Privacy policy

X is provided by Narayana Global Ventures Private Limited (we, us). This policy explains what personal data we process when businesses and their staff use X, why we process it, and the choices you have.

For questions, write to narayanaglobalventures@gmail.com. For complaints, see the grievance officer page.

A business that uses X decides what to record about its staff. For that staff data, the business is the Data Fiduciary under the Digital Personal Data Protection Act, 2023, and we process the data on its behalf.

For the details of people who create an account with us, such as business owners, we are the Data Fiduciary.

• Account details: name, phone number, email address if you give one, language, and your password, which we store only as a one-way hash.
• Business details: business name, legal name, address, GSTIN, PAN and TAN, branches and work sites.
• Staff records that a business enters: name, phone number, employee code, job details, dates of joining and leaving, personal details such as date of birth and emergency contact, and statutory numbers such as UAN and ESI number.
• Financial details of staff: salary structure, bank account number and PAN. We encrypt bank account numbers and PAN. For Aadhaar we store only the last 4 digits, never the full number.
• Attendance: the time of each punch, and the location the browser reports at that moment, with its accuracy. Leave requests and approvals.
• Photos at punch time, only if a business turns this on. We re-encode each photo and remove its metadata, including any location stored in the file. We do not use face recognition.
• Payroll: payable days, earnings, deductions, payslips and payment records.
• Security data: active sessions with the device type, sign-in time and last activity; IP addresses for security checks; and an activity log of changes.
• Billing: your plan, invoices and GST details. Card and UPI details are handled by our payment provider and are not stored by us.
• Requests you send us through the contact form or by email: your name, phone number, email, business details and message, and the campaign tags in the link you arrived from.

X reads location only when a staff member punches in or out, and only after the browser asks for permission. We do not track location in the background or between punches.

The punch location stays with the attendance record for as long as the business keeps that record.

• To provide X: attendance, leave, payroll calculations, payslips and registers.
• To keep accounts secure: sign-in checks, limits on repeated attempts, and the activity log.
• To send service messages, such as sign-in codes, invites, payslip notices and leave decisions.
• To bill for paid plans and to meet tax and legal duties.
• To answer your questions.

We do not sell personal data. We do not show ads.

Service messages go by email, SMS, WhatsApp or notification, when that channel is set up. Security and sign-in messages are always sent. You can turn off some other notifications in your settings.

We send marketing email only if you agree to it, and every such email has an unsubscribe link.

• People in your business, according to the roles the owner sets.
• Service providers that help us run X: hosting, email, SMS and WhatsApp delivery, and payments. They may use the data only to provide their service to us.
• Government authorities, when the law requires it.

We do not share staff data with advertisers or lenders.

Data is stored on servers that we operate for X. The country where these servers are located will be stated here once it is confirmed.

• HTTPS on every page.
• Bank account numbers and PAN encrypted with AES-256-GCM in our database.
• Passwords stored as a one-way hash.
• Access limited by role; salary fields are hidden from people without permission.
• Web sessions end after 7 days without use, and after 30 days at most.
• An activity log of sensitive changes.
• Encrypted database backups every night.

No system is completely secure. If a breach affects your personal data, we will tell you and the authorities as the law requires.

• Account and business data: while the account is active.
• Attendance, payroll and staff records: as long as the business keeps them. Labour and tax laws may require several years.
• Punch photos: for the period the business sets, 180 days by default, and then deleted.
• Activity log: up to 8 years.
• Backups: kept for up to 6 months, then deleted.

When you ask us to delete an account, we wait 30 days so that you can change your mind, and then delete its data, except what the law requires us to keep. Copies in backups expire on the schedule above.

• Ask for a summary of your personal data and how it is used.
• Ask us to correct or complete it.
• Ask us to erase it, unless the law requires us to keep it.
• Nominate someone to act for you.
• Complain to our grievance officer, and then to the Data Protection Board of India.

If a business added you as staff, write to that business first. We will help it answer your request.

We use only the cookies needed to sign you in and to remember your language. The cookie notice lists them.

X is meant for businesses. People under 18 should not create an account.

We will update the date at the top when this policy changes. For important changes, we will tell account holders by email or in X.

Write to narayanaglobalventures@gmail.com. For complaints, see the grievance officer page.