This notice explains how Claw LegalTech Private Limited (“Claw”) handles your personal data on Claw Tax & Accounts, under the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025, and, until those duties apply in full, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.
Who is responsible
For orders placed on Claw Tax & Accounts, Claw is the data fiduciary. Professionals Claw engages for your order process your data on Claw's behalf as data processors, under written agreements, and only for your order. When a chartered accountant uses Claw Practice for their own clients, that accountant is the data fiduciary and Claw is their processor.
What we collect and why
| Data | Purpose | Kept for |
|---|---|---|
| Name, phone, email | Create your account, confirm orders, send reminders and receipts | While your account is open, then [x] years |
| PAN, Aadhaar number, date of birth | Prepare and file the returns and registrations you order | As long as the law requires records of the filing to be kept, then deleted |
| Income, bank, invoice and business records you upload | Carry out the service you ordered | [x] years after the order closes, or earlier if you delete them |
| Payment references (not card numbers) | Take payment, issue GST invoices, process refunds | As required by tax and accounting law |
| Messages, tickets and call notes | Support, quality review and resolving complaints | [x] years |
| Chat with Aashima | Suggest a service and improve answers | [x] days, then deleted or anonymised |
We ask for consent with a separate, unticked checkbox at checkout and sign-up. We don't use your documents for marketing, and we don't sell personal data.
Aadhaar
Most tax and registration filings need your Aadhaar number, so we ask for it and use it only to prepare and file what you order. We keep it encrypted, never use it for marketing, and Aadhaar authentication for registrations happens on the government portal with your own OTP.
Who we share it with
- The Professional assigned to your order, and a Claw reviewer.
- Government portals, when you approve a filing.
- Service providers who run parts of the Service for us: hosting and storage [provider], payments [Razorpay], e-signature [MSB], messaging [WhatsApp provider, email provider], and an AI model provider for the chat assistant [provider]. Each is bound by a processing agreement.
How we measure the site and our service
To make the site simpler and our service faster, we record which pages you visit, which buttons and links you press, the steps you reach (for example adding to the cart, paying, uploading documents, filing) and how long each step takes. We use a random identifier stored on your device, not your name or number, until you verify a mobile or buy something; from then the record is linked to your lead or account so we can see the whole journey.
- What we never record: anything you type into a form, your documents, your screen, or keystrokes. Text we keep from buttons and links is masked for email addresses, phone numbers, PAN and GSTIN.
- No third-party trackers: this measurement is our own. No advertising or analytics companies receive it.
- IP address: shortened when it reaches us (the last part is removed) and never stored in full.
- How long: raw records for 13 months, then only totals that can't identify you.
- Your choice: turn it off any time from Privacy choices at the bottom of every page. We also respect the Global Privacy Control signal from your browser. Turning it off doesn't affect your orders or messages.
- Service quality: for each order we also measure how long it took to receive your documents, the time your CA spent, any corrections, the number of WhatsApp messages and whether you used us again. This is used to improve the service and pay professionals fairly.
Security
Documents are stored encrypted in private storage and opened only through short-lived links. Access is limited to the people working on your order and is logged. If a personal data breach occurs, we will inform you and the Data Protection Board of India as the Rules require.
Your rights
- See a summary of the data we hold and who we have shared it with.
- Correct, update or complete your data, and ask us to erase it once it is no longer needed for the order or required by law.
- Withdraw consent at any time, as easily as you gave it. Withdrawal does not affect work already done.
- Nominate a person to exercise your rights if you die or become unable to.
- Download all your documents and filings from your dashboard at any time.
You may also manage consent through a registered Consent Manager once these are available under the DPDP Rules.
Contact and complaints
Write to our Grievance Officer, Charmil Jain, at contact@clawlaw.in. If you are not satisfied with our response, you may complain to the Data Protection Board of India. See also grievance redressal.