Privacy policy

Effective 14 October 2026. Last updated 14 October 2026.

1. Two roles we play

• For our own customers and visitors — the people who visit vyomhrm.com, sign up, administer a workspace, or pay our invoices — we decide how their data is used. For this data we are the data fiduciary.
• For the employees, candidates and contractors of our customers, whose records an employer keeps in Vyom HRM, the employer decides what is collected and why. The employer is the data fiduciary and we are its data processor, acting only on its instructions. If you are an employee with a question about your records, please contact your employer first; we will help them answer you.

2. What we collect

From customers and visitors

• Account details: name, work email, phone number, organisation, job title, and sign-in records.
• Billing details: billing name and address, GSTIN, invoices, and the status of payments.
• Support conversations and anything you send us.
• Technical data: IP address, browser and device type, and logs of activity, used to run and secure the service.

Held for customers, in their workspaces

• Identity and contact details, employment history, job and organisation details.
• Payroll and statutory data: salary, deductions, bank account, PAN, UAN, ESI number, Aadhaar where the employer collects it, tax declarations and proofs.
• Attendance, leave, shifts and timesheets, including records from attendance devices.
• Documents, letters and e-signatures, recruitment and onboarding records, performance and expense records.

Payments

When you pay an invoice online you enter your card, UPI or bank details on our payment gateway's secure page (such as Cashfree Payments). The gateway processes them under the PCI-DSS standard. We receive only the result — the amount, the payment reference, the method used and whether it succeeded. We never see or store your full card number, CVV, UPI PIN or net-banking password.

3. Why we use it

• To create and run your account and workspace, and provide the features you use.
• To bill you, collect payments, and keep the accounting and tax records the law requires.
• To keep the service secure: to authenticate users, detect misuse and investigate incidents.
• To answer support requests and send service messages, such as security alerts, invoices and notice of changes.
• To improve the service, using aggregated information that does not identify individuals.
• To comply with the law and respond to lawful requests from authorities.

We process customer and visitor data with your consent, which you give when you sign up or contact us, or where the law otherwise allows it, such as to perform our contract with you or to meet a legal obligation. Workspace data is processed only to provide the service to the employer that controls it. We do not sell personal data, and we do not use workspace data for advertising.

4. Who we share it with

We share personal data only as needed to run the service, with providers bound to protect it:

• Hosting, storage and backup providers.
• Payment gateways and banks, to collect payments and, where an employer turns it on, to pay salaries.
• Email, SMS and WhatsApp delivery providers, for messages the service sends.
• E-signature, identity and bank-account verification providers, where an employer uses those features.
• AI providers, only where an employer turns on an AI feature, and only the data that feature needs.
• Government authorities, regulators or courts, where the law requires it.
• A buyer or successor, if our business is merged or sold, under the same protections as this policy.

Our providers may process data outside India. Where they do, we take steps to ensure it is protected to the standard this policy describes and is not transferred to any country the Government of India restricts.

5. How long we keep it

• Account and support data: while your account is active and for up to 3 years afterwards, to deal with queries and disputes.
• Invoices, payment and tax records: for 8 years, as Indian tax and company law requires.
• Workspace data: for as long as the employer's subscription lasts, then 30 days for export, after which it is deleted from the live service and from backups within a further 90 days — unless the employer deletes it sooner or the law requires us to keep it.
• Security logs: for up to 1 year.

6. How we protect it

Data is encrypted in transit (HTTPS) and sensitive values, such as credentials for connected services, are encrypted at rest. Each customer workspace is held in its own database. Access by our staff is limited to what their role needs and is logged. Users can turn on two-step sign-in. We follow reasonable security practices under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. If a breach affects your personal data we will notify you and the Data Protection Board of India as the law requires.

7. Cookies

Vyom HRM uses only what is needed to keep you signed in and the service secure. We do not use advertising or cross-site tracking cookies, and vyomhrm.com does not load third-party analytics.

8. Your rights

Under the Digital Personal Data Protection Act, 2023 you may:

• ask for a summary of the personal data we hold about you and how it is used;
• ask us to correct, complete, update or erase it;
• withdraw consent you have given, as easily as you gave it — this does not affect what was done before;
• nominate someone to exercise these rights if you die or become unable to;
• raise a grievance with us, and then with the Data Protection Board of India if you are not satisfied.

Email support@keenminds.in to exercise any of these. We may need to verify who you are. For data held in an employer's workspace, we will pass your request to that employer and help them respond.

9. Children

Vyom HRM is a business service and is not meant for children. We do not knowingly collect personal data from anyone under 18 except as an employer's records require (for example, a nominee), and then only on the employer's instruction.

10. Grievance officer

[[TO FILL: grievance officer's name]]
Keenminds Technologies Private Limited, [[TO FILL: registered office address]]
Email support@keenminds.in (subject "Grievance") · Phone [[TO FILL: support phone number]]
We acknowledge grievances within 24 hours and resolve them within 30 days.

11. Changes

We may update this policy. If a change materially affects how we use your personal data we will tell you by email or in the product before it takes effect. The date at the top shows when it last changed.