Part A applies to everyone. Then read the part that describes you: B if a CA files your own return through us, C if you are a partner or staff member of a CA firm, D if a firm or your employer invited you to a portal, E if you are an expert CA on our panel.
What changed in this version: the policy now covers every kind of ReturnDone user, lists exactly what is encrypted and what is not, and names the other companies that receive data. Deleting your data is a request to support@growinture.com, with the same time limits as before.
Tax documents are among the most sensitive files you own. This policy explains exactly what we collect, why, who can see it, and the controls you have. "ReturnDone" and "we" mean Growinture Technologies Pvt. Ltd., Bengaluru.
Who is responsible for your data depends on how you use ReturnDone. If you are an individual filing your own return, a partner or staff member of a CA firm, or an expert on our panel, ReturnDone is the Data Fiduciary for your account and your data. If a CA firm or your employer invited you to a portal, they are the Data Fiduciary for your data and ReturnDone is their Data Processor: we hold your data for them and on their instructions.
Solely to provide the service: to prepare, review and file an individual's income tax return and reconcile their documents against AIS/26AS; to run a firm's workspace; to show portal users what their firm or employer shares with them; to communicate about a case or a task (queries, status, reminders); to process payments and refunds; to keep the service secure; and to meet legal record-keeping obligations.
We do not sell your data or use it for third-party advertising, ever.
In transit. The site is served over HTTPS (TLS). The sign-in cookie cannot be read by scripts on the page, and every form that changes something carries an anti-forgery token.
Encrypted before it is stored. Every uploaded document and every chat attachment is stored encrypted (AES-256-GCM). So are these fields: PAN; Aadhaar, UAN and ESIC numbers of employees; dates of birth of team members and employees; mobile numbers; an employee's email address on their employee record; income-tax and other portal login ids and passwords that are stored with us; PDF passwords; bank account numbers; two-factor secrets; chat messages; and support requests.
Hashed, not stored. Passwords are never stored — only a one-way hash. Sign-in sessions, password-reset links, invitation and activation codes, one-time codes, document-upload links and employee document links are stored only as hashes.
Not encrypted by the application. These are stored as ordinary text or numbers: names and postal addresses; the email addresses used to sign in, to find an account or to send mail; GSTIN, TAN, CIN, DIN and PF/ESIC establishment numbers (a GSTIN contains its holder's PAN); tax figures, computations, onboarding answers and the filed acknowledgment number; task names, notes and comments; questions and answers between an expert and a taxpayer on a case; invoice amounts, descriptions, names, addresses, GSTIN, IFSC, branch and account-holder name; file names, sizes and types; notifications other than chat and support ones; the audit log, including IP addresses; short display forms such as the last four characters of a PAN; UDIN register and DSC custody details; and profile photos. At rest, these rely on the protection of the server's disk and of our backups.
A note on the newer encrypted fields. Client and employee identity fields, team members' details, client logins' mobile numbers, a firm's PAN and phone, and support messages were added to encryption in our October 2026 release. For a period after that release an unencrypted copy of those fields is still kept beside the encrypted one, so that the release can be rolled back; it is removed in a second step. Write to support@growinture.com to ask which step the live system is in.
What this is and is not. The encryption key is held by ReturnDone on the application server. Our servers can read the data they store — they have to, to compute tax, print invoices and show you your records. No system is perfectly secure; if a breach affects you, we will notify you and the Data Protection Board as the DPDP Act requires.
Between firms. Each firm sees only its own data. A firm cannot open another firm's clients, documents, tasks or conversations.
Inside a firm. Access follows the permissions of a person's role. By default a staff member sees only the clients they lead or hold a task for. Seeing all clients, the stored portal passwords, billing, team management and the audit log each need their own permission.
Clients and employees. A client login sees only its own company's records. An employee sees only their own record and the documents shared with them.
Experts. An expert sees an individual's case only if it belongs to their firm and they are its signer or assigned preparer.
ReturnDone operators. Operators sign in through a separate door that always requires two-factor authentication. There is no operator screen that opens a firm's client records, a stored document, or a firm's conversations with its clients, employees or team. Operators do read what is addressed to them: your conversation with ReturnDone Support, the support requests you raise or hand over to us, and any file you attach to those. They see order, subscription, billing and referral records. A small number of engineers who administer the server could technically reach stored data; they do so only to operate and secure the service.
Seeing a stored secret in full. Stored portal passwords and masked identity numbers are shown in full only after the viewer proves again who they are, and every such reveal is logged.
Document downloads are logged: who, which document, when, and through which route. Sign-ins and failed sign-ins, password changes, reveals of a stored password or identity number, edits to an identity field, role and permission changes, invoices and payments are logged too. A firm can read its own log if it holds the audit-log permission.
Deleting something inside the product hides it from use; it is not erased from the database at that moment. Erasure is a request to us, and this is how each kind of request works.
Individuals. Filed-return records are retained for 8 years in line with statutory assessment windows; uploaded source documents are retained for the same period unless you request earlier deletion. To request deletion, write to support@growinture.com from your registered address; we confirm within 72 hours and complete it within 30 days where law permits. You can also close your account yourself from your Profile: sign-in stops at once, and after 30 days your name, email, PAN, phone, date of birth and refund account are blanked on the account record. Closing an account does not by itself erase your documents, conversations or return data — ask us for that. Abandoned (unpaid) accounts are purged after 12 months.
Firms. A firm's data stays in its workspace for as long as the workspace is open. Returning and deleting it at closure is described in the Terms of Service.
Clients and employees of a firm. Ask the firm or your employer; they decide how long your data is kept, and we delete it on their instruction.
Backups are kept for up to 30 days and then overwritten, so deleted data can remain in a backup for that long.
You may access a copy of your data, correct inaccuracies, request deletion, withdraw consent, and nominate a person to exercise these rights on your behalf. You can correct your profile and download your documents in the product; for everything else write to support@growinture.com. We respond within 15 days. If unsatisfied, you may escalate to the grievance officer (below) and then to the Data Protection Board of India.
If a firm or your employer invited you, make the request to them; we will help them act on it. If you write to us instead, we pass it to them.
The service is for people aged 18 and above. We do not knowingly process children's data; if you believe a minor has created an account, write to support@growinture.com and we will delete it.
Grievance Officer, Growinture Technologies Pvt. Ltd., Bengaluru · support@growinture.com. We acknowledge complaints within 24 hours and resolve them within 15 days, as required under the DPDP Act and IT Rules.
Material changes are notified by email 15 days in advance and summarised at the top of this page. Continued use after the effective date constitutes acceptance; if you disagree, you may close your account and ask us to delete your data first.
Account details (name, email, mobile); identity details needed for filing (PAN, date of birth, bank account for refunds); the tax documents you upload (Form 16, AIS/TIS, broker statements and similar) and any password needed to open them; your questionnaire answers; your income-tax portal login, only if you choose to share it; payment metadata from Razorpay (never your card or UPI credentials); and your conversations with your CA and with support. We collect nothing beyond what preparing and filing your return requires.
To prepare and file your return, the documents you upload are made available to the Chartered Accountant assigned to your case and the authorised members of their firm working on it. They are stored encrypted. We do not use automated document-reading tools on them and we do not send them to any outside service to be read: a qualified CA reviews them. (Our own server checks that an uploaded file can be opened; nothing leaves the server for that.) If we ever introduce automated reading, we will change this policy first and ask for your consent.
All storage and handling runs on India-region infrastructure and happens only under the explicit consent you give at signup: "I agree to the Terms and the Privacy Policy, and consent to my documents being processed on secure servers in India, solely to prepare my return." That is the entire scope.
You may withdraw consent at any time by writing to support@growinture.com or by closing your account from your Profile. Withdrawal stops further processing but may prevent us from completing your return.
Only the Chartered Accountant assigned to your case and any authorised colleague at their firm working on it. Every document download is logged with the user, the time and the route. Marketing and sales staff cannot open customer documents. Platform operators see order and status metadata, not your document contents — except a file you yourself attach to a support request, which the support team reads in order to help you. The CA and their firm are bound by professional confidentiality and by contract to use your data solely to prepare and file your return.
From the firm: its name, address, FRN, PAN, GSTIN, contact email and phone, and bank details it adds for its own client invoices or for referral payouts. From each partner and staff member: name, sign-in email, mobile, and anything they add to their team profile (their own PAN, date of birth, an emergency contact). We also keep the firm's subscription, billing and referral records, and its support conversations with us.
ReturnDone is the Data Fiduciary for this account and billing data. We use it to run the workspace, to bill the subscription and to support the firm.
For the data a firm enters about its clients, their contact people and their employees, the firm is the Data Fiduciary and ReturnDone is its Data Processor. We process it only to provide the workspace, on the firm's instructions. The commitments we make to firms as their processor are in Part D of the Terms of Service.
A firm cannot delete its workspace's data from inside the product: it asks us, and we return and delete it as the Terms describe.
Your CA firm or your employer decided to record your data in ReturnDone and to invite you. They are the Data Fiduciary; we are their Data Processor. Their own privacy notice tells you why they hold your data.
What is held about a client login: name, sign-in email and mobile, and your company's records — registrations, filings, documents, requests, invoices and messages with the firm. If your firm stores a government portal login for your company, its id and password are stored encrypted.
What is held about an employee: name, email, mobile, date of birth, PAN, Aadhaar, UAN and ESIC numbers as your employer or the firm entered them, the documents shared with you, and your messages. The identity numbers, date of birth, mobile and email on your employee record are stored encrypted.
Who sees it: the firm's people whose role allows it; your own company's logins for their own company; and you. ReturnDone's operators have no screen that opens these records.
To see, correct or delete this data, ask the firm or your employer. If you cannot reach them, write to support@growinture.com and we will pass your request on.
We hold your name, sign-in email, mobile, PAN, ICAI membership number, the plans you take, your firm's public contact line, your case work and messages, and your settlement records. Your PAN, mobile and chat messages are stored encrypted. Your firm's public phone line is shown to the taxpayers your firm serves.
ReturnDone is the Data Fiduciary for this data. We use it to verify you, assign cases, settle what you earn and meet our legal obligations. For the taxpayers' data you see on a case, you act under the Terms of Service: only for that return.