords, income tax portal password, card numbers, or Aadhaar number. Please do not send them.
3. Consent
We ask for your consent when you first message us, and we record which version of our consent notice you agreed to and when. You can withdraw consent at any time by sending STOP. Withdrawing consent means we can no longer provide the service, so the account is closed as part of that process.
4. Where your data is stored
Your documents and tax records are stored on servers located in India (Mumbai region), using Amazon Web Services and Supabase.
One thing we want to be plain about. To read your documents and answer your questions, parts of the text are sent to Anthropic's AI service, whose servers are outside India. We send only what is needed for the task. Anthropic does not use this content to train its models. If you would rather your documents were not processed this way, the service cannot work for you, and you should not send them.
5. Who else sees your data
We do not sell your data. We do not share it for advertising. We share it only with:
- Service providers who operate parts of the platform: Meta (WhatsApp delivery), Amazon Web Services (storage and document reading), Supabase (database), Anthropic (AI processing), Razorpay (payments)
- A chartered accountant, only if you ask us to connect you and only with the information you agree to share
- Authorities, where we are legally required to
6. How long we keep it
| What | How long | Why |
|---|---|---|
| Tax documents and filing records | 8 years from the end of the relevant financial year | Income tax records must remain available for assessment and reassessment |
| Conversation history and general account data | 3 years after your account becomes inactive | Support history and continuity if you return |
| Payment records | 8 years, anonymised once you delete your account | Statutory accounting retention |
If you ask us to delete your data, we do so promptly, except for the payment records above. Those are anonymised — separated from your name and number — rather than destroyed, because we are required to keep the financial record itself.
7. Your rights
Under the DPDP Act you can:
- Access a summary of what we hold about you
- Correct anything inaccurate or incomplete
- Erase your data — send STOP on WhatsApp, or email us
- Withdraw consent at any time
- Nominate someone to exercise these rights if you die or become incapacitated
- Complain to us, and then to the Data Protection Board of India if we don't resolve it
We respond to requests within 30 days.
8. Security
Data is encrypted in transit and at rest. Access to production systems is restricted to the proprietor. Documents are stored with per-user access controls. We keep audit logs of access to tax documents.
No system is perfectly secure. If a breach affects your data, we will notify you and the Data Protection Board as the DPDP Act requires.
9. Children
The service is for adults filing their own taxes. We do not knowingly collect data from anyone under 18. If you believe a child has given us data, contact us and we will delete it.
10. Changes
If we change this policy materially, we will tell you on WhatsApp and ask for fresh consent where the law requires it. The version you agreed to is recorded against your account.
Data protection contact
Abrar Shaikh, Proprietor — KarSahayta
Email: complaints@karsahayta.com
Goregaon West, Mumbai 400104, Maharashtra, India
If we do not resolve your complaint, you may escalate to the Data Protection Board of India.