Privacy Policy

1. Introduction

AiroHR Technologies Private Limited (“we,” “us,” or “our”) is committed to protecting the privacy of our users. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or use our software applications.

We process personal data on the basis of consent where the law requires it (for example face attendance or WhatsApp messages), or for legitimate uses permitted under the Digital Personal Data Protection Act, 2023, such as employment and legal obligations.

Who is responsible for your data. When a company uses AiroHR to manage its employees, that company (the employer) decides why and how employee data is processed and is the Data Fiduciary for that data. AiroHR processes it on the employer’s behalf as a data processor. For information you give us directly — for example a demo request, a signup or contact form, or your account as a customer’s administrator — AiroHR Technologies Private Limited is the Data Fiduciary.

2. Data We Collect

We may collect information in several ways:

• Personal Data: Name, email address, phone number, and professional details provided during registration.
• Employee Data: Attendance logs, salary structures, and KYC documents uploaded by employers/employees.
• Device Information: IP address, browser type, and location data (if GPS attendance is enabled).
• Face Attendance Data (Airo Lens): if your employer uses the Airo Lens kiosk, a face template and one face photo captured at enrolment (see section 10).

3. How We Use Data

Your information allows us to provide a seamless HR experience, including:

• Calculating accurate payroll and attendance.
• Generating statutory compliance reports (PF/ESI).
• Sending automated notifications and payslips.
• Improving our software performance and security.

4. Data Security

We implement industry-standard security measures, including SSL encryption and secure cloud storage, to protect your data from unauthorized access, alteration, or disclosure. However, no method of transmission over the internet is 100% secure.

5. Data Sharing

We do not sell your personal data, and we do not share it for advertising. We may share information with:

• Service providers who run AiroHR for us, only for that purpose: cloud hosting; email delivery (Amazon Web Services – Amazon SES); SMS and WhatsApp messaging providers (including Gupshup, and Meta Platforms for WhatsApp); push notifications (Google Firebase Cloud Messaging); payment gateways for subscription payments; and, where your employer enables the optional AI letter-drafting assistant, an AI service provider that receives the letter text to draft it. We require each of them to protect personal data.
• Salary payouts go only through the customer’s own payout account (for example Cashfree Payouts) when the customer enables it.
• Government authorities (when required for statutory filings). EPFO, ESIC, the Income Tax Department and state PT portals receive data only when the customer uploads the files AiroHR prepares.
• Legal entities (if required by law).

Where data is stored. Your data is stored on secure servers operated by our hosting provider. If any data is stored or processed outside India, we do so only as permitted under Indian law.

6. Cookies

Our website and apps use only essential cookies — for your login session and for security (such as protection against forged requests). We do not use advertising or analytics cookies. You can disable cookies through your browser settings, but you will then not be able to log in.

7. Data Retention

We retain your information for as long as your account is active or as needed to provide you services and comply with legal obligations.

• Customer account and employee records: kept while the customer’s subscription is active. After it ends, the customer can ask us for an export; the workspace data is then deleted or anonymised, except records we must keep by law.
• Payroll, PF/ESI, TDS and wage records: kept for the periods that the law requires the employer to keep them, or as the customer instructs.
• Demo and signup enquiries: kept only as long as needed to respond to and follow up on the enquiry.
• Face data (Airo Lens): as described in section 10.

8. Your Rights

Users have the right to access, correct, or request the deletion of their personal data. Employers are responsible for the data of their respective employees as the primary data controllers.

You can ask to access, correct, update or delete your personal data, and withdraw consent you have given (for example for face attendance or WhatsApp messages), by contacting your employer’s HR team or our Grievance Officer (section 13). Withdrawing consent does not affect processing already done, or processing the law requires (for example statutory payroll records). You may nominate another person to exercise your rights if you die or become incapacitated. If you are not satisfied with our response, you can complain to the Data Protection Board of India.

Deleting your account or data: see Delete your account or data for how to ask, what is deleted and what the law requires us to keep.

9. Mobile App Permissions

The AiroHR apps (Android, and iOS where available) request the following device permissions. Each is used only for the purpose stated and never for advertising, profiling, or background tracking.

• Camera. Used only when you tap a photo upload field (profile photo, KYC document, attendance photo). Photos are never accessed in the background.
• Storage. Used to save documents you download (payslips, reports) to your device’s public Download/AiroHR folder. On Android 10 and above no storage permission is required.
• Notifications. Used to alert you about leave approvals, attendance reminders, and other workflow events. You can disable notifications in Android settings without affecting other app functionality.
• Location. Captured only at the moment of an attendance punch when your employer has enabled geofencing. No continuous or background location tracking.
• Internet. Required to communicate with airohr.com servers.

The apps do not keep your data on the device beyond your sign-in session. What you enter or capture in them (details, photos, punch location, and face data on the Airo Lens kiosk) is sent securely to your employer’s AiroHR account and handled as described in sections 2–8 and 10.

10. Face Data & Biometric Information (Airo Lens)

When your employer enables Airo Lens, your attendance can be marked by face recognition on your employer’s Airo Lens kiosk (an Android tablet installed at the workplace). This section explains exactly how that face data is handled.

• Explicit consent first. Enrolment is done on the kiosk by your employer’s administrator. Your face data is saved only after the consent notice is shown on the kiosk and “I agree” is tapped. You can withdraw consent at any time by asking your employer’s HR team or emailing admin@airohr.com.
• What is stored. At enrolment the kiosk converts your face into a mathematical template (a numeric “embedding”) used only to verify it is you. The kiosk also uploads one face photo captured at enrolment, which is saved as your employee profile photo so HR can recognise your record. Each re-enrolment replaces that photo.
• Where matching happens. Face matching runs on your employer’s Airo Lens kiosk, not on your personal phone.
• Purpose limitation. Face data is used only to mark your attendance and to prevent proxy (“buddy”) punching, and the enrolment photo only as your profile photo. It is never used for advertising, profiling, surveillance, or any other purpose.
• Liveness / anti-spoofing. When your employer turns on liveness detection, the kiosk checks for a real, live person (for example a blink) before marking attendance.
• Security. Your face template is encrypted in transit and at rest on our servers, stored only against your employee record, and enrolment and deletion actions are logged.
• No sharing or sale. Face templates and photos are never sold or shared with third parties or advertisers.
• Retention & erasure. There is no self-service “delete my face data” option in the app. To delete your face data, ask your employer’s HR administrator (who can delete your face enrolment from the kiosk) or email admin@airohr.com. We delete your face template when you withdraw consent. It should be kept only while it is needed for attendance, so when you leave the organisation your employer can delete your enrolment from the kiosk, or you can ask for it. If you also want your profile photo removed, say so in your request.
• Your rights (DPDP Act 2023). You may access, correct, or request deletion of your face data, and raise a grievance with our Grievance Officer in section 13.

The kiosk camera is used only for enrolment and when attendance is marked at the kiosk.

11. Children

AiroHR is a workplace tool and is not meant for children under 18. We do not knowingly collect children’s data, except where an employer records a dependant’s or nominee’s details (for example for ESI or PF nomination) in the course of employment.

12. Changes to this Policy

We may update this Privacy Policy from time to time. The “Last Updated” date at the top shows when it was last changed.

13. Grievance Officer and Contact

If you have a question, complaint or request about your personal data, including access, correction, deletion or withdrawing consent, contact our Grievance Officer. We acknowledge complaints within 24 hours and resolve them within 15 days. If you are an employee of one of our customers, you can also contact your employer’s HR team, because your employer decides how your employment data is used. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

For any other question about this Privacy Policy, please contact us: