Privacy Policy

1. Introduction

BringHR ("BringHR," "we," "us," or "our") provides a cloud-based Human Resource Management System (HRMS) built for Indian startups, SMEs, and growing businesses, together with related tools such as an income tax calculator, payslip generator, offer-letter studio, and a candidate/recruiting portal (together, the "Services"), reachable through our website at bringhr.com (the "Site").

This Privacy Policy explains what personal data we collect, why we collect it, how we use and share it, and the choices and rights available to you. It applies to visitors to our Site, prospective and current client organizations ("Clients"), the employees of those Clients whose records are processed inside BringHR, and candidates who apply for jobs through a Client's recruiting portal on BringHR.

By using our Site or Services, you agree to the practices described in this Policy, to the extent permitted by applicable law — including India's Digital Personal Data Protection Act, 2023 (the "DPDP Act") and the Digital Personal Data Protection Rules, 2025 made under it.

2. Key Terms & Roles

The DPDP Act uses a few terms that help explain who is responsible for what. We use them the same way here:

• Data Principal — the individual the personal data is about (for example, a website visitor, a Client's employee, or a job candidate).
• Data Fiduciary — the entity that decides why and how personal data is processed (broadly similar to a "controller" under other privacy laws).
• Data Processor — an entity that processes personal data on behalf of, and only on the instructions of, a Data Fiduciary.

Applied to BringHR:

• When you visit our Site or contact us directly as a prospective customer, BringHR is the Data Fiduciary for that data.
• When a Client uses BringHR's HRMS to manage its own employees' HR and payroll records, the Client is the Data Fiduciary for its employees' data, and BringHR acts as a Data Processor, handling that data only on the Client's instructions and for the purpose of providing the Services.
• When a Client uses BringHR's recruiting portal to receive job applications, the Client is the Data Fiduciary for candidate data and BringHR is the Data Processor.

3. Information We Collect

3.1 Information you or your employer give us

• Website & sales enquiries: name, company name, email, phone number, and message content when you fill in a contact form, request a demo, or email or call us.
• HRMS platform data (entered by a Client or its employees): name, contact details, date of birth, gender, government identifiers used for statutory compliance (such as PAN, Aadhaar, UAN/PF number, or ESI number), bank account details for salary disbursement, salary and compensation structure, tax regime and declarations, attendance and leave records, employment history, performance and appraisal records, and documents such as offer letters, ID proofs, or certificates uploaded to the platform.
• Recruiting portal / candidate data: name, contact details, resume/CV, education and work history, and any other information a candidate submits when applying to a job posted by a Client.
• Account credentials: usernames and passwords (stored using industry-standard hashing) for anyone who logs into the Employee Portal, Client Portal, or recruiting dashboard.

3.2 Information collected automatically

• Standard web log data such as IP address, browser type, device type, pages visited, and referring URLs.
• Cookies and similar technologies used for Site functionality (like keeping you logged in) and, where enabled, analytics — see Section 11.

3.3 What we don't collect

We don't ask website visitors for sensitive personal data (such as health information) unless you choose to share it with us, for example in a support message. Our standalone browser tools — the Income Tax Calculator, Payslip Generator, and Offer Letter Studio — run entirely in your browser: the salary figures, names, or other details you type into them stay on your device and are not transmitted to or stored on our servers unless you separately choose to save, download, or send the output yourself.

4. How We Use Your Information

1. To provide, operate, maintain, and improve the Services — running payroll, tracking attendance and leave, generating payslips, and managing candidate pipelines.
2. To calculate and file statutory dues on a Client's behalf where the Client has engaged us to do so, such as Provident Fund (PF), Employee State Insurance (ESI), Professional Tax, and TDS under the applicable income tax regime.
3. To respond to enquiries, provide customer support, and communicate service updates.
4. To send account, security, and transactional notifications, such as login alerts and password resets.
5. With appropriate consent, to send marketing communications about BringHR, which you can opt out of at any time.
6. To detect, investigate, and prevent fraud, abuse, or security incidents.
7. To comply with applicable law, regulation, legal process, or a lawful government request.
8. To generate anonymised or aggregated statistics that don't identify any individual, for example to understand product usage trends.

5. Our AI-Assisted Features

The Minamaa chat assistant on our Site currently answers common questions using a local, pre-programmed knowledge base built into the page — your question is matched and answered directly in your browser and is not sent to any third-party AI service.

We're also developing an optional voice mode for Minamaa. This feature is not currently active on our Site. If and when we enable it, it would involve processing your spoken words using third-party speech-recognition, AI-language, and text-to-speech services in order to hold a spoken conversation. Before that happens, we'll update this Policy to name the providers involved and describe exactly what's processed, and the microphone will only ever activate after your clear action, such as tapping a "talk" button.

We do not use fully automated decision-making that produces legal or similarly significant effects about you — such as automated hiring rejections — without human involvement.

6. How We Share Information

• Client organisations: employee and candidate data is visible to the relevant Client's authorised HR/admin users, since the Client is the Data Fiduciary for that data.
• Service providers acting on our behalf: hosting and cloud infrastructure providers, email/SMS delivery providers, and, where used, payment processors — each bound by contract to use data only to provide their service to us.
• Statutory and government bodies: where a Client engages us for compliance filings, data may be submitted to bodies such as the Employees' Provident Fund Organisation (EPFO), the Employees' State Insurance Corporation (ESIC), and Income Tax Department e-filing systems, as required to complete those filings.
• Legal and safety reasons: to comply with a law, regulation, court order, or lawful government request, or to protect the rights, property, or safety of BringHR, our Clients, or others.
• Business transfers: if BringHR is involved in a merger, acquisition, or sale of assets, personal data may be transferred as part of that transaction, subject to this Policy or one at least as protective.

We do not sell personal data to third parties for their own marketing purposes.

7. Cross-Border Data Transfers

We host and process data using reputable infrastructure providers. Where any personal data is stored or processed outside India, we take steps intended to be consistent with the DPDP Act's requirements for such transfers, including working only with providers that offer appropriate contractual and security safeguards.

8. Data Security

We use industry-standard technical and organisational measures to protect personal data, including encrypted connections (HTTPS/TLS) between your browser and our servers, hashed password storage, role-based access controls that limit who at BringHR and at a Client organisation can view particular records, and regular review of our systems.

No method of transmission or storage is 100% secure, and while we work hard to protect your data, we can't guarantee absolute security. If we become aware of a personal data breach likely to affect you, we will notify affected Clients and, where required by law, the Data Protection Board of India and affected individuals, in line with the timelines set out in the DPDP Rules, 2025.

9. Data Retention

We retain personal data for as long as necessary to provide the Services, comply with our legal and statutory obligations (payroll and tax records, for instance, are commonly required to be kept for several years under Indian labour and tax law), resolve disputes, and enforce our agreements.

When a Client's subscription ends, we retain their data for a reasonable transition period to allow export, after which it is deleted or anonymised, except where we're required or permitted by law to retain it for longer.

10. Your Rights & How to Exercise Them

Under the DPDP Act, as a Data Principal you generally have the right to:

• Obtain a summary of the personal data we hold about you and how it's processed.
• Request correction, completion, or updating of your personal data.
• Request erasure of your personal data, unless we need to keep it for a legal reason.
• Withdraw consent you previously gave, at any time, as easily as you gave it.
• Nominate another individual to exercise these rights on your behalf in the event of your death or incapacity.
• File a grievance with us and, if it isn't resolved, escalate it to the Data Protection Board of India.

If your data is held by BringHR as a Data Processor on behalf of a Client — meaning you're that Client's employee, or a candidate who applied through them — the Client controls that data, so we'll typically ask you to route your request through them. We still act on Client instructions promptly, and you're welcome to contact us directly using Section 15; we'll help route your request either way.

To exercise any of these rights over data BringHR holds directly, such as website enquiry data, contact us using the details in Section 15.

11. Cookies & Similar Technologies

• We use strictly necessary cookies to keep the Site functioning correctly, such as remembering your session on the Employee or Client login portal.
• Where enabled, we and our service providers may also use cookies or similar technologies for analytics, to understand how visitors use our Site and to improve it.
• Most browsers let you block or delete cookies through their settings; doing so may affect some Site functionality, particularly logged-in areas.

12. Children's Privacy

Our Site and Services are intended for business use by adults and organisations and are not directed at children. We do not knowingly collect personal data from children. Where a Client's workforce or a job candidate includes an apprentice or trainee who is a minor under applicable law, the Client, as Data Fiduciary, is responsible for obtaining any verifiable parental or guardian consent required by the DPDP Act before that individual's data is entered into the Services.

13. Third-Party Links

Our Site may link to third-party websites, for example our social media pages. We aren't responsible for the privacy practices of those third parties, and we encourage you to review their policies separately.

14. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices, Services, or applicable law. We'll post the revised Policy on this page with an updated "Last updated" date, and where changes are significant, we'll provide additional notice — such as an on-Site banner or an email to Client administrators.

15. Grievance Officer & Contact Us

In accordance with the DPDP Act and applicable Indian law, we've appointed a Grievance Officer to address questions, concerns, or complaints about this Policy or how your personal data is handled.

If you're not satisfied with our response, you may file a complaint with the Data Protection Board of India.