Privacy policy

1.Who we are and what this policy covers

PeoplePilotOS is a human-resources management platform operated by [Company legal name], a company incorporated in India with its registered office at [Registered address] ([CIN]) ("PeoplePilotOS", "we", "us").

This policy explains how we handle personal data in two settings:

• The platform: the HRMS our customers use at their own address (your-organization.peoplepilotos.com), where they keep records about their employees, candidates and alumni.
• This website: peoplepilotos.com, the public pages you are reading now.

Where a customer has signed a separate agreement or data processing addendum with us, that document governs the processing of its data and prevails over this policy if the two conflict.

2.Definitions

Terms used in this policy have the meanings given in the Digital Personal Data Protection Act, 2023 (the "DPDP Act") and the rules made under it. In particular:

Customer

The organization (an employer) that subscribes to PeoplePilotOS and uses it to manage its workforce.

Data Principal

The individual the personal data relates to: an employee, candidate, former employee, dependant, nominee or website visitor. For a child, this includes the parent or lawful guardian.

Data Fiduciary

The person who decides the purpose and means of processing personal data. For employee data in the platform, this is the Customer.

Data Processor

A person who processes personal data on behalf of a Data Fiduciary. For employee data in the platform, this is PeoplePilotOS.

Personal data

Any data about an individual who is identifiable by or in relation to that data.

Sub-processor

A third party we engage to help deliver the platform that may process Customer personal data, such as a hosting provider.

3.Our role under the DPDP Act

For data in the platform, your employer is the Data Fiduciary and PeoplePilotOS is its Data Processor. Your employer decides what it records about you, why, for how long, and who in the organization can see it. We process that data only to provide the platform under our contract with your employer and on its documented instructions, and we do not use it for our own purposes.

This means that notices, consent and requests about your HR records are handled by your employer. If you contact us about them, we will pass your request on to your employer and help it respond (see section 11).

For this website, our own customer accounts and our sales enquiries, PeoplePilotOS is the Data Fiduciary. That covers, for example, the contact details of the people who administer a Customer's subscription, and messages you send us.

4.Personal data processed in the platform

Which of the following a Customer actually records depends on the modules it uses and how it configures them. The platform is built to hold:

Identity and contact

Name, preferred name, date of birth, gender, nationality, photograph, official and personal email, mobile numbers, addresses and emergency contacts.

Employment

Employee code, dates of joining, confirmation and exit, job, department, location, manager, work model, contract dates, leave, performance, learning, assets issued, expenses, travel and exit records.

Payroll and bank

Salary structure, payslips, tax declarations and proofs, loans and advances, reimbursements, and bank account details used to pay salaries.

Statutory identifiers

PAN, Aadhaar number, Universal Account Number (UAN), PF member number, ESIC insurance number, PRAN, passport number and expiry, and the statutory returns built from them (PF ECR, ESI, professional tax, labour welfare fund and Form 24Q).

Family and nominees

Marital status, dependants and nominees, recorded for benefits, insurance and statutory nominations.

Sensitive details

Where a Customer chooses to record them: blood group, religion, category, disability status, medical notes, and the content of grievance, POSH and disciplinary cases.

Attendance and time

Clock-in and clock-out times, shifts and regularisations; punches received from biometric or badge devices (the badge code, device and time of each punch); and, for on-duty requests, a location the employee provides.

Documents

Files uploaded to an employee's record or generated by the platform, such as offer letters, ID proofs and certificates, and records of documents an employee acknowledged or signed.

Recruitment

Candidate profiles, CVs, interview feedback, assessments and offers.

Account and security

Sign-in history, sessions, IP address and browser (user agent), multi-factor authentication settings, consent records, and an audit trail of changes made.

AI interactions

Where the AI assistant is enabled: the questions asked, the answers given and a log of each request (see section 7).

This data is provided by the Customer and its authorised users (HR, managers and employees themselves), by devices and integrations the Customer connects, and by candidates through the Customer's careers portal.

5.This website, cookies and local storage

This website sets no cookies and uses no analytics, advertising or tracking scripts.

• Theme preference. If you switch between the light and dark themes, your choice is saved in your browser's local storage under the key trpl.theme. It never leaves your device, and you can clear it at any time through your browser settings.
• Fonts. The pages load typefaces from Google Fonts, so your browser connects to Google's servers, which receive your IP address and browser details as part of that request.
• Contact form. The form on our contact page does not submit to our servers. It opens a pre-filled email in your own email program, and we receive only what you choose to send.
• Server logs. Like any web server, ours may record technical request data (IP address, time, page requested, browser) for security and troubleshooting, kept for [log retention period].

Signing in to the platform does use the cookies and storage it needs to keep you signed in securely. These are strictly necessary and are not used for tracking.

6.Why we process personal data

As a Data Processor, we process Customer data to:

• host, operate and provide the platform features the Customer uses;
• keep the platform secure, prevent misuse and investigate incidents;
• provide support, where the Customer grants our support team access (see section 8);
• back up and restore the Customer's data; and
• comply with the law and with lawful requests from authorities.

As a Data Fiduciary, we process the business contact details of Customer administrators and of people who contact us to manage subscriptions, bill, communicate about the service and answer enquiries.

We do not sell personal data, use it for advertising, or use Customer data to train AI models.

7.The AI assistant

PeoplePilotOS includes optional AI features: an assistant that answers questions from the Customer's own policies, a job-description writer, and a payslip explainer. They are provided through a third-party large-language-model provider, which acts as our sub-processor.

• Off by default. AI features run only when the Customer's administrator turns them on for the organization, and individual features can be enabled separately.
• What is sent. The assistant sends the question and relevant passages of the Customer's policies, not employee records. The payslip explainer sends the structure of one payslip with every amount replaced by a placeholder, and no name, employee code, bank detail or employer identity.
• Redaction. Before any request leaves the platform, email addresses, PAN, IFSC codes, Aadhaar-shaped and other long numbers, and phone numbers are replaced with placeholders, and put back only in the answer shown to you. Pattern matching cannot recognise a person's name, so please do not type other people's personal details into the assistant.
• Access. AI features never widen what you can see: the payslip explainer can only read a payslip you are already allowed to open.
• Logging. Each AI request is recorded in the Customer's own database: the feature, the user, the model, the answer, token counts and timing, so the Customer can review how AI was used.

Our agreement with the model provider [confirm: does not permit the provider to use submitted data to train its models, and limits its retention of requests to [period]]. AI answers can be wrong; please check anything important with your HR team.

8.Sharing and sub-processors

We share personal data only as needed to provide the platform, with:

• Infrastructure providers that host our servers, databases and file storage;
• Email delivery providers that send notifications such as approvals and payslip alerts;
• SMS or WhatsApp providers, where the Customer enables those channels;
• An AI model provider, where the Customer enables AI features (see section 7); and
• Integrations the Customer connects, such as attendance devices, which receive or send data on the Customer's instruction.

Our current list of sub-processors, with what each does and where it processes data, is at [link to sub-processor list]. We bind each sub-processor to obligations that protect personal data at least as well as this policy.

Our own staff have no standing access to a Customer's data. When support needs to look inside an organization, the Customer grants time-limited access from its settings and can revoke it at any time; every grant and its use is recorded in the Customer's audit log. A separately controlled emergency procedure exists for incidents, and each such session is visible to the Customer.

We may also disclose personal data where the law requires it, for example to comply with a court order, and we will tell the affected Customer unless we are legally prevented from doing so.

9.How we protect personal data

• A separate database per organization. Each Customer's data lives in its own database, not in rows shared with other customers.
• Field-level encryption. PAN, Aadhaar, passport and bank account numbers, and filed statutory statements, are encrypted with AES-256-GCM inside the database, in addition to encryption of the storage itself. Aadhaar and PAN are masked in screens and exports unless a user holds a specific permission, and only the last four digits of a bank account are ever displayed.
• Encryption in transit. Connections to the platform use TLS.
• Role-based access. Every request is checked against the user's role and data scope on the server; sensitive actions such as viewing pay can require the user to re-verify their identity.
• An append-only audit trail. Changes are recorded with who made them, when and what changed, and the database refuses edits or deletions of audit records.

No system is perfectly secure. If a personal data breach affects Customer data, we will notify the Customer without undue delay [and within [X] hours] so it can meet its own obligations to inform the Data Protection Board of India and affected individuals. More detail is on our security page.

10.Retention and deletion

Customer data is kept for as long as the Customer's subscription is active. The Customer decides how long it keeps individual records, subject to the retention periods Indian employment, tax and social-security laws require of it.

When a subscription ends, the Customer can export its data for [30] days. We then delete the organization's database and files, and remove them from backups within [backup retention period], unless the law requires us to keep something longer.

Audit records are retained for up to seven years, so that changes to pay, access and employment records remain traceable. [Confirm audit retention]

Our own business records (account contacts, invoices, correspondence) are kept for as long as needed for the purpose they were collected for and as required by law.

11.Your rights as a Data Principal

Under the DPDP Act you have the right to:

1. Access a summary of the personal data being processed about you and the processing activities;
2. Correction and erasure: have inaccurate or incomplete data corrected, completed or updated, and data erased once it is no longer needed for its purpose, unless the law requires it to be kept;
3. Withdraw consent where processing is based on consent, as easily as you gave it;
4. Grievance redressal: have a complaint about the handling of your data answered; and
5. Nominate another individual to exercise these rights on your behalf in the event of your death or incapacity.

For data that PeoplePilotOS holds as Data Fiduciary, write to our grievance officer (section 14). We will respond within [X] days. If you are not satisfied with the response, you may complain to the Data Protection Board of India.

12.Children's data

PeoplePilotOS is a workplace tool for organizations and is not directed at children. This website does not knowingly collect data from anyone under 18.

A Customer may record details of an employee's children, for example as dependants or nominees for benefits and insurance. In that case the Customer, as Data Fiduciary, is responsible for obtaining verifiable consent from the parent or lawful guardian where the DPDP Act requires it, and for not processing children's data in ways the Act prohibits. The platform does not use any data for tracking, behavioural monitoring or targeted advertising.

13.Cross-border transfers

Customer data is hosted in [hosting region, e.g. India]. Some sub-processors, which may include the AI model provider, may process data outside India. We transfer personal data outside India only to countries not restricted by the Central Government under section 16 of the DPDP Act, and under contractual safeguards. [Confirm hosting location and transfer list]

14.Grievance officer

If you have a question or complaint about how we handle personal data, contact our grievance officer. We aim to acknowledge every complaint within [X] days.

15.Changes to this policy

We may update this policy as the platform or the law changes. We will change the "Last updated" date at the top of this page, and for material changes we will notify Customer administrators by email or in the platform at least [X] days before they take effect.

16.Contact us

For anything else about this policy, write to [privacy contact email] or to [Company legal name], [Registered address]. See also our terms of service.