Privacy Policy

1. Who we are

This Privacy Policy explains how Tax365 (Pvt) Ltd (“Tax365”, “we”, “us”, or “our”) collects, uses, stores, and shares information when you use our web platform and related services.

Tax365 is an independent, technology-enabled Tax Compliance as a Service (TCaaS) firm. We help individuals and businesses in Pakistan manage tax profiles, documents, filings, deadlines, billing, and staff-assisted compliance workflows. We do not replace FBR IRIS, provincial tax portals, or other government systems of record.

Phase 1 jurisdiction: Pakistan (PK). Multi-country expansion (for example UAE, UK, US, KSA, Qatar) is not part of the current platform.

2. Scope and key terms

• Personal data — information that identifies or can reasonably identify you (for example name, email, phone number, CNIC).
• Tax profile — a legal or tax entity you manage on Tax365 (for example salaried individual, business, company), including identifiers such as NTN (National Tax Number) and STRN (Sales Tax Registration Number) when provided.
• Document vault — the secure store of files you or staff upload for a profile or filing (returns, wealth statements, CPR challans, certificates, and similar artefacts).
• Filing — a tracked registration or return case with status and due date. Returns are prepared as a Draft for human review; Tax365 does not file without your review and approval where the workflow requires it.
• Client — an end-user with a Tax365 account. Staff includes roles such as Accountant, Tax Officer, Reviewer, and Admin who access client work under role-based access control (RBAC).
• Service providers (processors) — third parties that process data on our instructions to run the platform (hosting, storage, email, messaging, document intelligence).

3. Information we collect

Depending on how you use Tax365, we may collect:

3.1 Account and identity

• Full name, email address, and phone number
• Optional CNIC (Computerised National Identity Card) number
• Password (stored only as a secure hash; never in plain text) or OTP-based sign-in challenges
• Role (Client or staff role) and account status

3.2 Tax profiles and compliance data

• Entity name, entity type, province, industry, and jurisdiction (Pakistan)
• NTN, STRN, and other identifiers you or staff record (for example SECP CUIN if known)
• Stored ATL (Active Taxpayer List) status when entered or maintained in the platform
• Filing and registration case data (type, tax year or period, statutory due dates, status, notes, assignment, client approval timestamps)
• Compliance calendar deadlines and reminder history
• Compliance score (0–100) and related auditable score inputs or overrides where used
• Service preferences you select during onboarding

3.3 Documents and AI-assisted extraction

• Files uploaded to the document vault (PDFs, images, spreadsheets, and similar), including category metadata and links to profiles or filings
• Structured suggestions produced by our multi-format reader (OCR / document intelligence), subject to human review before they become system-of-record data
• Duplicate and missing-document signals used to help complete a filing checklist

3.4 Billing and communications

• Invoice and receipt records, amounts, tax on services where applied, payment status, and payment method notes
• Notification content and delivery logs for email, SMS, and WhatsApp channels (for example OTP codes, deadline reminders, invoice notices)

3.5 Technical and security data

• Session cookies and authentication tokens needed to keep you signed in securely
• Audit logs of security-relevant and operational events (for example document access, filing submissions, administrative actions), which may include user ID, timestamp, and IP address
• Limited application logs for reliability and abuse prevention (not full document contents)

We do not require biometric login data on the current web platform. We do not sell personal data.

4. How we use information

We use personal and tax-related information to:

• Create and secure accounts, verify OTP challenges, and manage sessions
• Operate tax profiles, registrations, filings, the document vault, and the compliance calendar
• Assist staff in preparing Draft filings and registrations for your review and electronic approval
• Run document intelligence (classification, extraction suggestions, duplicate/missing checks) under human review
• Calculate and display compliance scores and related alerts or penalty warnings
• Generate invoices and track payment status for Tax365 services
• Send transactional notices (OTP, deadlines, filing status, billing) via email, SMS, and/or WhatsApp
• Enforce RBAC, investigate misuse, maintain audit trails, and improve platform reliability
• Meet legal, regulatory, and professional obligations applicable to a TCaaS firm in Pakistan

5. Legal bases and your choices

We process information where it is necessary to:

• Perform our contract with you (provide the Tax365 platform and TCaaS workflows you requested)
• Obtain and act on consent where required (for example optional CNIC, optional notification channels, and client approval of a filing before submission continues)
• Pursue legitimate interests such as security, fraud prevention, auditability, and service improvement, balanced against your rights
• Comply with law or respond to lawful requests from competent authorities

You may decline optional fields (such as CNIC at registration) and, where offered, adjust notification channel preferences. Some processing is required to operate your account; if you withdraw essential consent or close your account, we may be unable to continue providing the service.

6. Who can access your information

• You — through the client portal for your own profiles, documents, filings, invoices, and notifications
• Authorised Tax365 staff — Accountants, Tax Officers, Reviewers, and Admins, limited by RBAC to what they need for assigned work, quality review, billing, or administration
• Service providers — listed in Section 7, under contractual and technical controls
• Authorities — when we are legally required to disclose information, or when you instruct us to submit materials to tax or corporate regulators as part of a filing engagement

Staff access and sensitive operational actions are subject to audit logging. Tax365 staff do not use client vault contents for advertising.

7. Service providers and subprocessors

We use trusted processors to operate Tax365. Categories currently used by the web platform include:

• Hosting and database — application hosting and PostgreSQL data storage for accounts, profiles, filings, billing, and logs
• Document vault storage (Cloudinary) — encrypted object storage for uploaded documents and generated invoice/receipt PDFs
• Document intelligence (Google Cloud) — Google Document AI and Cloud Vision process document bytes and minimal metadata to produce extraction suggestions. We do not send passwords, OTP codes, or session tokens to these services. Customer document training on your data is disabled where the provider configuration allows
• Email (Brevo) — transactional email delivery
• WhatsApp (Meta Cloud API) — OTP and utility notifications when that channel is enabled
• SMS providers — when SMS delivery is configured for OTP or notices

Payment gateway processors (for example JazzCash, Easypaisa, or card networks) may be introduced later. Today, invoice payment status is typically recorded through Tax365 billing workflows; if a gateway is connected, that provider’s privacy terms will also apply to payment data they process.

8. International transfers

Tax365’s product jurisdiction is Pakistan. Some processors (for example cloud hosting, Cloudinary, Google Cloud, Brevo, or Meta) may store or process data in other countries. Where that occurs, we rely on appropriate contractual and security measures offered by those providers. You acknowledge that cross-border processing may be necessary to deliver the service.

9. Retention

• Account, tax profile, filing, and billing records — retained for as long as your account is active and thereafter as needed for professional, tax, audit, or legal retention obligations
• Document vault files — retained while linked to an active profile or filing; soft-deleted files follow our object-storage lifecycle until purged
• AI ingest jobs and parse results — retained for the life of the linked document, and typically up to 24 months after document soft-deletion for support and audit; short text excerpts are capped; full OCR payloads are not kept in application logs
• OTP challenges — short-lived, stored hashed, and expire automatically
• Application logs — typically about 30 days for operations, excluding document bytes and full OCR text
• Audit events — retained longer to support security investigations and accountability

10. Security

We apply layered controls appropriate to a TCaaS platform handling tax documents, including:

• TLS encryption for data in transit
• Encryption at rest via our hosting and document-storage providers
• HttpOnly session cookies and hashed credentials / OTP secrets
• Role-based access control separating Client and Staff permissions
• App-mediated document downloads with authorisation checks and auditability
• Minimised AI ingest payloads (document bytes + limited metadata only)

No method of transmission or storage is perfectly secure. Please use a strong unique password, protect OTP codes, and notify us promptly if you suspect unauthorised access.

11. Cookies and similar technologies

Tax365 uses essential cookies and similar technologies for authentication and session management. These are required for the platform to function. We do not use advertising cookies on the client or ops portals. If we later add optional analytics, we will update this policy and, where required, provide a choice.

12. Your rights and requests

Subject to applicable Pakistani law and our professional retention duties, you may request to:

• Access personal data we hold about you
• Correct inaccurate account or profile information
• Download or obtain copies of documents you uploaded, where available in the vault
• Ask us to delete or restrict certain personal data, where legally permissible
• Object to optional processing or withdraw optional consent

Some records (for example filed returns, invoices, and audit logs) may need to be retained even after an account closure request. We will explain any limitation when you contact us.

13. Children

Tax365 is directed at adults and businesses managing tax compliance. We do not knowingly create accounts for children. If you believe a minor’s data was provided, contact us and we will take appropriate steps.

14. Changes to this policy

We may update this Privacy Policy as the platform evolves (for example new notification channels, storage regions, or payment processors). The “Last updated” date at the top will change when we do. Material changes may also be communicated in-product or by email.

15. Contact

Privacy requests for Tax365 (Pvt) Ltd can be sent to privacy@tax365.pk, or raised through your assigned Tax365 officer via the platform. Please include the email address on your account so we can verify your request.

Governing focus: Pakistan. This policy describes current web-platform practices and is not legal advice.