Privacy Policy

Who we are

TaxElita is practice management software for tax consultants and accounting firms in Pakistan. For the firms that sign up and their staff, TaxElita decides how account information is used. For the clients a firm keeps in TaxElita, the firm decides; TaxElita processes that information only on the firm's instructions (see the Data Processing Agreement).

What we collect

• Accounts: names, email addresses, phone numbers and passwords (stored only as a one-way hash) of firm staff, and of clients who use a firm's portal.
• What firms keep in TaxElita: their clients' details (CNIC and other identity numbers are encrypted), documents, forms, cases, invoices and messages. This belongs to the firm.
• Security records: sign-ins, signed-in devices, IP addresses and an activity log of changes, kept to protect accounts and to show who did what. To spot failing steps, bots and attacks we also record which steps and pages each signed-in person used, with the IP address, browser, operating system and device type, for 30 days; never what was typed or shown.
• Running the service: error reports and request timings, with emails, phone numbers, CNICs and similar details removed before they're stored, kept for up to a week.
• Usage, only if a firm chooses: how often each feature is used per day (for example "Invoices: 14"), never what was in it; and the questions its people type into Ask AI, with names, CNICs, NTNs, phone numbers, emails and amounts removed before they're stored, kept for 13 months, to learn what people need and where the AI falls short; and signs that someone struggled on a screen (the same button clicked again and again, a click that did nothing, an error shown, a dialog closed without saving), recorded as the page, the button's label and the few steps before it, with no person named and never what was typed or shown, kept for 90 days. Turning sharing off deletes all of it.

How we use it

• To provide the service: sign-in, the features a firm uses, sending what a firm asks us to send, billing.
• To keep it secure: detecting abuse, blocking attacks, investigating problems.
• To improve it: from error reports, timings and, where a firm has opted in, feature usage counts, masked Ask AI questions and struggle signals. We never use a firm's client data to improve TaxElita.
• To contact account holders about their account, bills and important changes. No marketing emails without consent.

AI features

AI features (the Copilot, Fill with AI, Read with AI, sorting files) send only what's needed for that request to the AI provider listed under Sub-processors, and only when the firm has AI document reading turned on. AI answers are checked by a person before anything is saved. We do not use firms' or clients' data to train AI models, and we choose provider settings that keep requests out of the provider's training where the provider offers that.

Who can see what

• Inside a firm: each person sees only what their role allows; consultants may be limited to their own clients.
• Other firms: never, except what a firm deliberately shares with a partner firm.
• TaxElita staff: can see each firm's name, package, billing, usage counts and masked Ask AI questions (where shared), staff accounts and system health. They cannot open a firm's client records, documents, invoices or messages; the software blocks it. In a support case, a firm can share specific records with us.

Sharing

We don't sell personal information. We share it only with the sub-processors that run parts of the service, when the law requires it, or when a firm sends something itself (an invoice to its client, for example).

How long we keep it

A firm's data is kept while its account is open. After a firm closes, its data is kept for 30 days in case it comes back, then deleted, except where the law requires us to keep records longer. Error reports and timings are kept for a week; security events and the activity log as long as the account exists.

Your choices and rights

Staff can see and update their profile, sign out of any device, and ask their firm for a copy of their data. Firms can export their clients and data, change whether they share usage (Settings → Privacy) at any time, and ask us to delete their account. A firm's clients should contact the firm, which controls their information. We respond to requests within 30 days.

Security

Connections are encrypted; identity numbers, secrets and stored files are encrypted at rest; each firm's data is kept apart; sign-in tokens are kept out of reach of page scripts and rotated; and every change is logged.

Law and changes

We follow Pakistan's laws, including the Prevention of Electronic Crimes Act 2016, and will meet the requirements of Pakistan's personal data protection law as it comes into force. When we change this policy in a way that matters, we update the version and tell account holders.