Privacy Policy

What HisabKing AI collects, why we collect it, who we share it with, and the rights you have over it.

Last updated: 2 September 2026

1. Who this policy covers

HisabKing AI is a platform that connects businesses and individuals with independent, verified Chartered Accountants for services such as GST filing, income tax returns, company registration, trademark registration, audits, payroll and ongoing compliance.

This policy explains what information we collect when you browse the site, submit an enquiry, create an account, or run a case through the platform — and what we do with it. It applies to visitors, clients, and the Chartered Accountants and assistants who work on cases.

The Chartered Accountants on the platform are independent professionals. When one is assigned to your case, they act as an independent recipient of the case information you share, and their own professional and regulatory obligations apply alongside this policy.

2. Information we collect

We collect only what the service needs to run. In practice that falls into six groups.

Enquiry details: When you submit the callback or contact form, we collect your name, phone number, email address, the service you selected, and whether you agreed to be contacted. We also record the time of the enquiry and, internally, its follow-up status and any notes our team adds while responding to you.
Account details: If your enquiry becomes a case, we create an account holding your name, email address, phone number, role, and an optional profile picture. Passwords are never stored in readable form — only a one-way hash of them.
Case and document data: Running a case means handling the documents you upload for it — which for accounting and compliance work commonly include financial and identity records. We also store the case's service type, its status history, questions raised against it, meeting details, and any certificate issued on completion.
Communications: We keep a record of the emails, WhatsApp messages, SMS and in-app notifications we send you about your enquiry or case, and of WhatsApp replies you send back to us, so that whoever picks up your case can see what has already been discussed.
Payment records: Where a fee applies, we store the amount, currency, purpose and status of the payment. We do not collect or store card numbers, UPI IDs or bank credentials on our servers.
Technical data: Our servers process the usual technical information needed to serve and protect a website, including your IP address, which we use to apply rate limits that block automated abuse of sign-in and enquiry endpoints.

3. How we use your information

To match you with a CA: Your enquiry details are used to identify a suitable Chartered Accountant for the service you asked about.
To deliver the service: Case data and documents are used by the assigned professional to carry out the filing, registration, audit or advisory work you booked.
To keep you informed: We send status updates, document requests, meeting links and reminders over email, WhatsApp, SMS and in-app notification.
To arrange consultations: Where your case includes a consultation, we generate a video meeting link and share the joining details with you and your CA.
To keep records: We maintain payment and case records to support billing, dispute resolution and our own statutory obligations.
To keep the platform safe: Technical data is used to authenticate sessions, apply rate limits, and investigate abuse or security incidents.

4. Consent and the basis for processing

We ask for your agreement before contacting you on WhatsApp, email and phone about an enquiry, and the enquiry form records that agreement together with the time it was given.

Once a case is opened, we process your information because it is necessary to deliver the service you engaged us for, and to meet the record-keeping obligations that apply to that work.

You can withdraw consent to marketing or non-essential communications at any time by contacting us. Withdrawing consent does not affect messages we must send to deliver an active case — for example a document request or a filing deadline reminder — and does not affect records we are required to retain.

5. Who can see your documents

Case documents are visible to you, the Chartered Accountant assigned to your case, and where one is involved, the assistant supporting that CA. Access is enforced by role: an account that is not party to a case cannot retrieve its documents or its certificate.

A small number of platform administrators can access case records where it is necessary to operate the service — for example to reassign a case, resolve a support request or investigate a fault. This access is limited to what the task requires.

Other clients can never see your documents, and Chartered Accountants cannot see cases that are not assigned to them.

7. How we protect your information

No system is perfectly secure. If a breach affects your personal data, we will notify you and the relevant authority as required by law.

Encryption in transit: Traffic between your browser and our servers is encrypted over HTTPS.
Encrypted documents at rest: Uploaded case documents are encrypted on our servers, so the stored files are not readable without the platform's key.
Hashed passwords: Passwords are stored only as a one-way hash. Nobody at HisabKing AI can read your password.
Session cookies: You stay signed in through a cookie that JavaScript on the page cannot read, which limits the damage a cross-site scripting flaw could do.
Role-based access: Every request for case data is checked against the requester's role and their relationship to that case.
Rate limiting: Sign-in, enquiry and webhook endpoints are rate limited to slow down automated attacks.

8. How long we keep it

Enquiries that never become cases are kept while they are still commercially relevant, and removed once they are not.

Case records, documents and certificates are kept for as long as your account is active, and afterwards for as long as tax, company-law and professional record-keeping rules require — these periods are set by law rather than by us, and for accounting records they commonly run to several years after the end of the relevant financial year.

When a retention period ends, records are deleted or archived out of everyday access.

9. Your rights over your data

To exercise any of these, write to us at the address in section 12. We may need to verify your identity first, so that we do not disclose your information to someone else.

Access: Ask for a copy of the personal information we hold about you and a summary of how it is being processed.
Correction: Ask us to correct information that is inaccurate, or complete information that is missing.
Erasure: Ask us to delete your information where we are not required to keep it.
Withdraw consent: Withdraw agreement to non-essential communications at any time.
Grievance redressal: Raise a complaint about how your information has been handled, and receive a response.

10. Cookies and local storage

We use one cookie, to keep you signed in. It is essential — without it you would be signed out on every page load — and it is not used for advertising or cross-site tracking. If you tick "keep me signed in" when logging in, that cookie lasts 30 days instead of one; leave it unticked and the session ends after a day.

Everything else is stored by your browser on your own device. None of it is sent to us, and none of it is readable by us or by any other site.

Essential — always stored: Your sign-in cookie, your light or dark theme choice, your answer to the cookie banner, and whether you have already dismissed a prompt in this tab. Without these the site cannot keep you signed in or remember that you already answered the banner.
Optional — only if you accept: An unfinished enquiry form, so you don't have to retype it if you navigate away, and the services you have opened, shown back to you as "recently viewed". If you choose "essential only" in the cookie banner, none of this is written, and anything already saved is deleted.
Working preferences on signed-in screens: For staff accounts, how you last left a dashboard set up — the layout chosen and the filters applied to the leads board — so the screen isn't reset every visit. These record no browsing activity.

11. Children

The platform is intended for businesses and for individuals managing their own tax and compliance affairs. It is not directed at children, and we do not knowingly collect their information. If you believe a child has provided us with personal data, contact us and we will remove it.

12. Contact us

Questions about this policy, requests to exercise the rights in section 9, and complaints about how your data has been handled can all be sent to support@hisabkingai.com.

We will acknowledge your request and respond within the period required by applicable law.

13. Changes to this policy

We may update this policy as the platform changes or as the law requires. The revision date at the top of this page always reflects the most recent change. Where a change materially affects how we use your information, we will tell you directly rather than relying on this page alone.