Last updated: 01 Apr 2026 · Aligned with the DPDP Act, 2023
Tax documents are among the most sensitive files you own. This policy explains exactly what we collect, why, who can see it, and the controls you have. The data fiduciary is Growinture Technologies Pvt. Ltd., Bengaluru ("ReturnDone", "we").
Account details (name, email, mobile), identity details needed for filing (PAN, Aadhaar as provided by you, date of birth, bank account for refunds), the tax documents you upload (Form 16, AIS/TIS, broker statements and similar), your questionnaire answers, payment metadata from Razorpay (never your card/UPI credentials), and support conversations. We collect nothing beyond what preparing and filing your return requires.
Solely to prepare, review and file your income tax return; to reconcile your documents against AIS/26AS; to communicate about your case (queries, status, e-verification reminders); to process payments and refunds; and to meet legal record-keeping obligations. We do not sell your data or use it for third-party advertising, ever.
To prepare and file your return, the documents you upload are made available to the Chartered Accountant assigned to your case and the authorised members of their firm working on it — no one else. They are stored securely and we do NOT use automated or AI tools to read, scan or extract data from them; a qualified CA reviews them. All storage and handling runs entirely on India-region infrastructure and happens only under the explicit consent you give at signup: "I agree to the Terms and consent to my documents being processed on secure servers in India, solely to prepare my return." That is the entire scope. You may withdraw consent at any time from Profile → Consent & privacy; withdrawal stops further processing but may prevent us from completing your return.
Only the Chartered Accountant assigned to your case and any authorised colleague at their firm working on it. Every document access is logged with user, time and purpose. Marketing, sales and engineering staff cannot open customer documents. Platform administrators see order and status metadata, not your document contents.
We share data with: the Chartered Accountant and their firm assigned to prepare your return — bound by professional confidentiality and by contract to use it solely to prepare and file your return; the Income Tax Department (to file your return); Razorpay (payment processing); and our email delivery provider (case notifications). We do not send your documents to any third-party document-processing or AI service. We disclose data to authorities only when legally required, and we notify you unless prohibited.
Documents are stored on secure servers in India with 256-bit encryption in transit (TLS 1.3) and at rest, isolated storage with access logging, and periodic security review. Your data never leaves secure servers without your consent. No system is perfectly secure; if a breach affects you, we will notify you and the Data Protection Board as the DPDP Act requires.
Filed-return records are retained for 8 years in line with statutory assessment windows; uploaded source documents are retained for the same period unless you request earlier deletion. Profile → "Delete my data" starts a deletion request; we confirm within 72 hours and complete it within 30 days where law permits. Abandoned (unpaid) accounts are purged after 12 months.
You may access a copy of your data, correct inaccuracies, request deletion, withdraw consent, and nominate a person to exercise these rights on your behalf. All of these are available in-app or by writing to support@growinture.com; we respond within 15 days. If unsatisfied, you may escalate to the grievance officer (section 12) and then the Data Protection Board of India.
We use essential cookies for login sessions and a privacy-respecting analytics tool that aggregates page-level usage without building individual profiles. No advertising trackers. You can clear cookies at any time; you'll simply be signed out.
The service is for taxpayers aged 18 and above. We do not knowingly process children's data; if you believe a minor has created an account, write to support@growinture.com and we will delete it.
Grievance Officer, Growinture Technologies Pvt. Ltd., Bengaluru · support@growinture.com. We acknowledge complaints within 24 hours and resolve them within 15 days, as required under the DPDP Act and IT Rules.
Material changes are notified by email 15 days in advance and summarised at the top of this page. Continued use after the effective date constitutes acceptance; if you disagree, you may delete your account and data first.