Privacy policy

Karmik is HR, attendance and payroll software. Companies (“customers”) use it to manage their employees. For employee data, the customer decides why and how it is processed (the Data Fiduciary under India's Digital Personal Data Protection Act, 2023) and Karmik processes it on the customer's instructions (Data Processor). For account holders of Karmik itself, Karmik is the Data Fiduciary.

What we process

• Account data: name, work email, role, password (stored only as a one-way hash).
• Employee records entered by the employer: name, phone, email, designation, department, work location, joining/exit dates, salary structure, PAN, UAN, bank account and IFSC.
• Attendance and leave: daily status, overtime, leave requests and decisions.
• Mobile check-in: GPS location, accuracy, time and an optional selfie photo, captured only when the employee opens their check-in link and taps Check in/out. No face recognition is performed.
• WhatsApp messages exchanged with the HR bot, when the employer connects WhatsApp.
• Payslips, payroll runs, generated letters and the emails sent with them.
• Security data: audit log of changes (who, what, when, IP address) and rate-limit counters (hashed identifiers).

Why

• To provide the service the employer signed up for: attendance, leave, payroll, letters and employee self-service.
• To keep the service secure: authentication, rate limiting, audit logs, fraud and abuse prevention.
• To meet legal obligations, such as keeping wage records for the period required by law.

AI

When the employer turns on AI features, the minimum necessary text (for example payroll flags, a leave question or letter instructions) is sent to Anthropic's Claude API to generate a reply. Salaries are never calculated by AI. [Lawyer: confirm the sub-processor terms and data-transfer position for the AI provider.]

Sharing and sub-processors

We do not sell personal data or use it for advertising. We share it only with sub-processors needed to run the service: hosting and database [provider, region], email delivery [provider], file storage [provider], WhatsApp (Meta) if connected, and the AI provider if enabled. [Owner: fill in the actual providers and regions before launch.]

Retention

Employers can set how long personal data of former employees is kept. After that period, names, contact details, PAN, UAN, bank details, check-in photos and locations, WhatsApp chats and letters are removed; wage records are kept under the employee code for as long as labour and tax law requires. Deleting a company removes all of its data. Backups are overwritten within [N] days.

Your rights

Account holders can download their data and delete their login from My account. Employees can ask their employer to correct or erase their data; employers can do this in Karmik. To raise a grievance, contact our Grievance Officer at [name, email, address]. You may also complain to the Data Protection Board of India.

Security

Data is encrypted in transit (HTTPS). Passwords are hashed with bcrypt. Access is limited by role (Owner, HR, Manager, Employee) and every company's data is isolated. Sensitive changes are recorded in an audit log. If a personal data breach affects you, we will notify the employer and, where required, the Data Protection Board.

Children

Karmik is for workplaces and is not intended for anyone under 18.

Contact

[Company legal name, registered address, email.]