Privacy & data retention

What we collect

To prepare your income-tax return, we collect:

• the documents you upload, such as Form 130, broker statements, and Form 168 or AIS data;
• the income and tax figures extracted from those documents;
• your sign-in email address, basic profile information supplied by Google if you use Google sign-in, and the account and session identifiers needed to keep your returns linked to you; and
• if phone verification becomes available and you choose it, the phone number used for verification.

We also keep the choices and explanations you provide, consent timestamps, payment references if payments are enabled, and security and access records needed to protect the service. We do not collect your Income Tax portal password or bank-login credentials. If you choose to create a filing file, we also collect the filing-profile fields you enter, which may include PAN, contact and address details, date of birth, optional Aadhaar, and optional bank-account and IFSC details.

Why we use it

We use this information only to:

• read and organise the records you provide;
• calculate, explain, and generate your tax computation and filing files;
• identify missing or inconsistent information and support CA quality review;
• keep your returns linked to your account and respond to support requests;
• prevent fraud, protect accounts, investigate incidents, and maintain audit records; and
• meet accounting, tax, and other legal obligations that apply to Renuds.

We do not use uploaded tax records for advertising or sell them. If we want to use personal data for a materially different purpose, we will provide a new notice and seek permission where required.

Renuds does not use uploaded tax records to train its own models. Anthropic processes document content for the document-understanding purpose described in this notice.

How long we keep it

During the free open pilot, your session data, meaning uploaded documents, extracted figures, and the computed return, is retained for up to 90 days from the date your session was created.

After 90 days, pilot session data is scheduled for permanent deletion. We will not contact you before deletion. If you want your return data deleted sooner, use the delete control in the product or contact us as described below.

Account and sign-in records are retained while needed to provide and secure your account. Recovery contact data is removed after 30 days when it is no longer needed. Security and access records are normally retained for 180 days. Consent and transaction records may be retained longer where they are needed to establish what happened or meet a legal obligation. If phone verification becomes available, its specific retention period will be stated before it is used. Where payment is enabled for a feature, payment records may need to be retained for statutory accounting purposes.

How we protect it

Your data is encrypted while it travels to us. Uploaded documents and sensitive extracted fields are also encrypted by the application while stored. Access is logged and restricted by role to authorised operator, administrator, and Chartered Accountant accounts where their work requires it.

The sign-in service uses secure session cookies to keep you signed in. Staff access requires a separate, recent passkey verification before taxpayer records can be opened. These values are used for access control and security, not advertising.

Third parties

Anthropic is our document-understanding provider and processes uploaded document content for that purpose. Clerk is our identity and session provider. Vercel is our hosting and analytics provider and processes the technical, aggregate visitor and page-performance data needed to operate and monitor the service. Integrations also exist for MSG91 (phone OTP), Razorpay (payments), and Sentry (error monitoring); they process data only when their corresponding feature is used or enabled. Phone OTP is not currently available. Razorpay processes payment and transaction details when you pay; Renuds does not receive or store your card, UPI PIN, or bank-login credentials. Some providers may process data outside India. We assess each production provider and record its processing locations, subprocessors, retention and deletion controls. Any restriction notified by the Government of India will apply. We do not sell your data.

Your choices and privacy rights

You may ask us to:

• access the personal data we hold about you;
• correct or update it if it is inaccurate or incomplete; and
• erase it, subject to information we must retain for a legal claim or obligation;
• withdraw consent for future processing; or
• tell you how to make a complaint.

To exercise any of these rights, email privacy@renuds.in from the email address you use to sign in, or include your session ID, together with your request. We will respond within 30 days.

To delete the return, uploaded documents, and extracted return data associated with a session, use the delete option in your session view, or include your session ID in the email above. Limited security, consent, and transaction records may remain where needed for fraud prevention, a legal claim, or a statutory obligation.

Withdrawal does not undo processing already completed. If the information is necessary to prepare or maintain your return, withdrawing consent may mean we cannot continue the service. We will stop consent-based processing within a reasonable time and ask relevant processors to do the same, except where continued processing is authorised or required by law.

Privacy and grievance contact

Renuds is operated by Aditya Dev as an individual during the current open pilot. Send privacy questions or complaints to privacy@renuds.in.

Our current service target is to acknowledge a grievance within 48 hours and resolve it within 30 days of receipt.

Contact

privacy@renuds.in