Data Processing Agreement

This Data Processing Agreement ("DPA") is entered into between:

• Data Controller / Firm: A registered/licensed professional (Chartered Accountant, Tax Professional, Tax Consultant, Advocate, or similar) ("you" or "User") who registers an account on iKnowIncomeTax and uploads client data.
• Data Processor: M/s TxQUBE, operating iKnowIncomeTax ("we", "us", "Platform").

Key Definitions:

• Data: Any information relating to an identified or identifiable natural person (your client), including income details, personal details and tax-related financial records.
• Processing: Any operation performed on Data, including collection, storage, use, analysis, and AI-assisted drafting.
• Sub-Processor: Any third-party service used by iKnowIncomeTax to assist in Processing (e.g., AI providers, cloud infrastructure).

The User (as Data Controller) instructs iKnowIncomeTax to process the following categories of Data:

• Client’s Identifiable Information: As uploaded by the User (as Data Controller).
• Financial Records: Including but not limited to Income Tax Returns (ITR), Form 26AS, AIS, TIS, bank statements, balance sheets.
• Legal Correspondence: Income Tax notices, orders, assessment records, appeal documents.
• Any other documents voluntarily uploaded by the User to the Platform.

Processing is carried out exclusively on behalf of and under the instructions of the User for the following purposes:

1. AI-assisted analysis of tax notices and legal documents.
2. Generation of draft responses and submissions.
3. Retrieval-Augmented Generation (RAG) research using the User's uploaded documents.
4. Case and compliance timeline management.
5. Secure client portal communication.

By using iKnowIncomeTax to process your clients' data, you confirm and warrant that:

1. You have obtained all necessary consent or have a valid legal basis under the Digital Personal Data Protection (DPDP) Act, 2023 and applicable professional rules (ICAI Code of Ethics) to share your clients' Personal Data with this Platform.
2. You will inform your clients that their data may be processed using AI-powered software tools for the purpose of providing tax compliance services.
3. You will not upload documents belonging to persons who have not engaged you for professional services.
4. You are responsible for maintaining the accuracy of data uploaded to the Platform.
5. You will promptly notify iKnowIncomeTax operated by M/s TxQUBE of any instruction that, in your view, would violate applicable law.

iKnowIncomeTax shall:

1. Process only on instruction: Process Data/Personal Data only in accordance with your documented instructions and not for any other purpose.
2. Confidentiality: Ensure that all personnel authorised to process Data/Personal Data are bound by appropriate confidentiality obligations.
3. Security: Implement technical and organisational measures to protect Personal Data, including encryption at rest and in transit, Row-Level Security (RLS) in the database to enforce strict account-level data isolation, and access controls.
4. No training on your data: Your uploaded documents and client data are never used to train any AI model. Documents are sent to AI providers solely for the purpose of generating a response to your specific query and are governed by those providers' API data policies.
5. Data subject requests: Assist you in responding to requests from data subjects (your clients) exercising rights under the DPDP Act, 2023.
6. Breach notification: Notify you without undue delay (and in any event within 72 hours of becoming aware) of a Personal Data breach affecting your clients' data.
7. Deletion: Upon termination of your account, delete or anonymise all Personal Data (documents and their embeddings) within 30 days, unless retention is required by law.

You authorise iKnowIncomeTax to engage the following categories of Sub-Processors, each of whom is bound by data processing terms no less protective than this DPA:

iKnowIncomeTax may notify you before adding any new Sub-Processor that processes Personal Data, giving you the opportunity to object.

You acknowledge that iKnowIncomeTax's infrastructure and Sub-Processors are located outside India. By agreeing to this DPA, you provide the necessary authorisation for transfer of Personal Data to these jurisdictions for the limited purposes described in this Agreement. iKnowIncomeTax ensures that appropriate safeguards are in place for such transfers in accordance with the DPDP Act, 2023 and any applicable guidance on data localisation (where applicable).

iKnowIncomeTax implements the following security measures:

• Encryption: AES-256 encryption at rest for all stored documents and database records; TLS 1.3 in transit.
• Access Control: Row-Level Security (RLS) at the database level ensures that each CA firm's data is strictly isolated — no firm can access another's data, even in the event of an application-layer bug.
• Document Access: Uploaded documents are stored in private Supabase Storage buckets. Signed URLs (valid for max 1 hour) are generated only when needed to send documents to AI providers.
• Vector Embeddings: Document embeddings are mathematical representations that cannot be reversed to reconstruct the original document text.
• Authentication: Multi-factor authentication support; session management with auto-expiry.
• Audit Logs: Activity logs maintained for all significant data processing events within the Platform.

This DPA commences on the date you accept it at registration and continues for the duration of your account.

Closing your account. You may delete your account yourself from Settings → Profile. There is a 30-day grace period during which nothing is removed and you may cancel the request at any time.

Exporting your data. Export is self-service and available at any time while your account is open — from Settings in iKnowIncomeTax, and from Reports → Export & Backup in TxQUBE Accounts, where Full Account Export produces a single archive of every entity, all accounting records and your uploaded documents. We recommend exporting before starting a deletion request.

What happens to your data. The distinction below reflects the different roles in which we hold it:

1. Your records and your clients' data — held as Processor. Cases, notices, drafts, uploaded documents and, in TxQUBE Accounts, your entities, journals, ledgers, invoices and GST records. These are deleted after the grace period. Accounting records are detached and held for a short operational recovery window (30 days by default) and then permanently removed. We do not retain them for the statutory periods under section 36 of the CGST Act or section 128 of the Companies Act: those obligations rest with you as the taxpayer, not with us as your software provider, which is why taking an export before deletion matters.
2. Billing records — held as Data Fiduciary. Invoices we raise to you and records of payments you make to us. These are retained for seven years as Indian accounting and tax law requires, with your personal identifiers removed so the records can no longer be linked to you.
3. Proof of erasure. A minimal audit record that a deletion was requested and carried out is retained. It contains no case, client or accounting data.

Both products. iKnowIncomeTax and TxQUBE Accounts share a single login. Deleting your account removes your data from both, including your accounting books. Export from each before you proceed.

iKnowIncomeTax's liability under this DPA is subject to the limitations set out in the Terms of Service. The User, as Data Controller, bears primary responsibility for compliance with the DPDP Act, 2023 with respect to the lawfulness of processing their clients' Personal Data. iKnowIncomeTax is responsible only for breaches of its obligations as Data Processor under this DPA.

For any data protection queries, breach reports, or data subject requests, contact:

Data Protection Officer / Grievance Officer:
(Grievance Officer, M/s TxQUBE)
M/s TxQUBE (operator of iKnowIncomeTax), Dehradun, Uttarakhand, India
Email: privacy@iknowincometax.com
Appointed as required under the Digital Personal Data Protection (DPDP) Act, 2023.

Grievances will be acknowledged within 48 hours and resolved within 30 days of receipt.