Privacy policy
This policy describes what TaxGuide.pk actually does with information. It is not a legal opinion. At the date of this policy, Pakistan has no single personal-data statute in force. The policy follows the Constitution, the cybercrime law that is in force, and the care a private site ought to take with the few details people send.
Calculators run without an account. The figures you type are sent so the server can calculate tax. They are not stored with the result unless you submit a correction report and tick the option to include those figures.
Who this policy covers
This policy covers the public website, the contact form, correction reports, and any API that uses the same engine. It covers visitors in Pakistan and visitors elsewhere who use the site.
It does not cover an official FBR system, Iris, a bank, an employer payroll system, or a third-party site you open from a link. Those services have their own terms and their own duties under Pakistani law.
The operator named on the About page is the person responsible for the information this site stores. There is no separate data-protection company behind the calculator.
The legal setting in Pakistan
The Constitution of the Islamic Republic of Pakistan, 1973, recognises dignity and privacy. Article 14 says that the dignity of man and, subject to law, the privacy of home, shall be inviolable. Article 4 says that every person shall be dealt with in accordance with law. Article 19A gives a right of access to information held by public bodies. That right is against the state. It is one reason this site cites official documents. It is not a right to demand the private notes of the operator.
The Prevention of Electronic Crimes Act, 2016, as amended by the Prevention of Electronic Crimes (Amendment) Act, 2025, is a criminal statute. It penalises, among other conduct, unauthorised access to an information system or data, interference with data, electronic fraud, and the unauthorised use of identity information. It is not a general privacy code. It does not create a data-protection commission for ordinary websites.
The Ministry of Information Technology and Telecommunication has circulated drafts of a Personal Data Protection Bill, including a text discussed in 2023. As at 23 September 2026 that Bill has not been passed into law. No National Commission for Personal Data Protection is in office under such an Act. If Parliament enacts a personal-data law, this policy will be revised to meet it. Until then, this policy is a commitment of the operator, not a claim that a statutory privacy code already binds every private website in the same way.
The Electronic Transactions Ordinance, 2002, gives legal recognition to certain electronic records and signatures. A calculation on this site is not an electronic filing, an electronic contract with FBR, or a signature on a return.
A particular request may also be governed by an order of a court of Pakistan, a lawful direction to preserve or disclose data, or the tax statutes named in the Terms of use. This policy does not weaken a duty those laws impose, and it does not invent a duty they do not impose.
Information you provide
Contact form. If you write to us, we store your name, email address, topic, and message, so the note can be read and answered. The form does not ask for a national identity card number, an NTN, or a bank account.
Correction report. If you report a calculation, we store the message, the calculator name, the tax year, the rule version if the page sent one, the page address, and the time. The numbers you entered are stored only if you tick the option to include them. If you do not tick it, those numbers are not written into the report.
Anything you type in a free-text box is stored with that message. Do not type a secret, a password, or an identity number in that box.
Information collected automatically
An ordinary calculation is processed so a result can be returned to your browser. The tax engine does not create an account and does not add your salary to a customer record.
The host, the web server, or a security tool may keep a technical log of requests. A log of that kind can include the IP address, the date and time, the address of the page, a status code, and the browser type. Those logs exist for security, abuse prevention, and keeping the site available. They are not a tax file and they are not sent to FBR.
The admin area keeps an audit record of editorial actions, such as a change to a rule set. That record can include the administrator account, the action, and a technical address. It supports the editorial control described on the About page. It is not a record of public calculations.
If an API key is issued in future, the service may log the key prefix, the endpoint, the time, the status code, and the duration. It is not designed to store the salary sent in the request. API terms, when published, will say if any exception exists.
Cookies, local storage, and similar tools
The public site sets a session cookie and a security cookie so a form can be submitted by you and not by another website. They are not an advertising profile. You do not need an account to use a calculator. Admin sign-in uses a session cookie of its own, and that session is not given to public visitors.
Your language choice, English or Urdu, is stored in local storage in this browser. It is not sent as a separate profile. Choosing Urdu also opens the Urdu address of the page.
If Google Analytics or Google Tag Manager is switched on in site settings, Google may set its own cookies and receive the fact that a page was opened, a general location derived from the IP address, and device information. Calculator inputs are not added to that analytics event. Salary amounts are not sent to analytics.
If Google AdSense is switched on, Google may use cookies to measure or select ads under the policy Google publishes. AdSense stays off unless an administrator enables it.
Pakistan does not currently require a European-style cookie banner, and this site does not pretend that one is legally mandatory. You can block or delete cookies in the browser. Blocking the session cookie may stop the contact form and the correction report from working. Blocking Google cookies limits analytics and ads. It does not stop the calculation itself.
Information we ask you not to send
Identity information is sensitive. Misuse of identity information can be an offence under the Prevention of Electronic Crimes Act, 2016. This site does not need identity documents to calculate tax. Do not send:
- A CNIC, NICOP, SNIC, or passport number.
- An NTN, STRN, or other tax registration number.
- A bank account, card, or wallet number.
- A password, a one-time code, or an Iris credential.
- Biometric data, a photograph of an identity document, or a medical record.
- Personal data of another person, unless you have a clear right to send it and the message cannot be understood without it.
Why information is used
Stored or processed information is used only for the following purposes:
- To calculate the estimate you asked for.
- To read and answer a message or a correction report.
- To correct a rule set when a report shows an error.
- To keep the site secure, to limit abuse, and to diagnose faults.
- To remember the language you chose on this browser.
- To understand which pages are used, if analytics is on, without sending salary figures to analytics.
- To show an advertisement, if advertising is on.
- To comply with a lawful order, or to establish or defend a legal claim.
Who receives information
We do not sell personal information. We do not use calculator inputs to build a marketing list.
The operator and the people who administer the site can read stored messages and reports. A hosting provider or an email provider may process technical data because that is how the site is served. They do so for the operation of the site. They are not your tax adviser.
If analytics or advertising is enabled, Google receives the technical information described above. Those services can process data outside Pakistan under their own terms.
We may disclose information if a court of Pakistan, the Federal Investigation Agency, or another authority with legal power requires it, including under the Prevention of Electronic Crimes Act, 2016. We may also disclose information where it is reasonably necessary to prevent abuse of the site or to reduce a risk of harm. We do not volunteer visitor calculations to the Federal Board of Revenue.
Information outside Pakistan
The site is aimed at users in Pakistan. The servers, the email path, or a Google service may nevertheless be located outside Pakistan. That is a consequence of using a public website and of any analytics or advertising that is switched on.
Until a Pakistani personal-data law sets rules for cross-border transfers, the practical limit we apply is this: salary figures are not placed in analytics, and they are stored only inside a correction report that you chose to attach.
How long information is kept
Contact messages and correction reports are kept while they are open and for up to 24 months after the last action on them. A longer period is used only where it is needed for a legal claim, a dispute, or a lawful request to preserve the record.
Calculator inputs inside a report are deleted when the report is deleted, or sooner if you ask and we do not need them to check a live correction.
Technical logs follow the period set by the host or the security tool. That period is normally shorter than 24 months. Editorial audit records may be kept for as long as the history of a rule set is kept, because they show who published a rate.
Language choice stays in your browser until you clear site data. Session cookies expire under ordinary browser and server rules.
Security
Access to stored messages, reports, and the admin area is limited to authorised administrators. Admin sign-in uses a session. Public visitors are not given that session.
The production site is expected to be served over HTTPS. No method of transmission or storage is perfectly secure. Please do not send identity documents or tax registration numbers to this site.
We may delete a message that contains identity information we asked you not to send. If you sent it by mistake, ask us to delete it. Deletion from the live store does not always erase a backup or a log at the same moment.
Children
The site is written for adults who have tax questions. Under the Majority Act, 1875, a person domiciled in Pakistan ordinarily attains majority at 18 years of age.
We do not knowingly collect personal information from a child. The calculators do not ask for a name. If you believe a child has sent a contact message, write to us and ask for that message to be deleted.
Requests you can make
You may ask what contact messages or reports we hold that are tied to your email address, or to a description you can show is yours. You may ask for a correction or for deletion of that material.
We will answer within a reasonable time. We may ask you to show that the email address is yours. We may refuse a request that would disclose the data of another person, that would break a legal duty to keep a record, or that we cannot match to a stored message.
You may withdraw the choice to include calculator numbers by asking for those stored inputs to be deleted. Withdrawal does not undo a calculation that was only processed and never stored.
There is no fee for a reasonable request. A request that is repeated in order to disrupt the site may be refused. These requests are a practice of the operator. They are not, today, an order of a personal-data commission, because no such commission is in office under an enacted Act.
Complaints and legal remedies
Start with the contact page so a privacy problem can be fixed directly.
If a statute later creates a personal-data authority, you may have a complaint route to that body from the date the statute says. No such authority is in office under an enacted personal-data Act at the date of this policy.
A complaint about criminal misuse of data, such as unauthorised access to an information system, may be made through the procedure in the Prevention of Electronic Crimes Act, 2016, including to the National Cyber Crime Investigation Agency or the Federal Investigation Agency, as the law in force provides.
A civil claim, where the law gives one, is for the courts of Pakistan. This policy does not create a new cause of action, and it does not remove a remedy the law already gives you.
Changes to this policy
We may update this policy when the site changes or when the law changes. The date at the top will change, and the new text applies from the date it is published on this page.
A change does not authorise a new use of an old stored message for a purpose this policy did not allow, unless the law requires that use. Continued use of the site after publication is how you can read the policy that is current.
How to contact us about privacy
Write through the contact page and choose a clear subject, such as a privacy request. If an email address is published in the footer, you may use that address as well. Do not include a CNIC, NTN, or bank number in the message.