WBC DTAX

Privacy Policy.

Last updated: January 2026. Your data is yours — WBC DTAX is custodian, not owner. This policy sets out exactly what we collect, why, how long we keep it, and the rights you have over it.

AES-256 at rest

Portal credentials & sensitive data are encrypted in our database — even our engineers can't read them in plaintext.

No third-party sale

We do not sell, rent, or share your personal data with advertisers, brokers or marketing partners.

Right-to-be-forgotten

You can request deletion at any time. Documents are purged; row metadata remains for legal audit only.

1. What we collect

  • Identity: name, email, mobile number, PAN, Aadhaar (for ITR filing only).
  • Authentication: hashed password (bcrypt), session refresh tokens (httpOnly cookies).
  • Tax data: salary statements, bank statements, investment proofs, capital-gains statements.
  • ITR / GST portal credentials (optional): AES-256-GCM encrypted at rest.
  • Communications: chat messages with your analyst, attachments (files + audio).
  • Operational: device, browser version and timestamps for audit logs.

2. Why we collect it

Each data point above maps 1:1 to a service you have asked for — filing your return, computing tax, scheduling an advisory session, processing your payment, or alerting you to a refund. We never enrich or sell this data to third parties.

3. How long we keep it

Tax filings are retained for seven years as required by the Income-Tax Act (audit window). Sensitive documents (PAN, Aadhaar, bank statements) are purged from disk once your filing is closed, but the metadata row stays for audit. Portal credentials are kept for the lifetime of your account unless you explicitly delete them via Profile → Credentials.

You can request earlier deletion at privacy@dtax.com.

4. How we secure it

  • HTTPS everywhere, TLS 1.2+.
  • Database hosted in India (or as you direct). Daily snapshots, encrypted at rest.
  • Application secrets in environment variables, never in source control.
  • Bcrypt-hashed passwords (12+ rounds) and AES-256-GCM ciphertext for portal credentials.
  • Role-based access control inside WBC DTAX; every analyst data-reveal is audit-logged.

5. Your rights

  • Access: download your historical tax summaries (PDF) from your dashboard.
  • Correction: edit profile, KYC, ITR credentials inline.
  • Erasure: request account closure — sensitive blobs are wiped within 7 days.
  • Portability: export your case data as PDF/JSON on demand.
  • Withdrawal of consent: revoke ITR/GST portal access at any time.

6. Contact

Privacy questions, complaints or grievance redressal:

Email: privacy@dtax.com
Grievance officer: WBC DTAX Compliance Team, c/o WhiteBarn Capital, India.