Privacy Policy

Ventron, a sole proprietorship of Vineet Sharma (“Haazri”, “we”, “us”) provides an attendance and payroll platform to small and medium businesses in India. Under the Digital Personal Data Protection Act, 2023 (“DPDP Act”), your employer is the data fiduciary for the employee records it manages in Haazri, and we process that data on its instructions; for the account data of people who sign their company up, we act as the data fiduciary.

• Account & employee data — name, work and personal email, phone and WhatsApp number, employee code, designation, department, role, and (where your employer records them) date of birth and gender, provided by you or your employer.
• Location, at punch time — when you tap Check in/Check out, your device’s GPS coordinates at that moment are sent once to verify you are within your office’s geofence. Each stored punch keeps the coordinates, computed distance and result.
• Location, for office reminders (optional) — if you turn on office reminders in Settings, the app checks your location in the background to notice when you cross your office’s boundary, so it can remind you to check in or check out. This is off by default, and turning it on asks you separately for “Allow all the time” location on your phone before it works. It only ever compares your position to that one boundary — Haazri does not build a history of where you go, and the reminder never checks you in or out for you; you still have to tap the button. Outside of a punch or this opt-in reminder, we do not access your location at all.
• Selfies (optional) — if you or your employer enable selfie-at-punch, the photo you capture is stored with that punch record. Punching works without a selfie unless your employer requires it.
• Attendance & leave data — punch times, computed day statuses, leave requests, balances and approvals, medical certificates you upload.
• Salary & payout data — the salary structure your employer sets, computed payslips and statutory deduction amounts (PF, ESI, professional tax, TDS), and — where your employer provides them for payroll and payout — bank account number, IFSC and PAN, which are stored encrypted.
• Technical data — IP address and browser identifier on sign-in attempts (kept for account security), and server logs needed to run the service.

We do not collect Aadhaar or other government identifiers, we do not read anything else on your device, and we do not sell or share personal data with advertisers.

• To record and verify attendance (geofence check, punch history, day-status computation).
• To administer leave — balances, approvals and the audit ledger behind them.
• To compute salaries and generate payslips, including statutory deductions.
• To send service messages: welcome and password emails, leave decisions, payslip delivery.
• To keep accounts secure: login attempt logging, lockouts, session management.
• To meet legal obligations that apply to us or your employer (e.g. payroll record retention).

WhatsApp notifications are sent only if you have given consent (the opt-in flag on your profile). You can withdraw that consent at any time by telling your admin, and messages fall back to email.

Data is encrypted in transit (HTTPS everywhere) and at rest. Passwords are stored only as one-way hashes (argon2id), and especially sensitive fields — bank account number and PAN — are additionally encrypted at the application layer. Access inside Haazri is role-based: employees see their own records, managers their reportees’, and admins their company’s — every request is checked server-side, and every company’s data is isolated from every other’s.

We use the service providers below to run Haazri. They process data only to provide the service, not for their own purposes:

• Supabase — database and file storage (payslips, selfies, uploaded documents).
• Vercel — application hosting and delivery.
• Resend — transactional email (verification, password, leave and payslip notices).
• A WhatsApp messaging provider — only if your employer enables WhatsApp notifications and you have opted in.
• OpenStreetMap (Nominatim) — to look up an office address when an admin sets a geofence location.

These providers may process and store data on servers located in India or other countries; where data is processed outside India we rely on the provider’s contractual and technical safeguards. No system is completely secure; if a breach affects your data we will act on it and notify affected parties and the authorities as the law requires.

• Attendance and payroll records — retained while your employer's account is active, and as required by Indian payroll and labour regulations after that (typically up to 8 years for wage records).
• Punch selfies — automatically deleted 45 days after the punch. The attendance record itself (time, location, verdict) is kept; only the photo is removed.
• Medical certificates — retained with the leave record they support.
• Login attempt logs — up to 12 months.
• When a company closes its account, its data is exported on request and then hard-deleted within 90 days, except records we must keep by law.

• Access — ask for a copy of the personal data we hold about you.
• Correction — have inaccurate or incomplete data corrected (for employment records, via your employer's admin).
• Erasure — request deletion of data that is no longer needed for the purposes above or required by law.
• Grievance redressal — raise a complaint and receive a response within the timelines the DPDP Act prescribes.
• Nomination — nominate a person to exercise these rights on your behalf in case of death or incapacity.

For records your employer controls, we will support and route your request to them; for data we control, we act on it directly.

To ask us to delete your account and personal data, use haazri.ventron.in/delete-account. It explains what is erased and what your employer must keep by law.

Write to our grievance officer at grievance@ventron.in. We acknowledge complaints within 72 hours and aim to resolve them within 30 days. If you are not satisfied, you may escalate to the Data Protection Board of India.

If this policy changes materially, we will notify company admins by email and show the updated date above. Continued use after the effective date means the updated policy applies.