What we know about you, and what we do with it.
Owls see in the dark. We would still rather you saw all of this in daylight.
Last updated 14 July 2026
The short version
- We collect your email, the tax details you enter, and the documents you upload. Nothing else.
- We use it to work out your tax and keep your history. We do not sell it.
- Your PAN is stripped before AI field-extraction, but OCR reads the raw scan first, and chat messages go as written.
- You can download everything, or delete all of it, yourself in Settings.
What we collect
- Your email
- So you have an account to come back to.
- Tax details
- Whatever you type in: salary, deductions, vests, and the rest.
- Documents
- Anything you upload or photograph, such as a Form 16 or a notice.
- Chat & reports
- Your messages and the reports we generate from them.
What we use it for
Estimating your tax, generating your reports, answering your questions, and keeping your history so it is still there next time. That is the whole list. We do not sell your data, and we do not use it to advertise to you.
AI processing, stated plainly
To read documents and answer questions, we send the relevant text to AI providers. Two details we would rather you heard from us than discovered later:
Your PAN is stripped out before the AI field-extraction step. But raw scans and photos are read by Mistral’s OCR (EU-hosted) before that redaction happens. And your chat messages, including any web-search query, are sent exactly as you write them.
Who else touches it
These are the processors we use to run the service:
- DeepSeek
- Chat answers, report generation, field extraction.
- Mistral
- Reads (OCR) the scans and photos you upload. EU-hosted.
- Tavily
- Web search. Only when the feature is on; your query is sent to it.
- Supabase
- Sign-in, database, file storage.
- Vercel
- Hosting and usage analytics.
- Sentry
- Error monitoring. Only when enabled.
Where it lives
In our database, fenced off to your account by row-level security, so other users cannot reach it. Uploaded documents sit in a private store only you can open. Extraction happens in memory; we keep no extra copies beyond what you save to your library.
Your rights, and the buttons that honour them
Under India’s Digital Personal Data Protection Act, 2023 you can access, correct and erase your personal data, and withdraw consent. You do not have to ask us. All of it is in Settings.
- Access
- “Download my data” gives you everything we hold.
- Erase
- “Delete account” removes your account and its data, permanently.
- Withdraw
- Clear what Whoot remembers, and delete documents, any time.
- Correct
- Edit your inputs. Write to us for anything you cannot reach.
Contact & grievances
Privacy questions, data requests or grievances go to support@whoot.club. We aim to respond within 30 days.
This is an early product, and this page will change as it does. If something here is unclear or looks wrong, tell us at support@whoot.club and we will fix the page, not just the answer.