Privacy Policy

Effective date: 31 August 2026 Last updated: 31 August 2026

This Privacy Policy explains how Pathinettu Solutions LLP ("ITRSimple", "we", "us", "our") collects, uses, shares, and protects personal data when you use the ITRSimple desktop application, the ITRSimple cloud application at app.itrsimple.com, and the website itrsimple.com (together, the "Services"). It is written to meet the requirements of India's Digital Personal Data Protection Act, 2023 (DPDP Act).

If you do not agree with this Policy, please do not use the Services.

---

1. Who we are

2. Scope - two different products

ITRSimple is offered in two forms, and they handle data very differently:

• Desktop application (offline). Runs entirely on your own computer. Your data - and your clients' data - is stored in a local database file on that machine. ITRSimple does not transmit that data to us. The only information that reaches our servers from the desktop app is licence activation checks, software-update checks, anonymous error reports (if enabled), optional bug reports you submit, and - only if you turn on AI-assisted classification - the limited data described in Section 6.

• Cloud application (app.itrsimple.com). Runs on our servers. The data you and your clients enter is stored on our hosted infrastructure so it can be accessed from a browser. This Policy's provisions about storage, sub-processors, cross-border transfer, security, and retention apply primarily to the cloud application.

Where a provision applies to only one product, we say so.

3. Your role and ours

• Your clients' / taxpayers' data. When you (a chartered accountant, tax professional, or an individual preparing your own return) enter a taxpayer's personal and financial data into ITRSimple, you are the Data Fiduciary for that data and ITRSimple acts as your Data Processor - we process it only on your instructions and only to provide the Services. Our obligations to you as Processor are set out in our Data Processing Agreement.

• Your own account data. For the personal data of the account holder - your name, email address, phone number, firm details, and billing information - ITRSimple is the Data Fiduciary.

4. What personal data we process

4.1 Account data (you are the Data Principal; we are the Data Fiduciary)

• Name, email address, mobile number
• Firm / practice name, type, address, city, state
• Login credentials (passwords are stored only as salted hashes)
• Recovery PIN (stored as a hash)
• Billing and subscription information (see Section 4.4)
• Device / installation identifiers, app version, operating system (for licensing and support)
• Support and feedback messages you send us
• Records of your consent and of actions you take on your data (exports, deletions) - kept as a compliance record

4.2 Client / taxpayer data (your client is the Data Principal; you are the Data Fiduciary; we are the Processor)

Only what you choose to enter, which may include:

• Identity: name, PAN, Aadhaar number, date of birth, father's name, residential status, employee type
• Contact: address, city, state, pincode, mobile number, email
• Bank accounts: bank name, account number, IFSC, account type
• Financial data: bank-statement transactions, transaction classifications, income and expense figures, capital gains, deductions, advance tax / TDS / TCS entries, opening balances, loans, fixed assets
• Employer details (name, TAN)
• Supplier / customer / related-party names
• Government-portal login credentials for the client's income-tax e-filing account, if you choose to store them
• Data extracted from documents you upload - Form 16, Form 26AS, AIS, TIS, bank statements (the source files themselves are not retained - see Section 5)
• Tax computations and generated income-tax return data (JSON)

4.3 Website data (itrsimple.com)

• Standard server logs (IP address, browser type, pages visited, timestamps)
• Google Analytics measurement data (aggregated site usage)
• Anything you submit through the contact form

4.4 Billing data

Subscription for the cloud application is charged per (client + financial year). When we begin collecting payments, card / UPI / bank details will be handled by a third-party payment processor ([TO CONFIRM: payment processor, e.g. Razorpay]) - we do not store full card numbers on our systems. We retain only the fact of payment, amount, date, and a payment reference.

5. Uploaded documents are parsed and then discarded

When you upload a Form 16, Form 26AS, AIS, TIS, or a bank statement (PDF / Excel / CSV) to the cloud application, the file is sent to our server, the relevant figures are extracted, written into your workspace, and the source file is then deleted. We do not keep a copy of the uploaded document.

6. AI-assisted classification (optional, off by default)

AI-assisted classification is disabled unless you turn it on at signup or in Settings. When it is enabled, for the transactions ITRSimple cannot classify with its own rules, the following is sent to our AI sub-processor to suggest a category:

• the transaction's narration / description (first 150 characters) and type (credit / debit);
• the client's name and the last four digits of the client's own bank account numbers (used only to tell the client's self-transfers apart from genuine income);
• your existing confirmed classifications for that client (as examples);
• the names of the client's suppliers, customers, and related parties that you have entered.

Transaction amounts are not sent. The document source files are not sent (only the extracted figures are stored, as in Section 5).

Our current AI sub-processor is Anthropic, PBC (USA) - see our Sub-processor list for the up-to-date provider. You can turn AI off at any time in Settings → Your Data & Privacy; when it is off, no client data is sent to any AI service.

7. Purposes and legal bases

We process personal data for these purposes only:

We do not use your data or your clients' data to train AI models, for advertising, or for any purpose other than those listed above.

8. Who we share data with

• Sub-processors. Third parties that process data on our behalf to run the Services - hosting, AI classification, email delivery, payments. The current list, what each does, and where they are located is at itrsimple.com/sub-processors.html. We enter into data-processing terms with each.
• Your instructions. Data you ask us to export or transfer.
• Legal requirements. Where required by a valid legal request, court order, or to protect rights, safety, or property - limited to what is necessary.
• Business transfer. If ITRSimple is involved in a merger, acquisition, or asset sale, data may transfer to the successor entity under this Policy.

We do not sell personal data.

9. Cross-border transfer

The cloud application is hosted in India. Some sub-processors are located outside India - currently our AI provider (USA). The DPDP Act permits transfer of personal data outside India except to countries the Government of India restricts by notification; we transfer only to permitted countries and only what is necessary for the stated purpose.

10. Retention

• Desktop application. Data lives on your machine; you control it. If your subscription lapses, ITRSimple will offer to export your data and then delete the local database, on your confirmation.
• Cloud application. We retain your workspace for as long as your account is active. When you delete a client, or delete your account, all associated data - transactions, classifications, computations, generated returns, extracted document data, portal credentials - is permanently deleted after a 30-day recovery window. After deletion there is no way for us or you to recover it or view past computations. Export your data before deleting if you need copies for your records or to meet tax-law record-keeping obligations.
• After permanent deletion, data may persist in encrypted database backups for a short period until those backups rotate (about 7 days), after which it is gone from backups too.
• A minimal, non-identifying record that a deletion occurred (an internal id, what was removed, the date, and who confirmed it) is kept as evidence of compliance.
• Our full retention schedule is in RETENTION_SCHEDULE.md (internal).

11. Security

We use technical and organisational measures appropriate to the sensitivity of the data, including: encryption of data in transit (TLS) and at rest; encryption of stored login credentials and recovery PINs as hashes; access scoped to your company only; a bounded, least-privilege database connection; an activity log of exports, deletions, and consent changes; and background jobs that enforce retention limits. A plain-language summary is at itrsimple.com/security.html. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

12. Your rights

Under the DPDP Act you have the right to:

• Access a summary of the personal data we process about you and how.
• Correct, complete, or update inaccurate or incomplete data.
• Erase your data where it is no longer needed for the purpose it was collected for or where you withdraw consent.
• Withdraw consent at any time (this may mean we can no longer provide the Services).
• Nominate another individual to exercise these rights on your behalf in the event of your death or incapacity.
• Grievance redressal - raise a complaint about our handling of your data.

How to exercise them

• Cloud application: Settings → Your Data & Privacy - export your data, delete your account or a client, withdraw AI consent, view your data-activity log, and raise a grievance.
• Desktop application: Settings → Your Data & Privacy - export your data; raise a grievance (needs an internet connection).
• By email: raj@itrsimple.com (Grievance Officer).

If your request concerns a client's data and you are the CA, you exercise these rights through your workspace; if a taxpayer contacts us directly about data a CA holds in ITRSimple, we will refer them to that CA, who is the Data Fiduciary, and assist the CA in responding.

We will respond within the time required by law.

13. Grievance redressal and escalation

Contact our Grievance Officer, Rajesh Kumar, at raj@itrsimple.com. We aim to acknowledge within 3 working days and resolve within the period prescribed under the DPDP Act. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

Full process: itrsimple.com/grievance.html.

14. Children's data

The Services are meant for chartered accountants, tax professionals, and adult taxpayers. If a return is prepared for a taxpayer who is a minor, the CA is responsible for having obtained verifiable consent from the minor's parent or lawful guardian. We do not knowingly collect account-holder data from anyone under 18.

15. Cookies and analytics (website only)

itrsimple.com uses essential cookies and Google Analytics. The cloud application uses only cookies / local storage strictly necessary to keep you logged in and remember interface preferences. It does not use advertising or cross-site tracking cookies.

16. Changes to this Policy

We may update this Policy. If a change is material, we will re-request your consent in the app the next time you use it, and update the "Last updated" date. Continued use after a non-material change means you accept it.

17. Contact

Questions about this Policy or your data: raj@itrsimple.com / hello@itrsimple.com, or write to Pathinettu Solutions LLP at the address in Section 1.