Privacy Policy

1. Overview & Legal Framework

This Privacy Policy describes the policies and procedures of KriyaLabs Technologies ("KriyaLabs", "we", "our", or "us") regarding the collection, use, disclosure, and protection of information when you access or use our cloud-based HR, GPS attendance, and payroll platform available via kriyalabs.in, our mobile web application, and related APIs.

This document is formulated in compliance with:

• The Digital Personal Data Protection Act, 2023 (DPDP Act) of India.
• The Information Technology Act, 2000 (IT Act) and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules).

2. Inventory of Data Collected & Processed

We collect and process only the minimum information strictly necessary to provide accurate GPS attendance verification and statutory Indian payroll automation:

3. Anti-Surveillance & Employee Privacy Guarantees

KriyaLabs is engineered from the ground up to protect employee personal privacy and prevent workplace surveillance overreach:

• No Webcam or Microphone Snooping: We do not take background camera photos, record audio, or conduct biometric facial harvesting.
• No Keystroke or Screen Surveillance: KriyaLabs does not install background desktop agents, keyloggers, or invasive browser extensions.
• Zero Data Monetization: We never sell, rent, monetize, or trade employee or employer data to advertising networks or third-party data brokers.

4. Lawful Purpose & Use of Personal Data

We process personal data solely for legitimate and lawful employment administration purposes:

• Authenticating users and maintaining secure multi-tenant sessions.
• Verifying physical office attendance via mathematical geofencing.
• Executing monthly salary structures, statutory deductions (PF, ESI, Professional Tax), and LOP calculations.
• Generating confidential PDF payslips exportable by individual employees.
• Delivering system notifications for leave, WFH, and late delay requests.
• Preventing security fraud, denial-of-service attacks, and spoofed check-ins.

5. Third-Party Sub-Processors & Infrastructure

KriyaLabs engages trusted, enterprise-grade cloud sub-processors with SOC 2 Type II, ISO 27001, and PCI-DSS compliance certifications:

6. Data Retention, Portability & Purging

KriyaLabs adheres to strict data minimization and retention policies:

• Active Subscription: Data is retained for the active duration of the Employer's subscription to satisfy statutory Indian tax and labor audit requirements (e.g., 7-year payroll archives).
• Account Cancellation: When an employer cancels their workspace, the account enters a 30-day Grace Period during which administrators can download complete CSV attendance ledgers and payslip archives.
• Permanent Deletion: After 30 days of cancellation, all employer data, employee records, and punch telemetry are permanently and irrevocably purged from active production databases and backup cycles.

7. Technical & Organizational Security Measures

We implement comprehensive security controls to protect Sensitive Personal Data:

• Visual Sensitive Data Masking: Bank account numbers and PAN cards are masked by default on all screens (e.g., XXXX XX78 90). Base salary numbers require intentional eye-icon toggling to reveal.
• Encryption in Transit: All web traffic is strictly forced over HTTPS using modern TLS 1.3 protocols with HSTS (HTTP Strict Transport Security).
• Encryption at Rest: All database volumes, backups, and confidential records are encrypted using AES-256.
• Salted Password Hashing: User credentials are protected using salted, multi-round bcrypt cryptographic hashing. Cleartext passwords are never stored.
• Role-Based Access Control (RBAC): Strict permission walls ensure employees can only view their own records, while financial controls are restricted to verified CEO/Admin roles.

8. Employee Rights Under India's DPDP Act, 2023

Employees whose data is processed by KriyaLabs on behalf of an Employer hold explicit statutory rights under the DPDP Act:

• Right to Access: The right to obtain a summary of personal data being processed and the processing activities undertaken.
• Right to Correction & Updation: The right to request the correction of inaccurate or incomplete personal data via their profile editor or employer administrator.
• Right to Erasure: The right to request the deletion of personal data when the employment relationship has concluded and statutory retention mandates have elapsed.
• Right of Grievance Redressal: The right to have data protection queries or complaints resolved within the statutory timeline.
• Right to Nominate: The right to nominate an individual to exercise data rights in the event of death or incapacity.

9. Grievance Redressal Officer & Contact

In accordance with the DPDP Act 2023 and the Information Technology Act 2000, KriyaLabs has appointed a designated Grievance Officer to address data privacy inquiries, complaints, or subject access requests: