Privacy Policy

WeHR is provided by [your registered business name], [registered address]. This policy explains what personal data we handle and how, in line with the Digital Personal Data Protection Act, 2023 and the rules under it.

• Your account with us (the people who sign up and use WeHR, billing contacts, visitors to our website): we decide how this data is used — we are the Data Fiduciary.
• Employees of our customers: your employer decides what is kept about you in WeHR and why — your employer is the Data Fiduciary and we process the data on their behalf. For questions about your employment records, contact your employer first (their privacy contact is shown in WeHR where it applies).

• Account: name, email, mobile number, password (stored only as a one-way hash), sign-in times and the device and network address used.
• Company and billing: legal name, type of business, address, GSTIN, PAN, billing contact, invoices and payments, and the record of who accepted our terms for the business (name, designation, date, device and network address). Card and UPI details are handled by our payment provider; we never see or keep them.
• Employee records entered by our customers: identity and contact details, job details, salary, bank account, PAN, UAN and ESIC numbers, the last 4 digits of Aadhaar, attendance, leave, tax declarations, documents and letters, expense claims and helpdesk messages.
• Records of actions in WeHR (audit logs), kept for security and so customers can see who changed what.
• Enquiries from our website’s “Talk to us” form: name, work email, mobile number, company, number of employees, what you asked about, how and when to contact you, the page or campaign you came from (not your full browsing history) and when you agreed to be contacted.

• To provide WeHR: sign-in, payroll and attendance calculations, documents, alerts and support.
• To answer enquiries: call, message or email you about what you asked, and send your personal sign-up link. We don’t add you to newsletters.
• To bill customers and keep tax records.
• To keep WeHR secure, find and fix problems, and meet legal obligations.

We don’t sell personal data, show advertising, or use customers’ employee data for anything other than providing WeHR to that customer.

Only service providers we need to run WeHR, bound to confidentiality and security:

• Hosting and database: Render (servers in Singapore).
• Encrypted backups: [backup storage provider and region, e.g. Cloudflare R2].
• Email: [email provider, e.g. Zoho Mail / Amazon SES]; WhatsApp alerts (only when a customer turns them on and the employee agrees): Meta WhatsApp Business.
• Payments: Razorpay (for customers paying their WeHR invoices).
• Employee verification (only when a customer uses it and the employee consents): the verification provider shown to the employee in the consent notice.

We also share data when the law requires it (for example a lawful order from a government authority).

WeHR’s servers are in Singapore and backups are kept encrypted with the provider above. Transfers outside India are made only to countries the Government of India has not restricted, under the same protections.

• Customer data: for as long as the customer’s account is open. When a customer closes the account, its data is deleted after a 30-day period (with notice 2 days before); daily backups containing it expire within a further 30 days.
• Logs of access and changes: at least one year, as the law requires.
• Website enquiries: 12 months after our last contact, unless you become a customer. Ask us and we delete your enquiry sooner.
• Our invoices, payment records, customers’ business details and records of who accepted our terms: as long as tax and contract laws require (normally 8 years).

Encrypted connections (HTTPS), each company’s data kept separate in the database, passwords stored as hashes, two-step sign-in for our own team, encrypted daily backups that are test-restored every week, access logs and alerts for errors.

• Get a summary of your personal data and how it is used — employees can download their data from My space → Download my data.
• Ask for incorrect or incomplete data to be corrected or completed, and for data no longer needed to be erased (subject to what the law requires us or your employer to keep).
• Withdraw consent where you gave it (for example, for verification checks or WhatsApp alerts) as easily as you gave it.
• Nominate someone to exercise these rights if you are unable to.
• Have your grievance answered — we reply as soon as we can, and within the time the law allows.

If a personal data breach happens, we inform the affected customers and people, and the Data Protection Board of India, as the law requires.

WeHR is for businesses and their staff. It is not meant for children, and we don’t knowingly collect data about children except as part of an employee’s records entered by their employer (for example, a nominee).

Grievance Officer: [name of your Grievance Officer], [grievance email, e.g. privacy@yourdomain.in], [registered address]. If you are not satisfied with our answer, you may complain to the Data Protection Board of India.

We will update this policy when our practices change and show the date it takes effect at the top.