Privacy Policy

Last updated: 30 September 2026

Part 1 — Tax Monitor Chrome Extension

This part applies to the Tax Monitor Chrome extension (the “Extension”), which displays GST notices, returns, fees, alerts, and taxpayer tasks for the Taxman dashboard on taxhindi.com.

What the Extension accesses

• Gmail (read-only): With your consent via Google sign-in, the Extension may read messages from selected GST / government senders to surface notices and alerts. It does not send, delete, or modify your email.
• GST portal pages: On gst.gov.in, the Extension may read taxpayer context and document/notice data you open, to display and sync tax compliance information.
• Taxman / taxhindi.com: Account login (if you use it), taxpayer and return data you choose to sync, subscription status, and product diagnostics.
• Local storage: Settings, cached data, and (if you save them) GST portal credentials you enter for convenience — stored in the browser profile on your own device.

Gmail API usage and disclosure

• Scopes requested: https://www.googleapis.com/auth/gmail.readonly — read-only access, approved by you during Google sign-in.
• Purpose: to detect GST notices, orders, and government correspondence arriving by email, using filters limited to GST / government senders and GST-related keywords, and to surface them as alerts inside the Extension.
• How Gmail data is used: only to classify and display the messages described above. Gmail content is not used for advertising, is not sold, and is not shared with third parties other than the taxhindi.com servers described below.
• Data sent to taxhindi.com: only extracted references (e.g., notice identifiers, dates, GSTINs) and alert metadata you choose to sync for your account — not your full mailbox.
• Token storage: the Google OAuth token (your Gmail access) is saved on your local machine, inside the extension’s browser storage on your own device — it is not uploaded to our servers.
• How to revoke access: remove the Extension from Chrome, or revoke it at myaccount.google.com/permissions. Revocation stops all further Gmail access.

How data is used

• To show notices, returns, fees, alerts, and related tax compliance tools.
• To sync data you explicitly push to taxhindi.com for your account / subscription.
• To authenticate you and enforce subscription limits.

What is not done

• We do not sell your personal data.
• We do not use Gmail content for advertising.
• We do not read email outside the filters configured for GST notice detection.
• We do not collect contacts, calendar, or any other Google data beyond the Gmail scope listed above.

Third parties

• Google Gmail API — only with the OAuth scope gmail.readonly you approve.
• taxhindi.com servers — receive data you sync or that is required for account/subscription features.
• GST portal (gst.gov.in) — data originates from your own login session.

Retention, tokens & security

Data is kept while your account / subscription is active and as needed for the product. Access uses HTTPS. You can disconnect Gmail access from your Google Account and clear Extension storage from Chrome settings.

For the security of your user data, access tokens (including the Google OAuth / Gmail token) are saved only on your local machine, inside the extension’s browser storage on your own device, and are never uploaded to our servers. Secrets (API keys, credentials and signing keys) are kept server-side on secured taxhindi.com servers, so no shared secret is ever stored next to your tokens on your device.

Data protection mechanisms for sensitive data

Sensitive data handled by the Extension includes Gmail message content processed for notice detection, any GST portal credentials you choose to save, your Google OAuth token, and your taxhindi.com account data. We protect it with the following mechanisms:

• Encryption in transit: every connection — Extension to Google (Gmail API), Extension to taxhindi.com, and browser sessions to gst.gov.in — uses TLS/HTTPS encryption. No Gmail data or credentials are transmitted in plaintext.
• Encryption and isolation at rest (local): Gmail-derived data, settings, and saved credentials live only in the Extension’s browser storage, isolated inside your own browser profile under your operating system account. They are never written to shared or public locations on your device.
• Encryption and access control at rest (server): taxhindi.com server data is stored in access-controlled databases reachable only by authenticated application services and authorized personnel. Administrative interfaces require authenticated sessions, and database access uses parameterized (prepared) queries to prevent injection.
• Structural least privilege: the Extension requests only the gmail.readonly scope, which is technically incapable of sending, deleting, or modifying mail — the sensitive data cannot be altered even by a defect in the Extension.
• On-device processing and data minimization: Gmail messages are fetched and classified on your machine. Raw email content and full message bodies are not stored on our servers — only the extracted references (notice numbers, dates, GSTINs) and alert metadata you explicitly sync leave the device.
• Token/secret separation: OAuth and session tokens are stored only on your local machine; server-side secrets are kept only on secured servers (as described above), so compromising one side does not expose both.
• Revocation: disconnecting Gmail immediately revokes the token at Google’s revocation endpoint (https://oauth2.googleapis.com/revoke), after which the stored token is unusable.
• Breach response: should a data breach occur affecting your personal information, we will notify affected users via in-site notification within 1 business day (see Fair Information Practices in Part 2).

Google user data: retention and deletion

We retain Google user data only as long as needed for the purposes described in this policy:

• Gmail message content: processed on your device for classification and not retained on our servers at all. Any message content cached locally in the Extension is refreshed/overwritten as new mail arrives and is removed when you clear Extension storage or remove the Extension.
• Gmail-derived data (extracted notice references, alert metadata): retained on taxhindi.com servers while your account/subscription is active, and deleted within 30 days of the deletion events below.
• Google OAuth token: retained locally only while you keep Gmail connected. On disconnect (in the Extension or at myaccount.google.com/permissions) the token is revoked and its local copy is deleted; it is also deleted when you remove the Extension or clear Extension storage.
• Account data you sync (taxpayer records, returns, subscription): retained while your taxhindi.com account is active; deleted within 30 days after account closure or a verified deletion request.

How to delete your Google user data:

• Self-service (immediate): disconnect Gmail from the Extension’s email screen (or from Google Account permissions), and remove the Extension from Chrome — this deletes the OAuth token and all locally stored Gmail-derived data.
• Server-side deletion: email info@taxhindi.com from your registered account address with the subject “Delete my data”. We will delete your synced Google user data and account records within 30 days and confirm by email when complete.
• Google-managed data: data that Google itself retains (e.g., your original emails in Gmail) is controlled from your Google Account and is not stored by us.

Part 2 — taxhindi.com website

This privacy policy has been compiled to better serve those who are concerned with how their ‘Personally identifiable information’ (PII) is being used online. PII, as used in US privacy law and information security, is information that can be used on its own or with other information to identify, contact, or locate a single person, or to identify an individual in context. Please read our privacy policy carefully to get a clear understanding of how we collect, use, protect or otherwise handle your Personally Identifiable Information in accordance with our website.

Information Collection

What personal information do we collect from the people that visit our blog, website or app?

When ordering or registering on our site, as appropriate, you may be asked to enter your name, email address, mailing address, phone number or other details to help you with your experience.

When do we collect information?

We collect information from you when you register on our site, fill out a form or enter information on our site.

Information Usage

We may use the information we collect from you when you register, make a purchase, sign up for our newsletter, respond to a survey or marketing communication, surf the website, or use certain other site features in the following ways:

• To personalize user’s experience and to allow us to deliver the type of content and product offerings in which you are most interested.
• To administer a contest, promotion, survey or other site feature.
• To send periodic emails regarding your order or other products and services.

Information Protection

Our website is scanned on a regular basis for security holes and known vulnerabilities in order to make your visit to our site as safe as possible. We use regular Malware Scanning.

All traffic to taxhindi.com, including the Tax Monitor dashboard and login, is served over HTTPS (TLS encryption in transit). We do not store credit card or net banking information and do not process cash transactions on the site.

Cookie Usage

We do not use cookies for tracking purposes. You can choose to have your computer warn you each time a cookie is being sent, or you can choose to turn off all cookies. You do this through your browser settings. Each browser is a little different, so look at your browser’s Help menu to learn the correct way to modify your cookies.

If you disable cookies, some features will be disabled that make your site experience more efficient and some of our services will not function properly. However, you can still place orders.

Third Party Disclosure & Third Party Links

Third Party Disclosure: We do not sell, trade, or otherwise transfer to outside parties your personally identifiable information.

Third party links: Occasionally, at our discretion, we may include or offer third party products or services on our website. These third party sites have separate and independent privacy policies. We therefore have no responsibility or liability for the content and activities of these linked sites. Nonetheless, we seek to protect the integrity of our site and welcome any feedback about these sites.

Google AdSense

Google’s advertising requirements can be summed up by Google’s Advertising Principles. They are put in place to provide a positive experience for users: https://support.google.com/adwordspolicy/answer/1316548?hl=en

We use Google AdSense Advertising on our website. Google, as a third party vendor, uses cookies to serve ads on our site. Google’s use of the DART cookie enables it to serve ads to our users based on their visit to our site and other sites on the Internet. Users may opt out of the use of the DART cookie by visiting the Google ad and content network privacy policy.

We have implemented the following:

• Remarketing with Google AdSense
• Google Display Network Impression Reporting
• Demographics and Interests Reporting
• DoubleClick Platform Integration

We along with third-party vendors, such as Google use first-party cookies (such as the Google Analytics cookies) and third-party cookies (such as the DoubleClick cookie) or other third-party identifiers together to compile data regarding user interactions with ad impressions, and other ad service functions as they relate to our website.

Opting out: Users can set preferences for how Google advertises to you using the Google Ad Settings page. Alternatively, you can opt out by visiting the Network Advertising initiative opt out page or permanently using the Google Analytics Opt Out Browser add on.

Fair Information Practices, COPPA and CalOPPA

Fair Information Practices — The Fair Information Practices Principles form the backbone of privacy law in the United States and the concepts they include have played a significant role in the development of data protection laws around the globe. Understanding the Fair Information Practice Principles and how they should be implemented is critical to comply with the various privacy laws that protect personal information.

In order to be in line with Fair Information Practices we will take the following responsive action, should a data breach occur: We will notify the users via in site notification within 1 business day.

We also agree to the individual redress principle, which requires that individuals have a right to pursue legally enforceable rights against data collectors and processors who fail to adhere to the law. This principle requires not only that individuals have enforceable rights against data users, but also that individuals have recourse to courts or a government agency to investigate and/or prosecute non-compliance by data processors.

COPPA (Children’s Online Privacy Protection Act) — When it comes to the collection of personal information from children under 13, the Children’s Online Privacy Protection Act (COPPA) puts parents in control. The Federal Trade Commission, the nation’s consumer protection agency, enforces the COPPA Rule, which spells out what operators of websites and online services must do to protect children’s privacy and safety online. We do not specifically market to children under 13.

California Online Privacy Protection Act (CalOPPA) — CalOPPA is the first state law in the nation to require commercial websites and online services to post a privacy policy. The law’s reach stretches well beyond California to require a person or company in the United States (and conceivably the world) that operates websites collecting personally identifiable information from California consumers to post a conspicuous privacy policy on its website stating exactly the information being collected and those individuals with whom it is being shared, and to comply with this policy.

According to CalOPPA we agree to the following:

• Users can visit our site anonymously.
• Our Privacy Policy link includes the word ‘Privacy’, and can be easily found on our home page or the first significant page after entering our website.
• Users will be notified of any privacy policy changes: on our Privacy Policy page.
• Users are able to change their personal information: by logging in to their account.

How does our site handle do not track signals? We don’t honor do not track signals and do not track, plant cookies, or use advertising when a Do Not Track (DNT) browser mechanism is in place, because we do not have a mechanism for it now.

Does our site allow third party behavioral tracking? It’s also important to note that we allow third party behavioral tracking (as described in the Google AdSense section above).

CAN-SPAM Act

The CAN-SPAM Act is a law that sets the rules for commercial email, establishes requirements for commercial messages, gives recipients the right to have emails stopped from being sent to them, and spells out tough penalties for violations. We collect your email address in order to send order/product information and, in accordance with CAN-SPAM, we agree to the following: if at any time you would like to unsubscribe from receiving future emails, you can email us at info@taxhindi.com and we will promptly remove you from ALL correspondence.

Our Contact Information

Last updated: 30 September 2026. This page combines the website privacy policy (taxhindi.com/policy.php) and the extension privacy policy (taxhindi.com/taxman/privacy.html).