Legal compliance

Privacy policy

At Annapurna HR, we are committed to protecting your privacy and ensuring that your personal and organizational data is handled securely and responsibly.

Effective date: 18 May 2026

On this page

Introduction
1. Information we collect
2. How we use your information
3. Data storage & retention
4. Data security
5. Sharing of information
6. Compliance & user rights
7. Children's privacy
8. Changes to this privacy policy
9. Contact & support

Effective date: 18 May 2026
Last updated: 18 May 2026
Version: v1.0
App name: Annapurna HR
Platform: Android & iOS
Developed by: Ramyoz Developer
Support email: support@annapurnahr.com
Web portal: annapurnahr.com

Introduction

Ramyoz Developer ("we," "us," or "our") develops and operates the Annapurna HR HRMS mobile application and its associated backend systems (the "Service"). Annapurna HR HRMS is an enterprise Human Resource Management System that helps organisations manage attendance, leave, payroll, reimbursements, offboarding, and employee profiles.

This Privacy Policy describes exactly what data the App collects, why it collects it, how it is stored and secured, and what rights you have over it. By using the App, you agree to the practices described here.

B2B enterprise application notice

Important: Annapurna HR HRMS is a B2B enterprise application. Your employer is the data controller — they determine how your data is used within their organisation. Ramyoz Developer acts solely as a data processor on their behalf.

1.Information we collect

We collect personal data in two ways: data you provide directly when interacting with the App, and data collected automatically by the Service.

1A. Information provided directly by you

Identity & profile

Full legal name (first name and last name)
Work email address and system username
Unique Employee Code
Corporate designation, role hierarchy, and department
Employment status (Active, Onboarding, Inactive, Exited) and joining status
Date of Birth and Gender
Permanent or temporary residential address (Line 1, City, State, Pincode)
Universal Account Number (UAN) for statutory PF/pension records
Profile picture uploaded by you

Leave & attendance requests

Custom reasons for leave applications
Proposed time-off dates and half-day toggles

Financial & reimbursement claims

Date of transaction, claim category (e.g. travel, medical, client meetings)
Numeric claim amount and written remarks
Supporting receipt attachments (PDF, JPEG, JPG, PNG)

Offboarding & resignation

Formally submitted reason for resignation
Proposed last working day / exit timeline
Feedback comments submitted during exit flow

KYC & onboarding documents

Aadhaar card, PAN card, bank passbook
Degree and educational certificates
Previous employment experience letters
Note: All uploads are used solely for employer-side KYC verification and onboarding compliance

1B. Information collected automatically

Network & location verification

During daily attendance check-ins, the Service captures your public IP address to verify that you are connecting from an approved office network (whitelisted IP policy configured by your employer). This is not GPS location tracking.

No continuous GPS tracking

The App does NOT continuously track your physical GPS location. If your employer enables selfie-based attendance, the camera is used only at the moment of check-in.

Device & audit metadata

Hardware device identifier, OS version, and device model
User-agent string for security and compatibility checks
Timestamps of key actions: logins, check-ins, document uploads, approvals
Crash logs and app performance data for debugging (non-personal, anonymised)

2.How we use your information

We process personal and sensitive data strictly for the following business-critical operations. We do not use your data for advertising, profiling, or any purpose outside employment management.

2.1Attendance tracking & security

Check-in recording: Calculates shift compliance — identifying Present, Half-Day, and Absent statuses.
Network security: Cross-checks your public IP against your employer's whitelisted office network IP via backend/GCS verification.
Audit trails: Tamper-resistant logs of all attendance actions identifying the user, device, and network origin.

2.2Payroll & reimbursement processing

Salary calculation: Computes monthly pay, tax deductions, and PF contributions using attendance records, UAN, and employment details.
Payslip delivery: Generates and delivers digital payslip PDFs securely to each employee.
Expense workflow: Processes and audits reimbursement claims through manager and finance approval workflows.

2.3Organisational management

Hierarchy: Establishes team reporting relationships and manager/employee access privileges.
Team visibility: Displays leave and exit status to authorised colleagues within the same organisation only.

2.4Offboarding

Exit workflow: Manages resignation submission, manager review, department clearances (HR / IT / Finance), and full and final settlement calculations.
Document generation: Produces experience letters, relieving letters, and FNF statements upon offboarding completion.

2.5App stability & performance

Crash monitoring: Anonymised error logs and stack traces to fix bugs and prevent blank UI states.
Offline support: Local caching of non-sensitive summaries (recent attendance, leave balances, payslip metadata) to enable offline usage.

3.Data storage & retention

3.1 Local device storage (SWR cache)

To ensure maximum responsiveness and offline capability, the App caches the following data locally on your device using AsyncStorage:

Basic profile summaries (name, designation, department)
Recent attendance cards and calendar states
Pending leave records and leave balance figures
Payslip metadata (month, net salary, status — not full PDF content)
Reimbursement claim summaries

Local cache notice

No complete PDF files (payslips, letters) are permanently stored in local cache. Complete documents are downloaded to your device storage only when you explicitly tap the Download button.

3.2 Cloud infrastructure

All primary databases, server instances, and uploaded attachments are hosted on secure enterprise cloud servers (GCP). Attachment uploads use Google Cloud Platform (GCP) Cloud Storage.

3.3 Secure file upload — double-handshake process

To ensure zero client-side credential exposure, all file uploads follow this three-step double-handshake process:

Signed URL request
The App requests a short-lived, single-use GCP Signed Upload URL from the backend server.
Direct encrypted upload
Your file is PUT directly from your device to the private GCS bucket via the secure signed URL — credentials never touch the App.
Reference registration
A storage path reference is registered in the backend database. Files are never stored on public or unauthorised media.

3.4 Retention periods

Data retention is governed by your employer's operational requirements and applicable labour legislation. The following are standard minimum retention periods:

Retention periods
Data category	Retention period	Legal basis
Attendance records	Employment + 7 years	Labour law compliance
Payroll & payslips	Employment + 8 years	Income Tax Act
Leave records	Employment + 5 years	Statutory compliance
KYC / onboarding documents	Employment + 5 years	PF / ESIC / IT requirements
Expense claims	Employment + 7 years	GST and accounting compliance
Offboarding records	10 years post-exit	Legal and statutory requirements
Crash logs & app metadata	90 days	Debugging and support
AsyncStorage cache	Until app uninstall or logout	Offline functionality

Upon account deactivation or on written instruction from your employer's HR administrator, specified records will be permanently erased from our systems.

4.Data security

We employ state-of-the-art, multi-layered security measures to protect all corporate and employee data.

4.1 Hardware-backed token encryption

Authentication tokens (JWT) and session keys are stored using Expo's SecureStore API: iOS Apple Keychain Services and Android Keystore system. This protects active sessions against unauthorised extraction and side-channel attacks. Sensitive data is never stored in plain AsyncStorage.

4.2 Transport layer security

All communication between the App and backend is encrypted using HTTPS (TLS 1.2 / TLS 1.3). No unencrypted HTTP connections are permitted — all API calls are HTTPS-enforced. GCP Signed URLs for file transfers use time-limited, single-use cryptographic tokens.

4.3 Protected API architecture

Every server-side endpoint requires a cryptographically signed Bearer Token. Multi-tenant architecture: database queries are isolated at the company level — cross-organisation data access is structurally impossible. Role-based access control restricts employees to their own data.

4.4 Network auditing

All sensitive actions generate tamper-resistant audit log entries in the database recording: The acting user (employee ID), The device (model, OS, user-agent), The network origin (IP address), and The timestamp and action type.

4.5 Incident response policy

In the event of a confirmed data breach, we will notify affected parties and relevant authorities within 72 hours of becoming aware of the incident, in accordance with India's DPDP Act 2023 and applicable data protection laws.

Zero-sharing commitment — We never sell your data.

5.1 What we never do

We never sell, rent, trade, or monetise personal data.
We do not integrate third-party advertising SDKs or cross-app tracking tags.
We do not share data with any party unrelated to your employment or the operation of the Service.

5.2 Authorised sharing within your organisation

HR Administrators & Company Executives: Authorised staff within your registered organisation, bound by employment confidentiality agreements.
Reporting Managers: To review, approve, or reject leave applications, reimbursement claims, and offboarding workflows.

5.3 Infrastructure service providers

We share data only with trusted cloud and infrastructure partners who are contractually bound to maintain strict security compliance:

Infrastructure service providers
Service	Provider	Purpose
Cloud hosting & database	Google Cloud Platform (GCP)	Secure data storage and server infrastructure
File storage	Google Cloud Storage (GCS)	Storing uploaded documents via signed URL uploads

5.4 Legal compliance

We may disclose information if required by a binding legal authority, subpoena, court order, or to protect the safety and rights of our users and the organisation.

6.Compliance & user rights

This policy is aligned with corporate labour regulations and applicable privacy frameworks including India's Digital Personal Data Protection (DPDP) Act 2023, GDPR, and CCPA.

6.1 Rights available in-app

View: Access your complete profile, payroll history, leave records, attendance calendar, and reimbursement claims directly in the App at any time.
Download: Download payslips, offer letters, appointment letters, and experience letters as PDFs from within the App.

6.2 Rights requiring HR coordination

Because your employer is the data controller, the following requests must be initiated through your organisation's HR department:

Correction of core profile attributes (UAN, designation, department)
Deletion or anonymisation of your corporate account data
Export of your complete personal data in machine-readable format

Upon receiving official authorisation from your employer, we will action the request within 30 days.

6.3 Consent withdrawal

You may withdraw consent for optional data processing (such as push notifications) at any time through your device Settings or within the App's notification preferences. Withdrawal of consent for core employment data may affect the App's ability to deliver payroll, attendance, and leave management services.

7.Children's privacy

Annapurna HR HRMS is an enterprise application intended exclusively for use by employees in a professional workplace context. The App is not directed at individuals under 18 years of age. We do not knowingly collect personal information from minors. If you believe a minor's data has been entered into the system in error, please contact support@annapurnahr.com immediately.

8.Changes to this privacy policy

This policy is maintained and periodically updated to reflect platform feature changes and regulatory updates. When we make material changes:

The "Last Updated" date at the top of this document will be revised.
Employees will be notified via in-app announcement or email.
Continued use of the App after the effective date constitutes acceptance.

HR administrators should check the corporate compliance dashboard for custom organisation-level data processing agreements.

9.Contact & support

For privacy inquiries, data requests, or security concerns, contact us through the following channels:

Developer: Ramyoz Developer
Support email: support@annapurnahr.com
Web portal: https://hr.atu.a-sign.in
Response time: We aim to respond to all privacy requests within 30 days
Governing law: Republic of India — DPDP Act 2023 & IT Act 2000

DPDP Act 2023 redressal

India Compliance: You may raise a grievance with us in the first instance. If not resolved to your satisfaction, you may approach the Data Protection Board of India.

Ramyoz Developer