Privacy Policy

    Last updated: 26 February 2026

    1. Introduction

    KCS Creations ("we", "our", or "us") operates CryptoITR.com ("the Platform"), a cryptocurrency tax calculation service designed for Indian residents. We are committed to protecting your privacy and processing your personal data in compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act) and other applicable Indian laws. This Privacy Policy explains how we collect, use, store, and safeguard your information when you use our Platform.

    By using CryptoITR.com, you consent to the collection and processing of your personal data as described in this policy. You may withdraw your consent at any time by contacting us.

    2. Information We Collect

    2.1 Personal Information

    • Name and email address provided during registration
    • IP address collected automatically when you access the Platform
    • Device and browser information for security and compatibility

    2.2 Transaction and Financial Data

    • Cryptocurrency trade reports uploaded as CSV or XLSX files from supported exchanges (including Binance, WazirX, CoinDCX, KuCoin, Bybit, CoinSwitch, and Delta Exchange)
    • Exchange names and transaction details contained in uploaded files
    • Calculated tax results, reports, and summaries generated by the Platform

    2.3 Usage Data

    • Pages visited, features used, and interaction patterns
    • Analytics data collected via privacy-respecting tools

    3. Purpose and Legal Basis for Processing

    Under the DPDP Act 2023, we process your personal data based on your explicit consent and for legitimate purposes. We use your information to:

    • Provide cryptocurrency tax calculation services
    • Generate tax reports and summaries from your uploaded trade data
    • Process payments and manage your subscription (when applicable)
    • Communicate important updates, changes, or support responses
    • Improve our Platform, fix bugs, and enhance user experience
    • Comply with legal and regulatory obligations under Indian law

    4. Data Processors and Third-Party Services

    We use the following third-party service providers to operate our Platform:

    • Supabase -- Authentication provider for secure sign-in and session management. Supabase servers may be located outside India (e.g., Singapore or the United States).
    • Razorpay -- Payment gateway for processing subscription payments. Razorpay handles payment details directly; we do not store your payment information on our servers.
    • Microsoft Azure -- Cloud infrastructure provider for data storage and backend services. Your trade data and tax calculations are stored on Azure servers located in Central India.

    These processors are contractually bound to handle your data securely and only for the purposes we specify. We do not sell, rent, or share your personal data with any third parties for marketing or other unrelated purposes.

    4A. Cross-Border Data Transfer

    Your primary data (trade records, tax calculations) is stored on servers located in India (Microsoft Azure, Central India region). However, certain data may be processed or stored outside India by our authentication provider (Supabase) and payment gateway (Razorpay). We ensure that any cross-border transfer of personal data complies with the provisions of the DPDP Act, 2023 and the DPDP Rules, 2025. Data is not transferred to any country restricted by the Central Government under the DPDP Act.

    5. Data Security

    We implement appropriate technical and organizational measures to protect your data, including:

    • Encryption of data in transit (TLS/HTTPS) and at rest
    • Secure cloud infrastructure with access controls
    • Authentication mechanisms to protect your account
    • Regular review of security practices

    6. Data Retention

    Uploaded files and trade data: Your uploaded trade report files and parsed trade data are automatically deleted 1 hour after upload. You can also delete your data immediately at any time from your Dashboard. This ensures your sensitive financial data is not stored longer than necessary.

    Account data: We retain your basic account information (email, authentication data) for as long as your account remains active. Upon account deletion, your data will be securely erased from our systems.

    You may request earlier deletion of any data by contacting us. We recommend downloading your tax reports (CSV/PDF) before your data is auto-deleted.

    7. Your Rights as a Data Principal (DPDP Act 2023)

    Under the Digital Personal Data Protection Act, 2023, you have the following rights:

    • Right to Access -- Request a summary of your personal data being processed and the processing activities
    • Right to Correction -- Request correction of inaccurate or incomplete personal data
    • Right to Erasure -- Request deletion of your personal data, subject to legal retention requirements
    • Right to Withdraw Consent -- Withdraw your consent for data processing at any time; this may affect your ability to use certain features
    • Right to Grievance Redressal -- Lodge a complaint with us or with the Data Protection Board of India
    • Right to Nominate -- Nominate another individual to exercise your rights in case of death or incapacity

    To exercise any of these rights, contact us at support@cryptoitr.com.

    7A. Data Breach Notification

    In the event of a personal data breach that is likely to cause harm to you, we will notify the Data Protection Board of India and affected users within 72 hours of becoming aware of the breach, in accordance with the DPDP Act, 2023. The notification will include the nature of the breach, the data affected, and the remedial actions taken.

    8. Cookies and Tracking

    We use only essential cookies required for Platform functionality (such as session management and authentication). We do not use third-party advertising or tracking cookies. Analytics, if any, are collected using privacy-respecting tools that do not build user profiles or share data with advertisers. You can control cookie preferences in your browser settings.

    9. Affiliate Disclosure

    CryptoITR.com may contain referral or affiliate links to cryptocurrency exchanges (such as Binance, WazirX, CoinDCX, and others). If you sign up or transact through these links, we may receive a commission from the exchange. This does not affect the price you pay or the services you receive. Affiliate relationships do not influence our tax calculations or recommendations in any way.

    10. Children's Privacy

    Our Platform is not intended for individuals under the age of 18. We do not knowingly collect personal data from minors. If we become aware that we have collected data from a person under 18, we will promptly delete it.

    11. Changes to This Policy

    We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date. Continued use of the Platform after such changes constitutes acceptance of the revised policy.

    12. Grievance Officer and Contact

    For any privacy-related questions, to exercise your data principal rights, or to file a grievance, please contact:

    KCS Creations
    Operating CryptoITR.com
    Address: [Registered Address — to be updated before production launch]

    Designation: Grievance Officer
    Email: grievance@cryptoitr.com

    We will acknowledge your request within 48 hours and endeavour to resolve it within 15 days, in accordance with the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021. If you are not satisfied with our response, you may file a complaint with the Data Protection Board of India.