Privacy Policy

H&A LLP ("we", "us", "our") is a tax-consultancy firm registered in Bhiwandi, Thane, Maharashtra, India. Our website is hallp.in and our registered email is [email protected].

This Privacy Policy explains how we collect, use, store, and protect personal information when you visit our website, use the client portal, or engage our services.

Information you provide directly:

• Name, email address, mobile number, and PAN card number when you register for the client portal.
• Income documents, ITR acknowledgements, ITR forms, and other tax-related files you upload through the portal.
• Messages and enquiries submitted via the contact form or chat widget.
• Payment details (name, amount, service selected) when you pay online. Card and UPI credentials are processed directly by Razorpay and are never stored on our servers.

Information collected automatically:

• IP address, browser type, device type, and pages visited — collected via server logs for security and analytics purposes.
• Push-notification subscription tokens if you opt in to browser or app notifications.
• Session tokens stored in your browser's local storage to keep you logged in to the client portal.

• To create and manage your client portal account.
• To store and retrieve your tax documents securely.
• To send one-time passwords (OTP) for account registration and password reset via email (Brevo transactional email service).
• To process online payments and send PDF invoices via email.
• To send tax-update notifications if you have opted in.
• To respond to your enquiries and provide tax-consultancy services.
• To detect and prevent fraud, abuse, and unauthorised access.
• To comply with applicable Indian tax laws and regulatory requirements.

We do not use advertising or third-party tracking cookies. We use browser local storage solely to maintain your authenticated session in the client portal. This data is cleared when you log out.

Our AI chatbot (powered by OpenAI) processes only the text you type in the chat window. No chat history is stored on our servers beyond the current session.

We use the following third-party services, each governed by their own privacy policies:

• Razorpay — payment processing (India). Razorpay's privacy policy applies to payment data.
• Brevo (Sendinblue) — transactional email delivery for OTPs and invoices.
• Firebase (Google) — push-notification delivery (FCM) and web analytics.
• OpenAI — AI chatbot responses. Messages are sent to OpenAI's API; OpenAI's data-use policy applies.
• GoDaddy Airo — website hosting and infrastructure.

We do not sell, rent, or share your personal information with any other third party for marketing purposes.

Your uploaded documents are stored on secure servers provided by our hosting provider. Access is restricted to authenticated sessions only. Passwords are stored as bcrypt hashes and are never stored in plain text. OTPs are hashed, expire after 5 minutes, and are invalidated after use.

While we take reasonable technical and organisational measures to protect your data, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security.

We retain your account information and uploaded documents for as long as your account is active or as required to provide our services. If you request account deletion, we will delete your personal data within 30 days, except where retention is required by Indian law (e.g., financial records under the Income Tax Act, 1961).

You may request account deletion at any time via the Delete Account page or by emailing us.

You have the right to:

• Access the personal information we hold about you.
• Request correction of inaccurate information.
• Request deletion of your account and associated data.
• Withdraw consent to push notifications at any time through your browser or device settings.

To exercise any of these rights, email us at [email protected].

Our services are not directed at children under 18. We do not knowingly collect personal information from minors. If you believe a minor has provided us with personal data, please contact us and we will delete it promptly.

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page will reflect any changes. Continued use of the website after an update constitutes acceptance of the revised policy.

For any privacy-related questions or requests, please contact: