Peoplo is a cloud HRMS (attendance, leave, payroll and onboarding) operated by the operator of Peoplo ("we"). This policy explains what personal data the service handles, why, who can see it, and what choices you have. It applies to the Peoplo website and to the workspaces our customers run on it.
1. Two roles: your employer and us
Each company that uses Peoplo creates its own workspace and decides what employee data goes into it. For that employee data, the company is the "data fiduciary" (the party that decides why and how it is used, in the language of India's Digital Personal Data Protection Act, 2023), and we act as its service provider, processing the data on its instructions. For the account details of the people who sign up a workspace, and for visitors to this website, we decide the purposes ourselves.
If you are an employee, your employer is your first point of contact for questions about your attendance, payroll or documents.
2. What data is handled
- Account data: name, work email address, role, job title and reporting line. Passwords are stored only as one-way hashes, never in readable form.
- Attendance data: the time of each check-in or check-out, the GPS location and its accuracy, the distance from the assigned site, and a selfie photo, captured only when the employee checks in or out. Punches that come from biometric machines or an API are stored with the device or system name.
- HR records your employer enters: leave, on-duty and regularisation requests, salary structure and payslips, bank details, statutory identifiers (such as PAN, Aadhaar number, UAN and ESIC number), education and employment history, emergency contacts, uploaded documents and profile photos.
- Onboarding and hiring data: details, documents, a selfie and a location submitted through an invite link, and application forms from job candidates.
- Technical data: IP address and device identifiers in server logs, the time a biometric device was last seen, and the session cookie described in section 8.
3. Why it is used
To provide the service: verifying attendance, running approvals, calculating payroll, issuing payslips and offer letters, sending notifications, keeping the service secure and billing for subscriptions. We do not sell personal data and do not use it for advertising.
4. Location and selfies
Location and a selfie are requested when an employee taps Check in, and the browser asks for permission first. They are used to show a manager where and when a punch was made. Selfies, documents and photos are stored privately and are shown only to the employee, to HR and administrators of that workspace, and to managers above the employee in the reporting line. They are not public and are not indexed by search engines.
Employers decide whether to require them. Employers are responsible for telling employees what is collected and why, and for having a lawful basis (such as consent or a legitimate use for employment purposes) under the DPDP Act 2023 and other applicable law. We recommend giving employees a written notice before enabling location and selfie attendance.
5. Who we share data with
- The customer's own people, according to the roles and reporting lines the customer sets up.
- Service providers that help us run the service: hosting and infrastructure; a payment gateway for subscription payments (we do not store card or bank-account details); and, only if a customer switches it on, WhatsApp messaging through that customer's own AiSensy account, which receives the recipient's phone number and the message content.
- Authorities where the law requires it.
Each customer's workspace is kept separate: users in one company cannot see another company's data.
6. How long data is kept
Workspace data is kept while the workspace is active and, if a subscription lapses, while the workspace remains locked so that the customer can come back. A customer may ask us to delete its workspace; we will do so and remove its uploaded files. Employers decide how long to keep individual employee records, and statutory retention duties (for example for payroll records) remain theirs.
7. Security
We use measures such as hashed passwords, HTTPS, per-company separation of data, access checks on every private file and sign-in protection. No system is perfectly secure, and we cannot promise that data will never be accessed without authorisation. Choose strong passwords and remove access for people who leave.
8. Cookies and local storage
The public pages set no cookies. Signing in to a workspace sets one strictly necessary session cookie, and the app stores check-ins you make while offline in your browser until they are sent. We use no advertising or tracking cookies.
9. Your rights
Under the DPDP Act 2023 you may ask to access your personal data, have it corrected or erased, withdraw consent where processing is based on consent, nominate someone to exercise your rights, and make a complaint. For employee data, ask your employer first. For data we control, or if your employer does not respond, contact us using the details below. If you are not satisfied with our response you may complain to the Data Protection Board of India.
10. Children
Peoplo is a business tool for employees and is not directed at children.
11. Changes
We may update this policy as the service changes. The date at the top shows the latest version, and material changes will be announced to workspace administrators.
12. Contact
Contact details for privacy questions and complaints are available from your workspace administrator.