This policy explains what personal data Tech Lab India handles through HRHelm and the hrhelm.com website, why, and the choices you have. It is written with India's Digital Personal Data Protection Act, 2023 in mind.
1. Two kinds of data
Customer workspace data: the employee records, attendance, leave, payroll and other information that customer companies put into HRHelm. For this data, the customer company decides what is collected and why; we process it only on their instructions, to provide the service.
Our own data: details of people who visit our website, request a demo, register a company or contact us. For this data, Tech Lab India decides how it is used, as described below.
2. What we collect
When you request a demo or register: your name, work email, phone, company name, size, country, state and GSTIN, and your message.
When you pay: invoice and payment records. Card, UPI and bank details are handled by our payment partner Razorpay; we never see or store full card numbers.
When you use the service: sign-in records, IP addresses and an audit log of changes, kept for security.
On the public website: if analytics is turned on, Google Analytics collects anonymous usage statistics. Analytics never runs inside customer workspaces.
In the HRHelm mobile app: when you clock in or out, the app sends your device's location (if you allow it) so your employer can check you are at your workplace, and, if your employer requires it, a selfie taken with the front camera. Both are stored as part of your employer's workspace data, shown only to you, your managers and HR, and selfies are deleted after the retention period your employer sets. Location is read only at the moment you clock in or out, never in the background. Your sign-in token is kept in your device's secure storage. The app has no advertising or third-party analytics.
3. How we use it
To provide and secure the service, review registrations, issue GST invoices and collect payment, reply to enquiries, send service emails (such as confirmations, invoices and password resets), and meet legal and tax obligations. We don't sell personal data or use workspace data for advertising.
4. Who we share it with
Only service providers who help us run HRHelm, under confidentiality obligations: our hosting provider, Razorpay for payments, and email delivery. If a customer turns on the AI assistant, questions are sent to Anthropic using that customer's own API key and agreement. We disclose data to authorities only when the law requires it.
5. Security
Encrypted connections (HTTPS), hashed passwords, encrypted storage of secrets such as API keys, role-based access so people see only what their role allows, and a full audit trail of changes.
6. How long we keep it
Workspace data is kept while the subscription is active and for 30 days after it ends, so the customer can export it, then deleted. Invoices and payment records are kept for as long as tax law requires. Demo requests are kept for up to two years unless you ask us to delete them sooner.
7. Your rights
You can ask to access, correct or delete your personal data, or withdraw consent, by emailing support@hrhelm.com. If you're an employee of one of our customers, please contact your employer first, as they control your workspace data; we'll help them respond.
8. Grievance officer
Questions or complaints about how we handle personal data can be sent to our grievance officer at support@hrhelm.com. We'll acknowledge them within 48 hours and aim to resolve them within 30 days.
9. Changes
We'll post any changes here and update the date above. Significant changes will be emailed to account owners.