Privacy Policy

Scrutiny Mitra is an AI-powered Income Tax Scrutiny defense platform owned and operated by Siddesh Umrigar, based in India. For the purposes of the DPDP Act, 2023, we act as the Data Fiduciary in respect of personal data you provide. You can reach us at contact@scrutinymitra.in.

We collect the following categories of information:

• Account information — name, email address, and authentication credentials managed via our auth provider (Clerk).
• Scrutiny case data — income tax notices, assessment orders, supporting documents, and any text, metadata, or notes you provide while using the platform.
• Communication data — messages, attachments, and metadata when you contact us via email or the in-app dashboard.
• Technical data — IP address, browser type, device identifiers, timestamps, and server logs collected automatically for security, fraud prevention, and diagnostics.
• Usage data — interactions with platform features, AI queries, case activity, and session information for product improvement.

• To create and operate your account and authenticate you securely.
• To analyse income tax notices, generate AI-assisted summaries, risk assessments, and draft scrutiny responses.
• To surface relevant ITAT, High Court, and Supreme Court precedents applicable to your scrutiny matter.
• To respond to your queries and support requests.
• To detect, prevent, and investigate fraud, abuse, and security incidents.
• To improve and personalise the platform experience.
• To comply with applicable law, including responses to lawful requests from public authorities.

We process your personal data on the basis of your consent provided at the time of registration and at the point of case upload, and for the legitimate uses recognised under Section 7 of the DPDP Act, 2023 (including to fulfil our contractual obligations to you and to comply with law). You may withdraw your consent at any time by writing to us; please note that withdrawal does not affect processing already carried out.

We do not sell your personal information. We share information only with the following categories of recipients:

• AI service providers — we use Google's AI infrastructure (Gemini API) to analyse notice documents and generate scrutiny response drafts. Only the relevant extracted text is sent; we take steps to minimise personally identifiable information in AI prompts.
• Cloud hosting and infrastructure providers — we use Oracle Cloud Infrastructure for hosting the application and database. These providers process data only under contract and for the limited purposes we instruct.
• Authentication provider — Clerk, Inc. manages user authentication and identity on our behalf. Clerk's own privacy policy applies to the authentication data they process.
• Authorities and others — to comply with applicable law, valid legal process, or to protect the rights, property, or safety of users, the platform, or the public.

Some of the processors and infrastructure providers we use are located outside India. We disclose them by category and jurisdiction:

• AI processing — Google LLC (via the Gemini API), with processing infrastructure located in the United States.
• Hosting infrastructure — Oracle Cloud Infrastructure, with servers in the United States and India.
• Authentication — Clerk, Inc., with infrastructure in the United States.
• DNS and edge protection — Cloudflare, Inc., operating from globally distributed infrastructure.

Where transfers occur, we take reasonable contractual and technical safeguards (including secure transport, access controls, and processor agreements). Transfers comply with the DPDP Act, 2023 and any country-restriction notifications issued by the Central Government.

• Scrutiny case files and AI-generated drafts: retained while your account is active and for up to 90 days after case closure, unless you request earlier deletion.
• Account information: retained while your account is active and for a reasonable period thereafter for security and audit purposes.
• Server and security logs: retained for up to 12 months unless a longer period is required for an ongoing investigation.

We follow reasonable security practices and procedures as required under Section 8 of the DPDP Act, 2023, including encryption of data in transit (TLS) and at rest, role-based access control, secure authentication (via Clerk), and audit logging. No method of transmission over the internet is 100% secure; we ask that you also keep your credentials confidential.

Subject to the DPDP Act, 2023 you have the right to:

• Access a summary of the personal data we hold about you.
• Correct or update inaccurate or incomplete personal data.
• Have your personal data erased once the purposes for which it was collected are no longer served.
• Withdraw your consent and have the consequences of such withdrawal explained.
• Nominate another person to exercise these rights in the event of your death or incapacity.
• File a grievance with our Grievance Officer (see Section 12) and, if unresolved, with the Data Protection Board of India.

We use only strictly-necessary cookies — primarily to keep you signed in (authentication tokens managed by Clerk) and to remember session preferences. We do not currently use third-party advertising or behavioural-tracking cookies. If we introduce analytics or other non-essential cookies in future, we will update this policy and obtain your consent where required.

Scrutiny Mitra is intended for taxpayers, Chartered Accountants, and Advocates who are 18 years of age or older. We do not knowingly collect personal data from any person below 18. If we become aware that we have inadvertently collected data from a minor, we will delete it within 30 working days of becoming aware. A parent or guardian may write to contact@scrutinymitra.in to request deletion.

In accordance with the Information Technology Act, 2000, the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and the DPDP Act, 2023, the contact details of our Grievance Officer are:

We will acknowledge a complaint within 48 hours and resolve it within 15 days of receipt, except where law prescribes a different timeline.

In the event of a personal-data breach affecting your information, we will notify the Data Protection Board of India within 72 hours of becoming aware, in accordance with Section 8(6) of the DPDP Act, 2023. We will also notify affected users without undue delay through their registered email and a banner in the dashboard, including the nature of the breach, the categories of data affected, the mitigation steps taken, and contact details of the Grievance Officer.

We may update this Privacy Policy from time to time. The effective date at the top of this page will indicate the date of the most recent update. Material changes will be notified to you in your dashboard or by email.

For any question relating to this policy or your personal data, write to contact@scrutinymitra.in.