Privacy notice
How Fortax handles personal data under the Digital Personal Data Protection Act, 2023.
Version 2026-09-16 · Last updated 16 September 2026
1. Who we are
Fortax is a product of IFTS IT Solutions Pvt. Ltd., IIM Lucknow Campus, Prabandh Nagar, Lucknow, Uttar Pradesh, India. For the personal data you give us about yourself, we are the Data Fiduciary under the Digital Personal Data Protection Act, 2023 (“DPDP Act”). This notice covers fortax.in, ai.fortax.in, the hiSAI desktop app and the Fortax mobile and card products.
2. What personal data we collect
| Kind | Examples | Where it comes from |
|---|---|---|
| Account | Name, email, phone, firm or company name, role, password (stored only as a hash) | You, at registration |
| Billing | Plan, invoices, GSTIN, payment reference and status | You and our payment gateway |
| Usage | Sign-in times, device and app version, pages and features used, token usage, error logs, IP address | Automatically, as you use the product |
| Content | What you type to the assistant, files you upload, documents you seal, messages you ask us to send | You |
| Support | What you write on the contact form or to support, and our reply | You |
We do not ask for and do not want government identifiers beyond what a filing needs (PAN, GSTIN, TAN, CIN of the business you are filing for). We never store your government-portal passwords or OTPs: in hiSAI they stay in your computer’s own keychain, and they are never sent to us or to a model.
3. Why we use it
- To run the service you asked for — create your account, prepare and reconcile returns, generate documents, send the mail or WhatsApp you approve, and support you.
- To bill you — plans, invoices, payment reconciliation, and the tax records the law requires us to keep.
- To keep it safe and working — authentication, abuse and fraud prevention, rate limits, backups, debugging.
- To tell you about the product — release notes and service notices. Marketing mail only if you asked for it, and every such mail can be unsubscribed in one click.
We rely on your consent, which you give at sign-up and can withdraw, and on the legitimate uses the DPDP Act allows (for example, doing what you asked us to do, and meeting a legal obligation).
4. Your clients’ data
A CA firm or a business puts data about other people into Fortax — clients, employees, vendors. For that data you are the Data Fiduciary and Fortax is your Data Processor: we process it only on your instructions, for the work you are doing, and we do not use it for anything of our own. You are responsible for having a lawful basis to put it there. When you delete it, or when your account is closed and the retention period below has passed, it goes.
5. AI, and what it is allowed to see
- The assistant reads what your request needs — the file you point it at, the figures in your account — and sends that to the model provider that answers it, over an encrypted connection.
- We do not allow your content to be used to train anyone’s model. Our model providers process it to produce your answer and for the short retention their abuse-monitoring requires.
- Passwords, OTPs, portal logins and card numbers are never sent to a model. On the desktop app they never leave your machine.
- Arithmetic that matters — returns, reconciliations, computations — is done by our own engines, not by the model, so an answer can be checked against its source.
6. Who else sees it
Only the processors that make the product work, each under contract and only for that purpose: cloud hosting in India, our model providers, the payment gateway (for payments), the WhatsApp Business provider (for messages you approve), and email delivery. Government portals receive exactly what you submit to them. We do not sell personal data and we do not share it for anyone else’s advertising.
Some processors operate outside India. Where that happens, transfers are made under the DPDP Act and the Central Government’s restrictions in force at the time.
7. How long we keep it
| Data | Kept for |
|---|---|
| Account and content, while your account is open | Until you delete it, or the account is closed |
| After account closure | 90 days, then erased or anonymised, except what is named below |
| Invoices, payments and tax records | 8 years, as the Income-tax and GST laws require |
| Consent records and security logs | 3 years |
| Sealed Vault documents | As long as the owner keeps them; a seal record of the fact of sealing is retained for verification |
8. Your rights
- Access — a summary of the personal data we hold about you and who we shared it with.
- Correction and completion — fix what is wrong or incomplete; most of it you can edit yourself in your account.
- Erasure — delete your data, unless a law requires us to keep it.
- Withdraw consent — at any time, as easily as you gave it. The service that needed it stops from then on; what was lawfully done before stays done.
- Nominate — name someone to exercise these rights if you die or cannot act.
- Grievance redressal — write to our Grievance Officer below. If you are not satisfied, you may complain to the Data Protection Board of India.
Write to hola@fortax.in from your registered email, or use the contact form. We answer within 30 days, usually much sooner. A request that is not yours to make, or that would expose someone else’s data, is refused with a reason.
9. Children
Fortax is for businesses and professionals and is not meant for anyone under 18. We do not knowingly process a child’s personal data; if you believe we have, tell us and we will erase it.
10. Security
Encryption in transit, passwords stored only as salted hashes, access limited to the people who need it and logged, portal credentials in the operating system’s keychain, sealed documents with a verifiable signature, and backups. No system is perfect: if a breach affects your personal data, we will tell you and the Data Protection Board as the DPDP Act requires.
11. Cookies
We use cookies and local storage to keep you signed in, to remember your light or dark theme, and to count page views in aggregate. We do not run third-party advertising trackers on fortax.in.
12. Grievance Officer
The Grievance Officer, Fortax
IFTS IT Solutions Pvt. Ltd.
IIM Lucknow Campus, Prabandh Nagar, Lucknow, Uttar Pradesh, India
hola@fortax.in
13. Changes
If this notice changes in a way that matters, we raise its version, show it in your account, and ask again for consent where the law requires it. The version you agreed to is recorded with the date and time.