Privacy Policy
How we collect, use, share and protect personal data across the NeevHR website, web application and mobile app. Last updated 01 Nov 2026.
1. Who we are and what this policy covers
NeevHR Technologies LLP, a limited liability partnership registered in India (“NeevHR”, “we”, “us”), provides an India-first HRMS and payroll platform for businesses. This policy explains how we handle personal data when you:
- visit our website, www.neevhr.com (the “Website”);
- request a demo, contact us or become a customer;
- use the NeevHR web application (the “Platform”); or
- use the NeevHR mobile app for Android and iOS (the “App”).
We follow the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 as their provisions come into force, together with the Information Technology Act, 2000 and the rules made under it.
2. Our role: Data Fiduciary or Data Processor
Our role depends on whose data it is and why it is processed.
| Whose data | Our role | Who decides how it is used |
|---|---|---|
| Website visitors, people who request a demo or contact us, and our customers' account and billing contacts | Data Fiduciary | NeevHR, as described in this policy |
| Employees, candidates, contractors and their family or nominees, whose records an employer keeps on the Platform or App | Data Processor | The employer (our customer), who is the Data Fiduciary. We process this data only on the employer's documented instructions and under our customer agreement. |
If you are an employee using NeevHR through your employer, your employer decides what data is collected about you, why, and for how long. Please send requests about your employment records to your employer's HR team first, or use the data request option in employee self-service. If you contact us, we will pass your request to your employer and help them respond.
3. Personal data we collect
3.1 On the Website
| Data | Source | Purpose |
|---|---|---|
| Name, work email, company, phone, role, company size, current HR system, requirement, preferred demo date and your message | You, through the demo or contact form | To respond to your enquiry, arrange a demo and follow up about NeevHR |
| Pages visited, referring page, approximate location, device and browser type | Google Analytics, with IP anonymisation switched on | To understand how the Website is used and improve it |
| A note in your browser that you closed our pop-up | Your browser's local storage | So we do not show the pop-up again for a while |
3.2 Customer account data
Names, work email addresses and phone numbers of customer administrators and contacts, company and billing details, contracts, support tickets and our correspondence with you. We use this to provide the service, invoice, support you and meet legal obligations.
3.3 On the Platform and App, on behalf of employers
Employers configure which of the following they collect. Depending on that setup and the modules in use, the Platform may hold:
| Category | Examples |
|---|---|
| Identity and contact | Name, photo, date of birth, gender, personal and work contact details, address, emergency contacts |
| Employment | Employee code, designation, grade, department, location, manager, dates of joining and exit, employment history |
| Statutory identifiers | PAN, Aadhaar, UAN, ESI number, passport or other identity documents the employer requires |
| Pay and finance | Salary structure, payslips, tax declarations and proofs, bank account and IFSC, loans, advances, reimbursements and expenses |
| Time and attendance | Punch times, attendance device logs, shifts, timesheets, leave and holidays |
| Location | Location at punch-in or punch-out, and for field workers who consent, location during working hours |
| Health and family | Medical certificates attached to leave, insurance and benefit enrolments, family members and nominees |
| Performance and talent | Goals, reviews, feedback, learning records, recognition and survey responses |
| Recruitment | Candidate applications, CVs, interview feedback and offers |
| Exit | Resignation details, clearances, full and final settlement and exit survey responses |
| Documents | Letters, certificates and other files uploaded by HR or the employee |
| Usage and security | Sign-in history, IP address, device type, app version, audit trail of changes, notification preferences |
4. The NeevHR mobile app
The App is for employees whose employer uses NeevHR. Accounts are created by the employer, so you cannot sign up in the App yourself. The App asks for device permissions only when a feature needs them, and you can turn each one off in your phone's settings.
| Permission | When it is used | What we receive |
|---|---|---|
| Location (while using the App) | When you punch in or out, if your employer uses location-based attendance | Your location at the moment of the punch |
| Location (background) | Only for field workers, only after you give consent, and only during working hours | Periodic location points shared with your manager. Tracking stops outside working hours and as soon as you withdraw consent. |
| Camera and photos | When you choose to photograph or attach a document, such as a receipt or medical certificate | Only the image you choose to upload |
| Face ID, fingerprint or device PIN | To unlock the App | Nothing. Your phone's operating system does the check, and your biometric data never leaves your device. |
| Notifications | To alert you to approvals, payslips, leave decisions and other updates | A device token used only to deliver notifications |
The App also sends its version number and platform with each request, so we can keep it compatible and prompt you to update. If the App crashes, a crash report with technical details (device model, OS version, App version and the error) is sent to us. Crash reports do not include your name, salary or other HR records.
To protect your data, the App stores only a limited set of your own non-sensitive information on the device for offline use, and encrypts it. It does not store approvals, pay data, loans, expenses or colleagues' details on the device. Downloaded payslips and documents are deleted when you sign out. The App contains no advertising and no third-party tracking.
5. How and why we use personal data
| Purpose | Basis |
|---|---|
| Responding to enquiries and arranging demos | Your consent, given when you submit the form |
| Providing, securing and supporting the Platform and App for our customers | Our contract with the customer, and the employer's instructions for employee data |
| Sending service messages, such as sign-in codes, password resets, approvals and payslip alerts | Needed to provide the service you or your employer asked for |
| Preventing fraud and misuse, keeping audit logs and investigating security incidents | Legitimate use for security, and legal obligations |
| Website analytics and improving our products, using aggregated or de-identified data | Your consent and legitimate use |
| Meeting legal, tax and regulatory obligations, and responding to lawful requests | Compliance with law |
| Occasional updates about NeevHR to business contacts | Your consent. You can unsubscribe at any time. |
Where we rely on consent, you can withdraw it at any time, as easily as you gave it. Withdrawal does not affect processing that happened before it.
6. What we never do
- We do not sell or rent personal data.
- We do not use employee data for advertising, and the App has no ads.
- We do not use our customers' employee data to train artificial intelligence models.
- We do not access an employer's data except to provide or support the service, when the customer asks us to, or when the law requires it.
7A. AI features and what they send
AI features are off until they are switched on for an employer, module by module, and the employer's AI admin can turn them off. Where they are on, the data below goes to our AI provider, Anthropic, outside India, to prepare the result. A person decides what to do with the result: the feature does not reject, approve, pay or change a record by itself.
Files can contain what is printed on them. A receipt or tax proof goes as the whole file that was uploaded. NeevHR adds no detail from the record to it, and cannot remove what the file itself shows, which can include a name, PAN, account or card number, or anything else on the page. Please upload only what the claim or proof needs.
Candidates. If an employer switches on Resume match, the text of a candidate's resume goes to the provider after automatic rules take out the name, contact details, ID numbers, address, personal details and pay. These rules work on patterns, so something written in an unusual way could remain. Resume match gives a score and reasons to the recruiter; it does not reject or move a candidate.
Health-related tax proofs. Proofs on the 80D, 80DD, 80DDB and 80U lines of a declaration are not sent. This check goes by the line a file is uploaded on, so a health paper uploaded on a different line would be sent.
Disciplinary and POSH cases and letters have no AI features.
| Feature | What is sent |
|---|---|
| AI assistant (chat) | The question, and the record data needed to answer it within that person's role, such as their own payslip summary or leave balance. The assistant's tools do not read bank account, IFSC, PAN, Aadhaar, UAN, ESI number, address, tax details, health or disciplinary data, a candidate's phone or email, or another person's individual pay. Whatever a person types in a question goes as typed. |
| Resume match | Cleaned resume text and the opening's title and job description. Automatic rules take out the name, contact details, ID numbers, address, personal details and pay first. Rules work on patterns, so something written in an unusual way could remain. |
| Expense receipt reading | The whole receipt file as uploaded (image or PDF), and your expense category names. No detail is added from the record, but a file can contain what is printed on it, such as a name or a card or account number. |
| Tax proof reading | The whole proof file as uploaded (image or PDF), and the product's tax section names. A file can contain what is printed on it, such as a name, PAN or account number; those are not kept or shown from the reading. Proofs on the health-related lines (80D, 80DD, 80DDB, 80U) are not sent. The check is by the line a file is uploaded on, so a health paper uploaded on another line would go. |
| Leave policy from a PDF | The whole PDF as uploaded, and the names of your leave types. A PDF whose text shows a PAN or Aadhaar number is refused. A scanned page has no text to check, so it can still go if it shows one. |
| Import column matching | Column headings, and up to three masked samples per column that show the shape of a value, not the value. Columns for PAN, Aadhaar, bank, pay and other personal details send no sample. The rows of the file do not go. |
| Payroll change explanation | The checks that fired, with a line reference for each person, the percent change in net pay, loss-of-pay days, overtime hours and variable pay as a percent of gross. No name, employee code, department, bank detail, PAN or rupee amount. |
| Helpdesk category and reply draft | The ticket subject and the conversation with the employee, after automatic rules remove names, contact details and ID numbers, your ticket category names, and matching knowledge base and Help Centre text. Internal notes and attachments do not go. Confidential categories and tickets that read as a private matter do not use AI. |
| Report from a sentence | The sentence typed, and the names of the reports and fields the person's role may use. No employee data. A sentence with a person's full name, code, email, phone or ID number is refused. |
| Review, goal and 1:1 drafts | For a review: each goal's title, description and weight, and the employee's own note and self percent. For a goal: the designation, department and existing goal titles. For a 1:1: the agenda, shared notes, action items and that person's own private note. Automatic rules remove names, codes, contact details, ID numbers, bank details and pay figures first. Ratings, pay and the other person's private note do not go. |
| Letter template draft | The letter type, language, template name and category, and the names of the merge fields. No employee data: details stay as merge fields until a letter is issued. |
| Survey summary | The question text and open-text answers, with no name, employee code or department attached, after automatic rules remove names, contact details, ID numbers and pay figures from the words. A question goes only with at least the survey's minimum group of comments. An answer that reads as a health, private, disciplinary or POSH matter is left out. |
| Attrition reasons | For each department large enough to show: its name, average headcount, exits, attrition percent, trend, and counts of exit types and resignation reasons. No name, employee code, pay, rating or exit interview text. |
| Learning suggestions | The person's designation, department and skill names, and your catalogue's course titles, types, hours and skills. No name, employee code, contact detail, pay, rating or attendance. |
8. Where your data is stored
The Platform's application and database are hosted in India, in the Mumbai region. Some service providers listed above process limited data outside India, for example to deliver an email or a notification, or to prepare an AI result where the employer has switched that feature on. We transfer personal data outside India only as permitted under the DPDP Act, 2023, and never to a country the Government of India has restricted.
9. How we protect personal data
- Encryption in transit (HTTPS) for all traffic to the Website, Platform and App.
- Field-level AES-256 encryption for PAN, Aadhaar, UAN, ESI number and bank details, on top of encrypted database storage.
- Strict separation of each customer's data, enforced inside the database by row-level security.
- Role-based access with data scopes and field masking, so people see only what their role allows.
- Multi-factor authentication, mandatory for privileged administrator roles, plus session timeouts and account lockout.
- An audit trail of changes, and password-protected payslip PDFs.
- App lock with biometrics or device PIN, encrypted on-device storage, and blocked screenshots on Android.
See our Security & Compliance page for more detail. No system is completely secure. If a personal data breach occurs, we will inform affected customers without undue delay and support them in notifying the Data Protection Board of India and affected individuals, as the DPDP Act requires. Where we are the Data Fiduciary, we will make those notifications ourselves.
10. How long we keep data
| Data | Retention |
|---|---|
| Demo and contact requests | Up to 24 months after our last contact with you, unless you become a customer or ask us to delete it sooner |
| Customer account and billing records | For the contract, then as long as tax and accounting law requires (generally 8 years) |
| Employee data on the Platform | As set by the employer's retention schedules, which can reflect statutory periods under labour, tax and social security laws. When a contract ends, the employer can export its data, after which we delete it within 90 days, except where the law requires us to keep it. |
| Security and access logs | At least one year, as the DPDP Rules require, and then deleted on a schedule |
| Backups | Overwritten on a rolling schedule. Deleted data leaves the backups as they expire. |
11. Your rights
Under the DPDP Act, 2023 you have the right to:
- get a summary of the personal data processed about you, and of who it has been shared with;
- correct, complete or update inaccurate or incomplete data;
- have your data erased when it is no longer needed for its purpose, unless the law requires us to keep it;
- withdraw consent where processing is based on consent;
- have your grievances addressed; and
- nominate another person to exercise these rights if you die or become incapacitated.
Employees: please use the data request option in employee self-service or contact your employer's HR team, because your employer controls your records. Everyone else: email hello@neevhr.com. We may need to verify your identity before acting on a request. We respond as quickly as we can, and within the period the law sets.
12. Children
The Website, Platform and App are meant for businesses and their working-age staff. We do not knowingly collect personal data from anyone under 18 except where an employer must lawfully keep it, for example a dependant or nominee in an employee's record. In that case the employer is responsible for obtaining any consent the law requires. If you believe a child has given us personal data directly, contact us and we will delete it.
14. Changes to this policy
We may update this policy as our services or the law change. We will change the “last updated” date above. If a change is significant, we will tell customers in advance and show a notice on the Website or in the App.
15. Contact us and grievances
For any question, request or complaint about personal data, contact our Grievance Officer, NeevHR Technologies LLP:
Grievance Officer, NeevHR Technologies LLP
Email: hello@neevhr.com
Address: L-1601, Aster, Adani Shantigram, near Shoppers Plaza, Vaishnodevi Circle, Ahmedabad, Gujarat 382421, India
We acknowledge grievances promptly and aim to resolve them within 30 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India.