Privacy Policy

This policy explains how White Star Web Solutions (Pvt) Ltd (company registration number PV 114441, registered office 110, Havelock Road, Colombo 05) (“we”, “us”), the company that provides TaxFlow, collects, uses and protects personal data. It follows the Personal Data Protection Act, No. 9 of 2022 of Sri Lanka, as amended (“the Act”).

TaxFlow has two lines. TaxFlow for Business issues tax invoices, credit notes and debit notes and provides VAT tools. TaxFlow Personal computes individual income tax and prepares return packs. Accounting practices use both for their clients.

1. Our role

• We are the controller of your account, billing, referral and affiliate data, your use of our website, and the TaxFlow Personal data you enter about yourself.
• When a business or practice uses TaxFlow, it decides what data about its customers, clients and staff goes into TaxFlow. For that data, the business or practice is the controller and we process it on its behalf. If you are a customer of one of our users, contact that business first about your data; we will help it respond.
• If you share a return with a partner practice on the assisted route, that practice is also responsible for your data for the work it does for you.

2. What we collect

• Account details: your name, email address, phone number if you give it, your password (stored only as a secure hash), two-step verification settings and your role in a workspace.
• Business details: company names, TINs, addresses, logos, bank details shown on invoices, customers and their details, invoices, credit and debit notes, approvals and the tax documents you issue.
• Connection data: access tokens for Xero, QuickBooks, Zoho Books, Odoo, Google Sheets, WhatsApp Business and PayHere, encrypted at rest. We read data through these connections and never change your accounting records.
• TaxFlow Personal data: TIN, NIC number, date of birth, residency and senior citizen status, income from each source, reliefs and tax credits, tax withheld and paid, last year's tax and losses, assets and liabilities, evidence documents you upload (such as salary statements, bank certificates and receipts) and IRD acknowledgements. If you prepare a return for a family member, the same data about them. Only add another person's data if you are entitled to, and let them know.
• Payment details: your plan, amounts, dates and PayHere references. Card details go directly to PayHere; we never see or store full card numbers.
• Referral and affiliate data: the code a workspace signed up with, visits to referral links (counted with a one-way keyed hash of the IP address, never the address itself), points and commission. Affiliates also give us payout bank details, which are encrypted at rest.
• Usage and security data: sign-in times, IP address, device and browser type, error logs and an audit log of actions in your workspace.
• Website data: cookies and similar technologies, described in section 6.
• Support messages: what you send us when you ask for help.

3. How we use it and why

• To provide TaxFlow, because you have a contract with us: reading your invoices, preparing and issuing tax documents, computing tax, building return packs, and sending documents and reminders when you ask us to.
• To bill you and run the referral and affiliate programmes, under the same contract.
• To keep TaxFlow secure and prevent fraud and misuse, including self-referral, because we have a legitimate interest in doing so and the law requires it.
• To meet legal obligations, such as keeping tax and accounting records and answering lawful requests from authorities.
• To send service messages about security, billing and changes to TaxFlow.
• To send marketing emails, only with your consent. You can unsubscribe at any time.
• To improve TaxFlow, using usage data in aggregated form.
• To measure our website and advertising, only if you accept analytics and advertising cookies.

We do not sell personal data, and we never use your invoice or tax data for advertising. TaxFlow's tax computations are automated calculations from the figures you enter. They are shown to you to review; we make no decisions about you based on them.

4. Who we share it with

• Service providers who run TaxFlow for us under contract: cloud hosting (DigitalOcean), email delivery (Brevo), PayHere for payments, Meta for WhatsApp messages you send from your own WhatsApp Business number, and Google and Meta for website analytics and advertising if you accept those cookies.
• Software you connect: data moves between TaxFlow and Xero, QuickBooks, Zoho Books, Odoo or Google Sheets under that provider's own terms.
• Recipients you choose: when you send a document by email or WhatsApp, its recipient receives it.
• Practices: staff in a practice workspace see the clients assigned to them. A partner practice on the assisted route sees your return for the year you accepted, and only after you give consent. You can withdraw consent at any time; this stops further access but does not undo work already done.
• The Inland Revenue Department: only if you use IRD e-invoice sync once the IRD opens access. TaxFlow does not file income tax returns for you.
• Referrers and affiliates: they see counts and amounts only, never who their customers are.
• Authorities and advisers: where the law requires it, or to protect our rights and our users.
• A buyer of our business: if TaxFlow is sold or merged, your data moves with the service and we will tell you.

5. Transfers outside Sri Lanka

Some of our service providers store or process data outside Sri Lanka. Our main hosting is in India (Bengaluru). When personal data leaves Sri Lanka, we use the safeguards the Act requires, such as binding contractual commitments with the recipient. Contact us for details.

6. Cookies and analytics

• Essential cookies keep you signed in, protect your account, remember a referral code for 30 days and store your preferences. TaxFlow cannot work without them.
• Analytics and advertising cookies (Google Analytics and Meta Pixel) run on our public website only after you accept them in the cookie banner. You can change your choice at any time through the “Cookie settings” link in the footer or in your browser.

7. How long we keep it

• Issued tax documents, tax registers and audit records: for as long as your workspace exists, and then for 5 years after the end of the tax period they relate to, as Sri Lankan tax law requires.
• TaxFlow Personal computations, return packs and evidence: on the same basis, counted from the end of the year of assessment.
• Connection tokens: deleted when you disconnect the software or close your account.
• Other account data: deleted or anonymised within 90 days after you close your account, unless the law requires us to keep it.
• Payment and payout records: for as long as tax and accounting law requires.
• Backups: overwritten within 30 days.

8. Your rights

Under the Act you can ask to access your personal data, correct or complete it, erase it, withdraw consent, or stop us processing it. You can export your issued documents and return packs from TaxFlow at any time.

We reply within one month. If a request is complex we may extend this by up to two more months and will tell you why. We may need to confirm your identity first. If we refuse a request, we will explain why and how you can appeal. You can also complain to the Data Protection Authority of Sri Lanka (dpa.gov.lk).

9. Security

We encrypt data in transit and encrypt sensitive fields at rest with AES-256, including TINs, NIC numbers, bank details, financial figures and connection tokens. We offer two-step verification, limit and log staff access, and record important actions in an audit log. If a personal data breach affects you, we will notify the Data Protection Authority and you as the Act requires. Please protect your password and turn on two-step verification.

10. Children

TaxFlow is for people aged 18 and over. Do not create an account for anyone under 18.

11. Contact us about privacy

For privacy questions or requests, email [email protected] or write to us at 110, Havelock Road, Colombo 05.

12. Changes to this policy

We post changes on this page and update the date at the top. We email you about significant changes before they take effect.