This Privacy Policy explains how IFTS IT Solutions Pvt. Ltd. ("Company", "we", "us", "our"), the owner and operator of Fortax, collects, uses, stores, shares, protects and deletes information when you use our website, dashboards, mobile applications, APIs, WhatsApp channels, AI assistants and hardware accessories (collectively, the "Services"). It should be read together with our Terms of Service. By using the Services you agree to the practices described here.
We handle financial, tax and identity data, so we treat privacy as a core engineering requirement rather than a legal formality. If anything below is unclear, write to us at hola@fortax.in.
1. Who we are and how to reach us
Fortax is a product of IFTS IT Solutions Pvt. Ltd., headquartered at IIM Lucknow Campus, Prabandh Nagar, Lucknow, Uttar Pradesh, India. For all privacy queries, data access requests and complaints, contact hola@fortax.in. Grievance Officer details are in section 15.
2. Our roles: fiduciary and processor
We act as a data fiduciary for information about you as our customer, such as your account, billing and support records. We act as a data processor for information you upload about your own customers, vendors, employees and contacts. For that second category you remain the fiduciary: you decide why and how it is processed, you are responsible for having a lawful basis and valid consent, and we process it only on your instructions and to operate the Services.
3. Information we collect
a. Account and identity information. Name, business or firm name, email address, mobile number, password hash, role, designation, profile photo, workspace and team membership, and the identifiers you use to log in.
b. Business and statutory information. GSTIN, PAN, TAN, CIN or LLPIN, DIN, business address, place of supply, constitution of business, bank account details used for invoicing and refunds, registration certificates and other statutory documents you upload.
c. Transactional and compliance data. Invoices, credit and debit notes, purchase records, inventory items, expenses, ledgers, e-way bills, e-invoice IRNs, return workpapers, challans, filing acknowledgements, reconciliation results, deadlines and compliance scores.
d. Contact and messaging data. Contact lists, phone numbers, opt-in records, message templates, campaign metadata and delivery or read status where you use WhatsApp or other messaging features.
e. AI interaction data. The prompts you send to Fortax SAI, files or context you attach, the responses generated, and feedback signals such as ratings or corrections.
f. Payment data. Plan, invoice history, transaction identifiers and payment status. Card numbers, UPI credentials, CVV and net-banking passwords are captured and stored by our PCI DSS compliant payment gateways, not by us. We receive only masked identifiers and tokens.
g. Technical and usage data. IP address, device and browser type, operating system, timezone, referring pages, feature usage, session logs, API call logs, error traces and crash reports.
h. Communications. Support tickets, emails, chat transcripts, and call notes where you contact us. Demo or onboarding calls may be recorded with prior notice.
We do not intentionally collect special category personal data, and you should not upload it to the Platform. We do not knowingly collect data from children under 18.
4. How we collect it
Directly from you when you register, configure your workspace, upload documents or contact support. Automatically through cookies, SDKs and server logs when you use the Services. From Government Portals and integration partners when you authorise a connection, for example return status, GSTIN validity or filing history. From your team members, your CA, or an authorised administrator who invites you or acts on your behalf. From payment gateways and platform partners in the form of transaction and delivery status.
5. Why we use it, and on what basis
We use personal data to create and secure your account; deliver the Services you request, including invoicing, inventory, reminders, reconciliation, filing preparation and submission; connect with Government Portals on your authorisation; run AI assistance; send transactional and service messages; process payments and issue GST-compliant invoices; provide support; detect, investigate and prevent fraud, abuse and security incidents; maintain audit trails; comply with tax, accounting, anti-money-laundering and other legal obligations; and improve the reliability, safety and accuracy of the Services.
Our lawful bases are your consent, the performance of our contract with you, compliance with legal obligations, and our legitimate interests in operating a secure and functional platform. Where consent is the basis, you may withdraw it at any time, and we will explain the consequences for the features that depend on it.
6. Marketing communications
We may send product updates, compliance deadline alerts and occasional promotional messages by email, WhatsApp or SMS. You can opt out at any time using the unsubscribe link, by replying STOP on messaging channels, or from your notification settings. You cannot opt out of essential transactional and security messages while your account is active, since they are necessary to operate the Services.
7. AI features and your data
Prompts and the context you supply are sent to our AI layer and, where relevant, to third-party model providers, solely to generate a response for you. We retain prompts and outputs for a limited period for abuse prevention, debugging, safety review and quality improvement. We do not sell this data and we do not use your identifiable business data to train third-party foundation models. We may use aggregated, de-identified interaction patterns to improve our own prompts, routing and compliance logic. Do not enter passwords, OTPs, full card numbers, or personal data you are not permitted to share into AI chat. AI output can be inaccurate and must be verified before use, as set out in our Terms.
8. When we share information
We do not sell your personal data, and we do not rent or trade contact lists. We share only as follows.
Government Portals and authorities, where you authorise a filing or verification, or where disclosure is required by law, court order or a valid regulatory request.
Service providers and sub-processors who act on our instructions under written confidentiality and data protection obligations, including cloud hosting and storage, database and backup providers, email, SMS and WhatsApp Business Solution Providers, payment gateways, AI model providers, error monitoring, analytics and helpdesk tools.
Professionals you engage, such as a chartered accountant you invite into your workspace or hire through the marketplace, limited to the data you grant them access to. Their handling of your data is governed by their own terms.
Your own organisation, meaning the workspace owner and administrators, who can see activity within the workspace.
Corporate transactions, where we merge, restructure or sell assets, subject to the acquirer honouring this Policy, with notice to you.
Legal protection, where sharing is necessary to enforce our Terms, protect our rights, investigate fraud, or protect the safety of any person.
9. Cookies and similar technologies
We use strictly necessary cookies for authentication, session management and security, and functional cookies to remember preferences such as theme and language. We use analytics cookies to understand feature usage and improve the product. Where required, we ask for consent before setting non-essential cookies, and you can change your choice at any time from the cookie settings. Most browsers also let you block or delete cookies, though blocking essential cookies will break login and other core functions.
10. Data storage, transfers and retention
Data is hosted on infrastructure located primarily in India. Some sub-processors, including AI model providers and communication tools, may process data outside India. Where that happens we rely on contractual safeguards with those providers and transfer only what is necessary.
We retain data for as long as your account is active and for as long as needed to provide the Services. After account closure, we retain transactional and financial records for the periods required under Indian tax, company and accounting law, and retain a limited set of records where needed to resolve disputes, prevent fraud or enforce agreements. Backups are retained on a rolling cycle and expire automatically. When a retention period ends, we delete or irreversibly anonymise the data.
11. Security
Fortax is protected by Fortax Shield, our layered security gateway. Controls include encryption in transit using TLS, encryption at rest for stored documents and sensitive fields, hashed and salted passwords, role-based access control and least-privilege internal access, HMAC-signed webhooks, API key scoping and rate limiting, audited and encrypted backups, activity and audit logging, vulnerability patching, and monitoring for anomalous access.
No system is completely secure. You are responsible for keeping your credentials confidential, enabling available security features, and controlling who you invite into your workspace. If we become aware of a personal data breach that is likely to affect you, we will notify you and the relevant authority without undue delay, describing what happened, the likely consequences and the steps we are taking.
12. Your rights
Subject to applicable law and to our legal retention obligations, you may request to access a summary of the personal data we hold about you and how it is processed; correct inaccurate or incomplete data; update your account details from your profile settings; erase personal data that is no longer needed for the purpose it was collected; withdraw consent for processing that relies on consent; export your data in a commonly used machine-readable format; nominate another individual to exercise your rights in the event of death or incapacity; and complain to us or to the competent authority.
To exercise a right, email hola@fortax.in from your registered address. We may ask for information to verify your identity before acting. We aim to respond within 30 days. Where you are asking about data uploaded by a business that uses Fortax, we will direct your request to that business as the fiduciary and assist them in responding.
13. Third-party links and integrations
The Services may link to or integrate with third-party sites and platforms, including Government Portals, Meta and WhatsApp, payment gateways and AI providers. Those parties operate under their own privacy policies, which we encourage you to read. We are not responsible for their practices.
14. Changes to this Policy
We may update this Policy to reflect changes in the Services, our sub-processors or the law. The revised version will be posted here with an updated date, and material changes will be notified by email or in-app notice before they take effect. Continued use after the effective date means you accept the updated Policy.
15. Grievance redressal
In accordance with the Information Technology Act, 2000 and the rules made under it, and with applicable data protection law, complaints about the handling of your data may be sent to our Grievance Officer at hola@fortax.in with the subject line "Privacy Grievance". Please include your registered email, a description of the issue and any supporting documents. We will acknowledge within 48 hours and endeavour to resolve within 30 days.
16. Contact
IFTS IT Solutions Pvt. Ltd.
IIM Lucknow Campus, Prabandh Nagar, Lucknow, Uttar Pradesh, India
Email: hola@fortax.in
Web: https://fortax.in
This page describes our data practices in general terms and is not legal advice. We recommend a review by your legal counsel before final publication.