Privacy Policy

1. Who we are, and our role

This policy is written with India's Digital Personal Data Protection Act, 2023 (the "DPDP Act") in mind, and to stay compatible with the Act and the rules under it as they apply to us. It covers personal data handled through the BlueOneHR website, the sign-up and billing systems, and customer workspaces. It makes no claim of any certification or audit.

The party responsible is VIJAY HARISHCHAND CHAURASIA, who provides BlueOneHR under the brand BlueOneHR by तंत्र Stack, of 1501, Paradise Heights, MHADA Complex, Chikuwadi, Borivali West, Mumbai 400092, Maharashtra, India ("we", "us" or "our"). Our role depends on the data:

• Website, sign-up, billing and portal data. We decide why and how it is used. We are the data fiduciary (the "controller") for it.
• Data in a customer's workspace. The customer, usually your employer, decides what is entered and why. The customer is the data fiduciary and we are its data processor, acting on its instructions. If you are an employee and want to know how your employer uses your data, ask your employer. We will help your employer to answer you.

You can reach us through WhatsApp support or at support@blueonehr.com. Requests are dealt with in section 8, and grievances in section 13.

2. This website, cookies and analytics

The pages of this website use a page-view analytics script that we host ourselves. It is self-hosted and first-party: no third party is involved, it is never used for advertising, it does not track you across other websites, it sets no cookies, and it stores no personal data. It records only aggregate, anonymous details of a visit, such as the page you viewed, the page you arrived from, your browser, operating system, screen size and country, and whether you used one of a small set of pre-named buttons or links, such as "Start free trial" or "See the demo". Its only other scripts open the mobile menu and reveal content as you scroll.

The web server that serves the site keeps an access log of each request: the method, the path, the status, the client address and the duration. The log is kept in size-limited rotating files, so older entries are overwritten. We use it to keep the site running, to find faults and to protect it from abuse.

The sign-up, billing and workspace applications, which you reach from links on this website, use session and CSRF cookies. They keep you signed in and protect forms. A workspace can also include a page-view analytics script that we host ourselves, if it is switched on for that deployment. It is not a third-party analytics service. Links from this website to other sites leave this policy: those sites have their own.

3. Sign-up, account and billing data

When you start a trial we collect your e-mail address, your name, your organisation's name and your country. We also record the network address from which sign-up started and the time at which you accepted the terms and this policy. The verification code we e-mail you is stored only in a hashed form. The organisation we create uses your sign-up address as its primary contact.

The billing account can hold a billing e-mail address, a billing address, a GST number, a place of supply and a purchase order reference. An issued invoice keeps a copy of the seller and buyer details as they were when it was issued, and cannot be edited.

You sign in to the billing portal with a link sent to your e-mail address. We store a hashed form of the link, its expiry and the network address of the request.

For payments we keep a reference, the provider's identifiers, the amount, the currency, the status, any refunded amount and any failure reason, together with the full record of each event the payment provider reports to us. We do not store the payment details you enter with the provider.

We send verification codes, sign-in links, workspace activation links, invoices, payment receipts and service notices by e-mail. Our application log records the subject and the recipient of the e-mails we send. If you write to us by e-mail or WhatsApp, we keep what you send so that we can answer you.

The DPDP Act allows personal data to be handled with the person's consent, or for certain legitimate uses that it lists. The table gives the basis in plain terms. You can withdraw consent at any time by writing to us (section 8). Withdrawing it does not affect what was done before, and it can mean we can no longer provide the service to you. We do not sell personal data.

Staff with an operator role can read these records in our console. Every operator page requires a role. A customer can see only its own organisation's records in the billing portal.

4. Customer workspaces

A customer's employee data lives in that customer's own workspace, in its own database and media storage. Our sign-up and billing systems do not hold employee records.

They do read summary figures from a workspace: the number of active employees (which sets the customer's Fees), employee counts by department, and usage figures such as the number of people present today, pending leave requests, modules used and daily sign-in counts. These are counts. They do not name employees.

The customer decides which modules to use and what to enter. Depending on the modules in use, a workspace can hold:

• Employee records: name, e-mail address, phone number, address, date of birth, gender, marital status, qualifications, emergency contact, badge number and a profile photograph.
• Identity and KYC details: PAN, Aadhaar, UAN, ESI number, health details, health insurance, nominee, driving licence and passport details.
• Bank details: bank name, account number and branch.
• Payroll: contracts, allowances, deductions, payslips, loans and reimbursements.
• Attendance: clock-in and clock-out times and, for biometric devices, punch records that include the badge number.
• Location: the coordinates and address of a geo-fenced clock-in or clock-out and of a site visit.
• Photographs: attendance photographs, site-visit photographs and face-enrolment images.
• Documents: HR letters, signatures, uploaded documents and resumes.

We handle this data to provide the service to the customer, and for no other purpose of our own, apart from the summary figures above. The customer is responsible for having a lawful ground to collect and use it, and for giving its employees the notice the law requires, including about location and photographs where it uses those features.

People with roles inside a workspace can read its data, as the customer has set those roles. Staff who operate our hosting infrastructure have technical access to the systems on which workspaces run. Our staff access workspace data only when that is needed to provide the service, to give support that the customer has asked for, to keep the systems secure, or because the law requires it.

Aadhaar numbers are stored in encrypted form and are shown masked, with only the last four digits visible. Section 9 describes the other measures that protect workspace data.

5. Service providers and processors

These are the third parties that our platform is built to call. Each handles data under its own terms and privacy policy, and only as the table describes.

Each workspace also sends its own e-mail, for example HR letters and notifications, through the mail service that is configured for that workspace.

Two optional features use an engine that runs outside the workspace's own application. AI Insights and Mitra's answers use a language model engine, and Mitra's optional spoken briefings use a speech engine. The text they send is drawn from the workspace. The address of each engine is a setting of the deployment, and the product has no built-in default provider. Which engine, if any, is in use for your workspace is something you can ask us.

A customer can also connect its own systems, such as Snipe-IT, LDAP, Microsoft Outlook mail or its own Google Drive. Data sent to them goes to services the customer controls.

We can change this list. If a change materially affects the personal data of a customer's employees, we will tell the customer, as the Terms of Service describe for changes. We can also disclose personal data where the law, a court or an authority requires it.

6. Where data is stored, transfers and backups

Our production platform, including the sign-up and billing systems and the customer workspaces, runs on Google Cloud in region asia-south1. The sign-up and billing database is backed up every day to a Google Cloud Storage bucket. The server's data disk, which holds the workspaces' databases and files, has a daily disk snapshot. Older copies expire. A record deleted from a live system can remain in backups until they expire.

Some of the third parties in section 5, such as Google for sign-in and push notifications, can handle data outside India. The DPDP Act allows personal data to be transferred outside India except to countries that the Government of India has restricted.

7. How long we keep data

• Sign-up, account and billing records. We keep them while your organisation has an account with us, and afterwards for as long as we need them for the purposes above or the law requires. Invoice and payment records are kept for as long as accounting and statutory record-keeping laws require.
• Workspace data. It stays in the workspace for as long as the customer's workspace exists. Nothing is deleted automatically at the end of a trial or when a subscription is not renewed, and we set no maximum period for keeping an unconverted workspace. We delete a workspace and its data from our live systems when the customer asks us to (section 8).
• Website access logs. They are kept in size-limited rotating files and overwritten as new entries arrive.
• Backups. Copies in backups expire on their own schedule (section 6). Data deleted from a live system can remain in them until then.

Some records cannot be erased while the law or a legitimate need requires them to be kept. Examples are invoice records and, inside a workspace, payroll and attendance history.

8. Your rights and how to make a request

Under the DPDP Act you have the right to ask for a summary of the personal data we hold about you and how we handle it, to have it corrected, completed or updated, to have it erased, to have your grievance dealt with, and to nominate another person to exercise these rights for you if you die or cannot do so yourself. You can also withdraw consent that you have given.

How to make a request. Write to support@blueonehr.com with "Privacy request" in the subject, or message us through WhatsApp support. Say what you want: a summary, a correction, a copy, or erasure. We check that the request comes from the person it is about, for example by asking you to write from the e-mail address on the account, before we act on it.

We do not have a self-service tool today for access, correction, export or deletion. VIJAY HARISHCHAND CHAURASIA handles these requests personally, by hand. We will answer within a reasonable time, and in any case within the time the law requires.

A request about data in a customer's workspace is dealt with by the customer, who decides that data. If you send it to us, we pass it to the customer. A customer who leaves can ask us for a copy of its data and for the workspace to be deleted, as the Terms of Service describe.

9. Security

These are measures that are in place today.

• Our websites, control panel and workspaces are served over HTTPS. The control panel redirects HTTP to HTTPS and sets HSTS, and marks its session and CSRF cookies as secure. Its session cookie is also HTTP-only.
• Sign-up resume tokens, billing portal links and workspace activation keys are stored hashed, can be used once and expire. The plain value is shown only once.
• A payment notification from Cashfree is accepted only if its signature verifies. An unsigned or wrongly signed one is rejected and recorded.
• Operator pages deny access unless a role allows it, and a customer can reach only its own organisation's records.
• Each workspace runs as its own application process with its own database.
• Aadhaar numbers are stored encrypted and shown masked.

No system is completely secure. This page makes no claim of any security certification or audit.

10. Personal data breaches

If a personal data breach affects personal data that we handle, we will tell the customer concerned without undue delay after we become aware of it. Where the law requires it, we will also tell the Data Protection Board of India and the people affected, or help the customer to do so. We investigate a breach, take steps to contain it, and keep a record of what happened and what we did.

11. Children

The website and the sign-up are for organisations and the adults who act for them. They are not for anyone under 18, and we do not knowingly collect personal data from a person under 18 through them. A customer that puts data about a person under 18 into its workspace is responsible for handling it as the law requires.

12. Changes to this policy

The top of this page shows a version number and the effective date. We can change this policy, including as the DPDP Act and the rules under it come to apply to us. For a change that materially affects how we handle your personal data, we will tell you at least 30 days before it applies, by e-mail to the address on your account or by a notice in the service. Continuing to use the service after that date means you accept the changed policy, except where the law requires us to ask for your consent again, in which case we will ask.

13. Grievances and privacy contact

The person to contact about privacy is VIJAY HARISHCHAND CHAURASIA, who provides the service. If you have a concern or complaint about how we handle your personal data, write to support@blueonehr.com with "Privacy" in the subject, or message us through WhatsApp support. This is our grievance contact. We will respond within a reasonable time, and in any case within the time the law requires. If you are not satisfied, you can complain to the Data Protection Board of India, as the DPDP Act provides, after you have first used this route.

Our address is VIJAY HARISHCHAND CHAURASIA, BlueOneHR by तंत्र Stack, 1501, Paradise Heights, MHADA Complex, Chikuwadi, Borivali West, Mumbai 400092, Maharashtra, India.