Privacy Policy
Last updated: 18-10-2026
Capitax helps you upload receipts and invoices, reads them and organises the information for you. Your documents are financial records, so we treat them as private. This policy explains, in plain words, what we collect, why, who helps us run the service and what you can ask us to do. Questions? Email support@capitax.org.
1. What we collect
- Account details: your name, email address and password. Passwords are handled by our login provider and stored only in scrambled (hashed) form; we never see them.
- Google or Microsoft sign-in: if you choose it, we receive only your name and email address. We never ask for access to your emails, files or other accounts.
- Your documents: the photos, scans and PDFs you upload, their file names, and the information Capitax reads from them (for example supplier, date, amounts and items), plus any corrections you make. Comments people write on a document are kept with it, readable by everyone who can see that document, until they are deleted (or the document is).
- Business and firm details: the name, country, currency and timezone of a business, and if you give them, its tax registration numbers (NTN, STRN), registered address, phone, city, industry, website and financial year end; your accounting firm's name and city; the businesses a firm works for; who belongs to each; and the email addresses of people invited to join. We also keep a record of what people do (for example who uploaded, approved, deleted or exported documents, added a client or changed someone's access) to keep accounts safe. A business's owners and admins, and the owners and admins of an accounting firm it works with, can see this record on the Activity page. It shows people's names and file names, never what is inside documents.
- Device and security information: for new-device verification we keep a short label for each trusted device (such as “Chrome · Windows”), when it was added and last used, and security events such as a device being removed. We do not store your IP address ourselves; our hosting and login providers may record it in their own security logs.
- Emails we send you: such as sign-up confirmation, password reset and verification codes.
- Emails sent to a business's Capitax address: the attachments become documents of that business. We keep the sender's address, the subject, when it arrived and what was added; we do not keep the email's text.
2. How we use it
- To create and secure your account, including checking new devices with an emailed code.
- To store your documents, read them and show you the results to check and correct.
- To organise your information and let you export it.
- To send you service emails about your account and security.
- To keep the service working, fix problems and prevent misuse.
We do not sell your information, show you advertising, or use your documents for marketing.
3. How documents are read (AI)
To read a document, Capitax sends a copy of it to an AI reading service, which returns the text and figures it can see. The document is sent only for that purpose. Capitax only reads and organises documents: it does not calculate tax, file returns or give tax or accounting advice. AI can make mistakes, so anything it is unsure about is highlighted for you to check.
4. Businesses and accounting firms
Documents in Capitax belong to a business, not to a single person. The people in that business can see them. If an accounting firm works for a business, the firm's staff who have been given access to that business can also upload and see its documents. A firm never owns a business's data: if the firm stops working for the business, the business keeps its documents and the firm loses access. Owners and admins of a business or firm can see the names and email addresses of its members and of people invited to join. If someone is removed, the documents they uploaded stay with the business.
5. Services that help us run Capitax
We use trusted service providers, who process information only to provide their service to us:
- Supabase: database, file storage and account login.
- Vercel: hosting the website.
- Resend: sending account and security emails, and receiving emails sent to a business's Capitax address.
- AI reading services: reading uploaded documents. Currently accessed through OpenRouter; some documents (for example Urdu or handwritten bills) may also be read by Anthropic's Claude, to read them more accurately.
- Google and Microsoft: only if you choose to sign in with them.
These providers may store or process information on servers outside Pakistan. We may also share information if the law requires it.
6. How we protect your information
- Everything is sent over encrypted connections (HTTPS).
- Documents are kept in private storage. They are never available at a public link, and only people with access to that business can open them, after signing in.
- Signing in on a new device needs a code sent to your email, and you can remove trusted devices at any time in Settings.
- Database rules make sure each person only sees the businesses and firms they belong to, and only the clients they have been given.
No system is perfectly secure, but we work to protect your information and will tell you if a breach affects you.
7. How long we keep it
- Documents and what was read from them are kept until you delete them. Deleting a document removes the file, its readings and the values you checked.
- Your account information is kept while you have an account.
- To close your account and delete all of your information, email support@capitax.org. We will confirm by email once it is done.
8. Your choices and rights
You can view and delete your documents in the app, update your name in Settings, and remove trusted devices. You can also ask us for a copy of your information, to correct it, or to delete your account, by emailing support@capitax.org.
10. Who can use Capitax
Capitax is for businesses and adults. It is not meant for anyone under 18.
11. Changes to this policy
If we change this policy, we will update the date at the top, and for important changes we will let you know by email or in the app. See also our Terms of Service.
12. Contact
Capitax, https://capitax.org. Email: support@capitax.org.