Privacy Policy

Last updated: 25 August 2026 · Applies to the 24eTax app, the web application and the 24etax.com website.

The short version: your business books belong to you. We collect only what the app needs to work and what the law makes us keep, we never sell your data, and you can see, export or erase your personal data whenever you want.

1. Who we are

24eTax ("we", "us"), Smart World Orchard, Sector 61, Gurugram, Haryana 122002, is the data fiduciary for the personal data described here under India's Digital Personal Data Protection Act, 2023 (DPDP Act).

2. What we collect and why

Account data — your mobile number and/or email, name, and sign-in security details. Why: to create and protect your account.
Business & GST data — your GSTIN(s), business details, invoices, purchases, inventory, parties, bank statements you upload, and accounting entries you create; data fetched from GSTN on your instruction (for example your GSTR-2B). Why: this is the service itself — billing, accounting, reconciliation and return preparation.
Filing credentials — when you connect your GSTIN, the session established with GSTN via our licensed GST Suvidha Provider. OTPs you enter are used once and never stored. Why: to fetch your data and file returns you approve.
Website download form — name, mobile number, and optionally email and GSTIN, stored with the time of your consent. Why: to give you the download link and contact you about the product. This is optional — the app can also be obtained without the form.
Website analytics & advertising measurement — this website uses Google Tag Manager, Google Analytics and the Meta (Facebook) Pixel to understand which pages are useful and to measure advertising. Only page-view level data is sent; we never send your GSTIN, PAN, contact details, customer information or any tax/financial data to these services, and we do not use analytics to identify you personally.
Technical data — device model, app version, IP address and diagnostic logs (with personal data scrubbed). Why: security (fraud and abuse prevention) and fixing crashes.
Payment data — when you subscribe, payments are processed by our payment partners; we receive the payment status, never your card details.

3. What we do NOT do

We do not sell or rent your personal data. Ever.
We do not read your books for advertising or profiling.
We do not store the OTPs used for sign-in or GST filing.
Bills you scan with the camera are read on your phone — the photo is not uploaded to us.

4. Consent

We ask for your consent at the moment of collection — when you sign up, when you connect a GSTIN, and on the website download form — stating the purpose plainly. You may withdraw consent at any time in the app (Settings → Privacy) or by writing to us; withdrawal doesn't affect processing already done lawfully, and some processing (like keeping tax invoices) continues under legal obligation rather than consent.

5. Who your data is shared with

GSTN / government systems — invoices and returns you choose to report or file travel to GSTN and related government systems through our licensed GST Suvidha Provider, who processes it under contract with us.
Service providers — cloud hosting and database (data stored in India region), SMS delivery for OTPs, payment processing, website analytics and crash reporting — each bound to use the data only to provide their service to us.
Nobody else, unless the law requires it (for example a lawful order from a court or authority).

6. How long we keep it

Financial records (invoices, journals, filed returns): 8 years, as required by GST law (Section 36, CGST Act) — even after account deletion, these are retained with your personal identifiers removed where the law permits.
Account data: for as long as your account exists, then deleted or anonymised.
Download-form details: until you ask us to remove them, or 3 years of inactivity, whichever is earlier.
Server logs (including IP addresses): up to 90 days, for security.

7. Your rights

Under the DPDP Act you can, at any time:

Access — see what personal data we hold about you (Settings → Privacy → Export my data gives you a complete copy).
Correction — fix inaccurate personal data in the app directly, or ask us.
Erasure — delete your account (Settings → Privacy → Delete account). Personal data is erased or anonymised; financial records are kept for the statutory 8 years with a documented legal basis.
Grievance — complain to us (below) and, if unsatisfied, to the Data Protection Board of India.
Nomination — nominate someone to exercise these rights if you are unable to.

8. Security

Your data is encrypted on your device (keys held in your phone's secure hardware) and in transit (TLS with certificate pinning). Our servers enforce per-business isolation at the database level, role-based access, brute-force lockouts, and an append-only audit log on every financial change. We test our defences and have a breach-response process; if a breach affects you, we will notify you and the Data Protection Board as the law requires. More in plain language on the security page.

9. Children

24eTax is a business tool and not directed at children under 18.

10. Changes

If this policy changes materially, we'll tell you in the app and update the date above. The current version always lives at 24etax.com/privacy.

11. Grievance officer

Grievance Officer, 24eTax
Email: support@24etax.com
Phone: +91 97117 78126
Address: Smart World Orchard, Sector 61, Gurugram, Haryana 122002
We aim to acknowledge complaints within 72 hours and resolve them within 30 days.