Privacy Policy

This Privacy Policy explains how Zodeck Technologies Private Limited ("Zodeck", "we", "us", "our") collects, uses, shares and protects personal data when you visit zodeck.com (the "Website"), use the Zodeck web app or mobile app, or use Zodeck through a connected AI assistant such as Claude (together, the "Services").

Zodeck is an AI Workforce OS. Companies use it to run core HR, attendance and leave, payroll and compliance, performance and growth, recruitment and separation. Because the Services handle employee data, including salary and statutory information, we hold ourselves to a high standard of care. We follow India's Digital Personal Data Protection Act, 2023 and the rules made under it (the "DPDP Act"), the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (the "SPDI Rules"), to the extent applicable.

By using the Website or Services, you acknowledge this Privacy Policy. Please also read our Terms of Service.

1. Who This Policy Covers and Our Role

How we handle your data depends on how you interact with Zodeck:

• Website visitors, prospects and business contacts. When you browse our Website, book a demo, request a free HR Health Check or contact us, Zodeck decides why and how your data is used. We act as the Data Fiduciary.
• Customer account holders. When a company signs up for Zodeck, we collect the details of the admins and billing contacts who manage the account. We act as the Data Fiduciary for this account and billing data.
• Employees, managers and candidates of our Customers. When a company (our "Customer") uses Zodeck to manage its workforce, the Customer decides what employee data is entered and why. The Customer is the Data Fiduciary for that data, and Zodeck processes it on the Customer's behalf as a Data Processor, under our agreement with the Customer ("Customer Data"). If you are an employee of a Customer, please contact your employer first with questions or requests about your HR records. If you contact us, we will forward your request to your employer and help them respond.

2. Summary

• We collect only what we need to run the Services, support Customers and grow our business.
• We do not sell personal data.
• We do not use Customer Data to train our own or any third party's AI models.
• AI features only process the data needed for the specific request a user makes, and record-changing actions need approval by an authorised user.
• Customer Data is stored in India — AWS and protected with encryption, role-based access and audit logs.
• You can ask to access, correct or erase your data, withdraw consent, and raise a grievance with our Grievance Officer (section 15).

3. Personal Data We Collect

3.1 Data you give us directly

• Account and contact details: name, work email, phone number, company name, designation, company size and password (stored in hashed form).
• Demo, HR Health Check and enquiries: details you share through forms, calls, email or WhatsApp, including information about how your company runs HR, payroll and attendance today.
• Billing details: billing name and address, GSTIN, and payment details. Card, UPI and bank payments are processed by our payment partners; we do not store full card numbers.
• Support and feedback: the content of support tickets, chats, calls, survey responses and feedback.
• Job applications to Zodeck: CV, contact details, education and work history, and other details you choose to share.

3.2 Customer Data we process on behalf of Customers

Depending on the modules a Customer uses, Customer Data may include:

• Identity and employment: name, employee ID, photograph, date of birth, gender, contact details, address, emergency contacts, designation, department, reporting manager, location, joining and exit dates, and documents uploaded by the employee or employer.
• Statutory and government identifiers: PAN, Aadhaar (stored in masked form or as otherwise permitted by law), UAN, ESIC number and other identifiers needed for payroll and compliance.
• Payroll and financial: salary structure, earnings and deductions, reimbursements, loans and advances, bank account details for salary credit, tax regime and investment declarations with proofs, and PF, ESI, Professional Tax, TDS and Labour Welfare Fund data.
• Attendance and leave: clock-in and clock-out times, shifts and rosters, overtime, leave applications and balances, and, where the Customer enables it in the mobile app, location at the time of clock-in or clock-out and selfie verification.
• Performance and growth: goals and self-set targets, reviews, feedback, ratings, talent grid placement and learning records.
• Recruitment: candidate profiles, CVs, interview notes and offer details.
• Separation and alumni: resignation details, exit interview responses, full-and-final settlement details and alumni contact details.
• Assets, approvals and audit records: assets issued, approval history and activity logs.

3.3 Data collected automatically

• Device and usage data: IP address, browser and device type, operating system, app version, pages and features used, timestamps, error and crash logs.
• Mobile app permissions: location (only at clock-in or clock-out, when enabled by the employer and allowed on your device), camera (for selfie attendance or document uploads) and notifications. You can change these permissions in your device settings, though some attendance features may stop working.
• Cookies and similar technologies on the Website (see section 8).

3.4 Data from other sources

• Sign-in providers such as Google or Microsoft, if you choose to sign in with them: your name, email address and profile picture.
• Integrations a Customer connects, such as biometric attendance devices, accounting software, calendars or banking systems.
• AI assistants connected to Zodeck (see section 5): the requests you make through them.
• Business sources: publicly available business contact information, event registrations and referrals.

4. How We Use Personal Data

We use personal data to:

• provide, operate and maintain the Services, including processing attendance, leave and payroll as each Customer configures them;
• authenticate users and enforce role-based permissions;
• run the AI features a user invokes (see section 5);
• onboard Customers, migrate their existing HR data and provide customer support;
• send invoices, process payments and maintain accounting records;
• send service messages, such as payslip notifications, approval requests, security alerts and policy updates;
• deliver the free HR Health Check and other services you request;
• send business contacts information about Zodeck, with an option to unsubscribe at any time;
• improve and develop the Services using aggregated or de-identified usage data;
• detect and prevent fraud, abuse and security incidents; and
• comply with law, respond to lawful requests and enforce our Terms.

5. AI Features and AI Assistants

5.1 How AI works in Zodeck

Zodeck lets users find information and take actions in plain language, inside the Zodeck app or through an AI assistant connected using the Model Context Protocol (MCP), such as Claude. Every request is limited by the user's role-based permissions, and any action that changes a record must be approved by an authorised user.

5.2 What we send to AI model providers

• Only what the request needs. If a manager asks for an employee's leave balance, only the data needed to answer that request is processed. We do not send entire databases to AI providers.
• Only when a user asks. AI processing happens when a user makes a request; there is no background AI processing of Customer Data.
• Sensitive identifiers are excluded. We exclude or redact government ID numbers and bank account numbers from AI requests unless they are strictly needed to complete the requested action.
• No training, limited retention. We use AI providers under commercial or API terms that do not allow them to use our data to train their models, and we enable zero or limited data retention where providers offer it.
• Providers we use: Claude.

5.3 Using Zodeck through your own AI assistant

If a Customer enables it, users can connect Zodeck to an AI assistant account such as Claude, ChatGPT or Microsoft Copilot. The answers Zodeck returns are displayed in that assistant and are handled under the agreement between the user (or their organisation) and that assistant's provider. Customers decide whether to enable this feature and for which roles. We recommend using business or enterprise plans of AI assistants for work data.

5.4 Human control

AI in Zodeck does not make final employment decisions, such as hiring, termination, pay or performance ratings, on its own. AI outputs can be inaccurate, so users should review them before acting.

6. How We Share Personal Data

We share personal data only as described below, and we require recipients to protect it.

• Within the Customer's organisation, according to the roles and permissions the Customer sets up.
• Service providers that help us run the Services, such as cloud hosting AWS India, email, SMS and WhatsApp messaging, payment processing via Razorpay, analytics, customer support tools and AI model providers. They may use the data only to provide services to us and are bound by confidentiality and data protection obligations.
• At the Customer's direction, for example salary transfer files to banks, statutory filings on EPFO, ESIC or tax portals, and data shared with insurers, auditors, chartered accountants or integrations the Customer connects.
• For legal reasons, when required by law, court order or a lawful request from a government authority, or to protect the rights, safety and property of Zodeck, our Customers or others.
• In a business transfer, such as a merger, acquisition or sale of assets, subject to the recipient continuing to protect the data in line with this policy.

7. Where Data is Stored and Cross-border Transfers

We store Customer Data primarily in India AWS cloud provider. Some service providers, including certain AI model providers, may process data outside India. We transfer personal data outside India only as permitted under the DPDP Act, not to any country restricted by the Government of India, and with contractual safeguards that require the recipient to protect the data.

8. Cookies and Similar Technologies

Our Website uses:

• Essential cookies that keep the Website and login working securely;
• Analytics cookies that help us understand how the Website is used, such as Google Analytics; and
• Marketing cookies and pixels, such as the Meta Pixel and Google Ads tags, that help us measure our campaigns and show relevant ads.

9. Security

We use reasonable security practices and procedures, including:

• encryption of data in transit (TLS) and at rest;
• role-based access control and least-privilege access for our staff;
• masking of sensitive identifiers such as Aadhaar and bank account numbers;
• audit logs of access and changes;
• regular backups and tested recovery procedures;
• security reviews of key vendors; and
• confidentiality obligations and security training for our team. We are ISO 27001 and ISO 27701 certified.

10. How Long We Keep Data

• Account and billing data: for as long as the account is active, and afterwards for as long as required by tax, accounting and other laws.
• Customer Data: for the duration of the Customer's subscription. After the subscription ends, the Customer can export its data for 30 days. We then delete or anonymise Customer Data within 90 days, except where we are required by law to keep it. Backup copies are overwritten within 90 days.
• Statutory employment records: Customers are responsible for keeping payroll and employment records for the periods required by law and should export them before closing their account.
• Leads and marketing data: until you unsubscribe or after 24 months without engagement.
• System and security logs: up to 12 months, unless needed longer to investigate an incident.

11. Your Rights

Subject to the DPDP Act, you have the right to:

• access a summary of the personal data we process about you and how it is processed;
• correct, complete or update inaccurate or incomplete data;
• erase data that is no longer needed, unless we must keep it by law;
• withdraw consent where processing is based on consent, without affecting processing already done;
• nominate another person to exercise your rights in the event of your death or incapacity; and
• raise a grievance with our Grievance Officer (section 15).

12. Children

The Services are built for businesses and are not directed at children. We do not knowingly collect personal data from anyone under 18 except as part of Customer Data. Where a Customer lawfully employs or engages a person under 18, the Customer must obtain verifiable consent from the parent or lawful guardian, as required by the DPDP Act, before entering that person's data in Zodeck.

13. Third-party Websites and Integrations

The Services may link to or connect with third-party websites, apps and AI assistants. Their privacy practices are governed by their own policies, and we are not responsible for them. Please review their policies before sharing data with them.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version on this page with a new "Last updated" date. If we make material changes, we will notify Customers by email or in the app before the changes take effect.

15. Grievance Officer and Contact

If you have questions, requests or complaints about this Privacy Policy or how we handle personal data, please contact our Grievance Officer:

• Name: Rajkumar Sabbathi
• Designation: CEO
• Email: raj.sabbathi@zodeck.com
• Phone: +91 7386388859
• Address: Flat No. 501, Mahesh Pride, Shilpa Park, Kondapur, Hyderabad, Telangana 500084