Privacy Policy
We believe privacy is a fundamental right. This policy explains what data we collect, how we use it, and the robust measures we take to protect it.
Overview
yourHRM ("we", "our", or "us") operates the yourHRM multi-tenant HR and payroll SaaS platform. This Privacy Policy informs you of our policies regarding the collection, use, and disclosure of personal data when you use our Service and the choices you have associated with that data.
We are committed to protecting the privacy of every individual whose data is processed on our platform. Our multi-tenant architecture is built with privacy-by-design principles — each organization's data is physically isolated and inaccessible to other tenants.
Data We Collect
We collect different types of information depending on how you interact with the platform:
| Category | Examples | Purpose |
|---|---|---|
| Identity Data | Name, email, phone, employee ID | Account creation & authentication |
| Employment Data | Designation, department, salary, joining date | HR management & payroll processing |
| Financial Data | Bank account, PAN, UAN, PF details | Payroll disbursement & statutory compliance |
| Usage Data | IP address, browser type, pages visited | Analytics, security & service improvement |
| Location Data | GPS coordinates (for geo-fenced attendance) | Attendance verification via geo-fencing |
| Documents | Aadhaar, offer letters, uploaded files | Encrypted document vault storage |
How We Use Your Data
Your personal data is processed for the following purposes:
- Service Delivery — to provide, maintain, and improve the HR and payroll platform functionality you subscribed to.
- Statutory Compliance — to calculate and file PF, ESI, Professional Tax, TDS, and other regulatory obligations.
- Communication — to send important service notifications, onboarding emails, and (with consent) product updates.
- Security — to detect, prevent, and address fraud, abuse, and technical issues including unauthorized access attempts.
- Analytics — to analyse aggregated, anonymized usage patterns for platform improvement (never individual tenant data).
Data Storage & Security
We take the security of your data seriously and implement multiple layers of protection:
- Database Isolation — each tenant's data resides in a completely separate database with no cross-tenant query capability.
- Encryption at Rest — all sensitive employee data and uploaded documents are encrypted using AES-256 encryption.
- Encryption in Transit — all communication between your browser and our servers uses TLS 1.3.
- Access Controls — role-based access ensures users only see data they are authorized to access.
- Audit Logging — all administrative actions are logged with timestamps, user identity, and IP address.
While we implement commercially reasonable security measures, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security but we are committed to continuous improvement.
Data Sharing & Third Parties
We do not sell, rent, or trade your personal data. We may share your information only in the following limited circumstances:
- Payment Processing — with Razorpay for secure subscription payment handling (they receive only transaction-necessary data).
- Legal Obligations — when required to comply with applicable law, regulation, legal process, or government request.
- Service Providers — with trusted partners who assist in operating our platform (e.g., cloud hosting), bound by strict data processing agreements.
- Business Transfers — in the event of a merger, acquisition, or asset sale, user data may be transferred with prior notice.
Cookies & Tracking
We use cookies and similar technologies to maintain your session, remember preferences, and understand usage patterns. The cookies we use include:
- Essential Cookies — required for authentication, CSRF protection, and core functionality. These cannot be disabled.
- Preference Cookies — remember your settings like theme, language, and dashboard layout.
- Analytics Cookies — collect anonymized usage data to help us improve the platform (you may opt out).
We do not use advertising or cross-site tracking cookies.
Your Rights
Depending on your jurisdiction, you may have the following rights regarding your personal data:
- Right to Access — request a copy of the personal data we hold about you.
- Right to Rectification — request correction of inaccurate or incomplete data.
- Right to Erasure — request deletion of your personal data (subject to legal retention obligations).
- Right to Portability — receive your data in a structured, machine-readable format (CSV/Excel export).
- Right to Object — object to certain types of processing, including direct marketing.
- Right to Withdraw Consent — withdraw previously given consent at any time without affecting prior processing.
To exercise any of these rights, contact us at our contact page. We will respond within 30 days.
Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected:
- Active Accounts — data is retained for the duration of your subscription.
- After Cancellation — data is retained for 30 days to allow for reactivation or export, then permanently deleted.
- Legal Requirements — certain financial and payroll records may be retained for up to 8 years as required by Indian tax and labour law.
- Audit Logs — administrative action logs are retained for 12 months for security purposes.
Children's Privacy
Our Service is not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child without parental consent, we will take steps to delete that information promptly.
Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy on this page and updating the "Last Updated" date at the top. For significant changes, we will provide a more prominent notice (such as an in-app notification or email).
We encourage you to review this Privacy Policy periodically for any changes. Changes are effective when they are posted on this page.
Questions about your privacy?
Our Data Protection team is available to address any questions or concerns about how we handle your data.