Privacy Policy

We collect only what a compliance engagement needs:

• Enquiry and lead forms — name, phone, email, the service you asked about and your preferred callback window.
• Newsletter signups — your email address and chosen topics.
• Portal accounts — name, email and phone for login and service delivery. Login uses one-time codes sent to your email; we never store passwords.
• Engagement records — documents you upload to the vault, filing details, invoices, payment records and support conversations, kept as part of delivering and evidencing the professional services you engaged us for.
• Website assistant — the questions you type. Identifiers such as Aadhaar, PAN, card or OTP digits are redacted before processing. Chat history is stored only on your own device and expires within 24 hours.

• To respond to enquiries and provide requested callbacks.
• To deliver engaged services: registrations, filings, renewals and the deadline reminders that go with them.
• To send service notifications — due-date reminders, invoice and filing updates — to the contact details on your account.
• To meet our own legal obligations as a professional services provider, including record-keeping required by Indian law.
• We do not sell personal data, and we do not use it for third-party advertising.

The website itself sets no advertising or analytics cookies. The only cookie in use is the essential, session-scoped cookie created when you sign in to a portal — it keeps you logged in and nothing else. If we ever add analytics, this policy and an on-site consent notice will say so first.

We use a small set of infrastructure providers, each acting under our instructions:

• Cloud hosting, database and encrypted document storage.
• An email delivery provider for login codes and reminders.
• A large-language-model service (Google Gemini) that rephrases the website assistant’s draft answers. Only the redacted chat text is sent — never your account, document or client records, which the assistant cannot access at all.

Beyond these processors, personal data is disclosed only to government portals as needed to complete a filing you asked for, or where the law requires it.

• Leads and enquiries — until resolved, and then only as business correspondence; deleted on request.
• Newsletter emails — until you unsubscribe or ask us to remove you.
• Engagement records and filed documents — for the period Indian statute requires records of that filing to be preserved, after which they are deleted or anonymised.

Data moves over encrypted connections and rests in access-controlled storage. Portal access requires one-time email codes; documents are served through short-lived, signed links rather than public URLs; and staff actions on client records are written to an audit trail. No system is perfectly secure, but we design for least access and honest logging.

Under the DPDP Act you may ask us, at any time, to access, correct or erase the personal data we hold about you, or to withdraw a consent you previously gave. Write to hello@axaon.in with the request and we will respond within the statutory window. If you are unsatisfied with our response you may escalate to the Data Protection Board of India.

Grievances go to the same address, marked “Grievance”, and are acknowledged within 72 hours.

Our services are directed at businesses and their authorised representatives. We do not knowingly collect personal data from anyone under 18.

When this policy changes, the effective date above changes with it, and material changes are notified to portal account holders by email. Continued use after a revision means the revised policy applies.