Privacy Policy

1.1 Information you provide directly

• Account details: name, email address, and optionally a phone number when you sign up via Google or email.
• Financial data: income figures, deductions, and investment details you enter into our calculators and planner tools. This data is stored locally in your browser and, if you are signed in, synced to your account.
• Bank statements: PDF or CSV files you upload for analysis. These are processed to extract transaction data and are not shared with third parties.
• Gmail data (optional, opt-in): if you connect your Google account for the Gmail bank-statement auto-import feature, we receive a read-only OAuth token (gmail.readonly scope) limited to finding bank-statement PDF attachments. See Section 5 — Google API User Data for full details on what we read, what we store, and how to revoke access.
• Contact form submissions: name, email, phone number, and message when you reach out via our contact form.
• Consultation requests: details you submit when booking a CA consultation.

1.2 Information collected automatically

• Usage data: pages visited, features used, calculator interactions, and time spent — collected via Google Analytics 4 (GA4).
• Device and browser information: IP address, browser type, operating system, and referral URL — collected by GA4 and Microsoft Clarity.
• Cookies and local storage: we use cookies for authentication sessions and localStorage to persist your calculator inputs between visits.

5.1 Scope requested

• https://www.googleapis.com/auth/gmail.readonly — read-only access to your Gmail messages and their attachments.
• openid and email — basic profile identifiers used only for sign-in and to associate the Gmail connection with your Taficon account.

We do not request scopes that allow sending, modifying, deleting, or organising your email. We do not access Google Drive, Calendar, Contacts, Photos, or any other Google service.

5.2 What we read and what we ignore

• We search Gmail for emails matching specific bank-statement subject patterns (e.g., “bank statement”, “account statement”, “e-statement”) and known Indian bank sender domains.
• We download only the PDF attachments from those matching emails for parsing.
• We do not read or store the body content of emails.
• We do not read non-statement emails such as personal correspondence, newsletters, or promotional messages.
• For protected PDFs, we may extract a password format hint from the email body text (e.g., “your password is the first four letters of your name”). The hint is shown to you in a prompt and is not stored.

5.3 What we store

• The OAuth refresh token issued by Google, encrypted at rest on our backend. This is what allows our 12-hourly background sync to fetch new statements without re-prompting you. Deleted within 24 hours of you disconnecting.
• Parsed transaction rows extracted from your bank-statement PDFs (date, description, amount, type).
• Statement metadata: detected bank, statement period, last 4 digits of account number.
• Optional per-bank passwords that you explicitly choose to save on your profile for re-use across imports.

We do not store the original PDF file or the raw email contents beyond what is necessary to complete a single sync operation.

5.4 Limited Use disclosure

Taficon's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, Taficon affirms that:

• We use Google user data only to provide and improve the user-facing features that you authorised (i.e., auto-importing your own bank statements).
• We do not transfer Google user data to third parties except as necessary to provide and improve those features, to comply with applicable law, or as part of a merger, acquisition, or asset sale (with prior notice to users).
• We do not use Google user data for serving advertisements, including re-targeted, personalised, or interest-based advertising.
• We do not allow humans to read Google user data, except (a) with your affirmative agreement for specific messages, (b) to investigate abuse or security concerns, (c) to comply with applicable law, or (d) where the data has been aggregated and anonymised in a way that cannot be re-identified.

5.5 Sharing with our PDF parser

PDF attachments downloaded from Gmail are sent to our own bank-statement parser service (hosted on Google Cloud Run, project tax-finance-consultant) for transaction extraction. The parser is operated by Taficon — not a third-party vendor. PDFs are processed in memory and discarded after parsing; only the extracted structured transaction data is persisted to your Taficon account.

5.6 Revoking access

You can revoke Taficon's access at any time:

• Within Taficon: visit your profile and click Disconnect Gmail.
• Within Google: visit myaccount.google.com/permissions, find “Taficon”, and click Remove Access.

After revocation, the stored OAuth refresh token is deleted within 24 hours. Already-parsed transaction data remains in your Taficon account until you delete it from Upload History or close your account.