This Privacy Policy (“Policy”) describes how TruHR (“TruHR”, “we”, “us”, or “our”), a product of [Legal Entity Name Pvt. Ltd.] operated by Diyos Infotech, collects, uses, stores, shares and protects personal data in connection with (a) the truhr.ai website and our marketing, advertising and sales activities — including campaigns run on Meta (Facebook/Instagram), Google Ads and LinkedIn — and (b) the TruHR human resource management system (“Platform” or “Service”) that we provide to organisations (“Customer”, “you”, or “your employer”) to manage their workforce, including attendance, leave, payroll and related HR functions.
We know TruHR sits at the intersection of “the Mud” — real ground-level operations across sites, shifts and field teams — and “the Sky” — the clarity leadership needs to trust their data. That trust starts with how carefully we handle personal information. This Policy is written to be read by four audiences: the organisations that buy TruHR, the employees whose data flows through it, visitors to our website, and people who encounter our advertising on third-party platforms.
This Policy is drafted with reference to India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”) and its rules, the Information Technology Act, 2000 and Information Technology Rules, 2011, and general international privacy principles (including the EU GDPR and the US California Consumer Privacy Act (CCPA), where relevant to our customers, their employees, or website visitors).
1. Two Roles TruHR Plays
Personal data flows through TruHR in two distinct capacities, and your rights and our obligations differ depending on which one applies:
- Data Processor (for Platform/HRMS data): When your employer (the “Customer”) uses TruHR to manage attendance, payroll, leave and related HR records, the Customer is the Data Fiduciary/Controller under the DPDP Act, and TruHR acts as a Data Processor, processing personal data strictly on the Customer’s documented instructions and under a data processing agreement with them.
- Data Fiduciary/Controller (for website, sales and advertising data): When you visit truhr.ai, fill a demo request or lead form, subscribe to updates, interact with our advertising on Meta, Google or LinkedIn, or communicate with our sales team, TruHR is the Data Fiduciary and determines how that data is used.
If you are an employee of a company that uses TruHR and you have a query about your HR data, your primary point of contact is your employer’s HR team; TruHR supports them in fulfilling such requests.
2. Information We Collect
The table below summarises the categories of personal data TruHR processes, whether as Processor (Platform use) or Fiduciary (website, sales and advertising use).
| Category | Examples | Why we collect it |
|---|---|---|
| Account & Identity Data | Name, work email, phone number, employee ID, designation, department, reporting manager | To create and administer user accounts and role-based access within TruHR |
| Employment & HR Data | Attendance, shift and roster records, leave balances and requests, payroll and salary structure, statutory IDs (PAN, Aadhaar last 4 digits, PF/ESI/UAN where applicable), performance and appraisal records | To deliver the core HRMS functions your employer has engaged TruHR to provide |
| Location & Device Data | GPS check-in/check-out location (for field or multi-site staff), IP address, device type, geo-tagged attendance punches; on our mobile app, device information, app usage patterns and location (where permission is granted) | To support field-force attendance, site verification and fraud prevention |
| Usage & Technical Data | Log-in timestamps, pages/features used, browser type and operating system, referral source, cookies and similar identifiers on truhr.ai | To operate, secure and improve the platform and website |
| Communications Data | Support tickets, emails, in-app chat, call recordings (where notified) | To respond to queries and provide customer support |
| Sales & Website Visitor Data | Name, company, company size, job title/industry, email, phone number submitted via demo/contact/lead forms; preferred contact method and time; message or enquiry details | To respond to enquiries, schedule demos, qualify leads and measure website performance |
| Advertising & Remarketing Data | Pixel and tag data from Meta Pixel, Google Analytics/Ads and the LinkedIn Insight Tag; conversion and lead-attribution data (including UTM parameters); remarketing and lookalike-audience signals; device and behavioural signals shared by ad platforms | To run, measure and optimise our marketing campaigns on Meta, Google and LinkedIn, and to attribute leads to the correct source |
We do not knowingly collect sensitive categories of data beyond what is necessary for statutory HR compliance (e.g., PF/ESI/UAN, bank account details for payroll disbursal, or biometric identifiers only where a Customer has explicitly enabled biometric attendance and has obtained the necessary consent from its employees). We do not use advertising data to build audiences based on sensitive categories (health, religion, caste, sexual orientation, or similar), and we do not permit discriminatory ad targeting on any platform.
3. How We Use Information
- Provisioning and administering the TruHR Platform for the Customer, including attendance capture, leave management, payroll processing and reporting
- Verifying identity and enforcing role-based access controls so field staff, managers, HR and leadership each see only what they are authorised to see
- Detecting attendance fraud (e.g., location spoofing, buddy punching) and maintaining audit trails for compliance
- Generating statutory reports and filings that the Customer is legally required to produce
- Responding to support requests, resolving technical issues and maintaining Platform uptime and security
- Improving the Platform, developing new features, and understanding aggregate/anonymised usage trends
- Responding to demo and lead-form requests, qualifying and routing leads, sending product updates and marketing communications (with an opt-out available at all times), and website analytics
- Running targeted advertising, remarketing and lookalike-audience campaigns on Meta, Google and LinkedIn, and measuring their effectiveness and return on investment
- Complying with applicable law, regulatory requests, and enforcing our agreements
4. Advertising, Remarketing and Third-Party Ad Platforms
We advertise TruHR on Meta (Facebook/Instagram), Google Ads and LinkedIn. This section explains how that advertising works and how we comply with each platform’s policies.
4.1 How We Use Advertising Data
- Creating targeted advertising campaigns on Meta, Google and LinkedIn
- Building lookalike and custom audiences based on website visitors and past leads
- Delivering personalised ads about TruHR services to relevant audiences
- Measuring campaign effectiveness, conversions and return on investment
You can opt out of personalised advertising at any time through the platform settings described in Section 8.3 below.
4.2 Meta (Facebook/Instagram) Compliance
- We comply with Meta’s Data Use Policy and Community Standards
- We do not collect data for discriminatory targeting
- We honour user preferences and opt-out requests
- We use the Meta Pixel for conversion tracking and audience building, with proper disclosure
4.3 Google Ads Compliance
- We comply with Google’s advertising policies and restricted-category requirements
- We do not engage in healthcare or other sensitive-category targeting violations
- We honour user privacy preferences and browser settings (e.g., Chrome privacy features)
- We implement Google Analytics with appropriate user-consent mechanisms
- We comply with Google’s requirements on sensitive personal information
4.4 LinkedIn Compliance
- We comply with LinkedIn’s User Agreement and Terms of Service
- We use the LinkedIn Insight Tag for conversion tracking and audience insights
- We do not scrape LinkedIn data or otherwise violate its Terms of Service
- We respect LinkedIn’s restrictions on automated data collection
- We honour user privacy choices regarding personalised advertising
4.5 Do Not Track (DNT)
We respect browser-based Do Not Track signals where applicable. However, some tracking technologies may continue to operate where necessary for site functionality and legal compliance.
5. Legal Basis for Processing
Where TruHR acts as Data Fiduciary (website, sales and advertising data), we process personal data on the basis of your consent (e.g., submitting a demo or lead form, or engaging with our ads) or for a “legitimate use” recognised under the DPDP Act, such as responding to a request you have voluntarily made.
Where TruHR acts as Data Processor (Platform/HRMS data), the Customer is responsible for establishing a valid legal basis with its employees, typically consent obtained at onboarding, or performance of the employment contract and compliance with labour law obligations (such as the Payment of Wages Act, Shops and Establishments Acts, PF/ESI regulations, and applicable state-specific labour legislation).
6. Sharing and Disclosure
- With the Customer’s authorised administrators and managers, strictly as configured by the Customer’s role-based access settings
- With sub-processors who support us in delivering the Platform and our marketing, such as cloud hosting providers, SMS/email/notification gateways, payment or payroll disbursal partners, our CRM, and advertising and analytics platforms (Meta, Google, LinkedIn, Google Analytics and similar heat-mapping or email-marketing tools) — each bound by contractual confidentiality and data protection obligations
- With statutory authorities, where a Customer instructs us to generate filings, or where disclosure is required by law, regulation, court order, or governmental request
- With professional advisors (auditors, legal counsel) under confidentiality obligations, or in connection with a merger, acquisition, or sale of business assets, subject to equivalent privacy protections
- With your consent, for any other purpose you have specifically authorised
We do not sell personal data. We share personal data only in the following circumstances:
7. Data Storage, Security and International Transfers
Personal data processed through TruHR is hosted on cloud infrastructure and protected through a multi-level security structure, including:
- Encryption of data in transit (TLS/SSL) and at rest
- Role-based access controls, so only authorised personnel access production data on a need-to-know basis
- Activity logging and regular security reviews, including periodic vulnerability assessments and penetration testing
- Regular employee training on data protection best practices
Where data is stored or processed outside India (for example, via a global cloud provider’s data centres, or by our advertising and analytics partners), we take contractual and technical measures to ensure the data receives a comparable standard of protection, consistent with the DPDP Act, GDPR and CCPA as applicable, and any restrictions the Central Government may notify from time to time.
No method of transmission or storage is 100% secure. We continuously work to strengthen our safeguards but cannot guarantee absolute security.
8. Data Retention
- Platform/HRMS data is retained for as long as the Customer’s subscription is active, and thereafter for the period specified in our agreement with the Customer or as required by applicable labour, tax and statutory record-keeping laws (commonly several years for payroll and statutory records)
- Upon termination of a Customer’s subscription, data is retained for a defined transition window to allow export, after which it is securely deleted or anonymised, unless a longer period is legally mandated
- Marketing and sales leads are retained for up to 2 years, or until you opt out, whichever is earlier
- Customer account data is retained for the account duration plus 3 years post-closure, for compliance purposes
- Website analytics data is typically retained for 26 months (configurable in our analytics settings)
- Advertising data (pixel/tag data held by Meta, Google and LinkedIn) is retained by those platforms in line with their own policies, typically 120–180 days
- Website and other sales enquiry data is retained for as long as reasonably necessary to respond to your enquiry and for a limited period thereafter for record-keeping, unless you request earlier deletion
Longer retention periods may apply where required by law or for legitimate business purposes.
9. Cookies and Tracking on truhr.ai
Our website uses cookies and similar technologies, including advertising pixels and tags, to remember your preferences, understand how visitors use the site, and measure the effectiveness of our marketing. We use the following categories:
- Essential Cookies — required for the site to function (e.g., authentication, security)
- Functional Cookies — remember your preferences and improve your experience
- Analytics Cookies — help us understand how visitors use our site
- Marketing Cookies — enable personalised advertising and retargeting, including via the Meta Pixel, Google Analytics/Ads tags and the LinkedIn Insight Tag
You can control or disable cookies through your browser settings; most browsers let you accept or reject cookies, delete existing cookies, or receive a notification when cookies are set. Disabling essential cookies may affect site functionality.
10. Your Rights
Subject to applicable law, you may have the following rights. Which rights apply, and whether you exercise them against TruHR directly or through your employer, depends on whether TruHR is acting as Data Fiduciary or Data Processor for the relevant data.
| Right | What it means |
|---|---|
| Right to Access | Request a copy of the personal data we (or, where TruHR is a processor, your employer as Data Fiduciary) hold about you. |
| Right to Correction | Ask us to correct inaccurate or incomplete personal data. |
| Right to Erasure | Request deletion of personal data that is no longer necessary for the purpose it was collected, subject to statutory retention requirements. |
| Right to Grievance Redressal | Raise a complaint about how your personal data has been processed and receive a response within the timelines prescribed under the DPDP Act. |
| Right to Nominate | Nominate another individual to exercise these rights on your behalf in the event of death or incapacity, as provided under the DPDP Act. |
| Right to Withdraw Consent | Withdraw consent for processing that is based on consent, without affecting the lawfulness of processing carried out before withdrawal. |
Employees of a Customer should generally route these requests through their employer’s HR team, who will coordinate with TruHR as needed. Website visitors and prospects can exercise these rights by contacting our Data Protection/Grievance Officer directly (see Section 15).
10.1 Marketing Communications
- Opt out of promotional emails by clicking the unsubscribe link in any message
- Adjust notification preferences in your account settings
- Request removal from our marketing lists by writing to us (see Section 15)
10.2 Advertising Preferences
- Meta: adjust ad preferences under Settings > Ads
- Google: manage ad preferences via Google Ads Settings or My Ad Center
- LinkedIn: control advertising preferences under Settings > Advertising
11. Forms, Enquiries and Communication Preferences
When you voluntarily send us an email or fill out a form on truhr.ai (for example, to request a demo, download a resource, or contact our team), we keep a record of that submission so we can respond to you, and we use UTM parameters and CRM integrations to track how the lead reached us. We only collect information through truhr.ai when you choose to register or fill out a form on the site; you are free to browse the website anonymously without submitting any personal information.
Forms on our site may ask you to share details such as your name, email address, phone number, company name, company size, job title and industry, along with your preferred contact method or time.
Where you have voluntarily submitted your personal information and contact details through such a form or email, we reserve the right to contact you about TruHR’s products, features and offers by call, SMS, email or WhatsApp, including to schedule a demo. This includes contact where your registered mobile number is enrolled under the National Customer Preference Register / Do Not Disturb (DND) service, to the extent permitted for transactional and business communications under applicable telecom regulations.
You can ask us to stop such communications at any time by using the unsubscribe/opt-out option provided in our messages, or by writing to us at the contact details in Section 15. We will honour opt-out requests as required by law.
12. Children’s Privacy
TruHR is a workplace product intended for use by adult employees of our Customers and is not directed at children. We do not knowingly collect personal data from individuals under 18 years of age through our website, platform or advertising. If we become aware that we have inadvertently collected such data, we will take steps to delete it promptly.
13. Automated Decision-Making
TruHR may use automated logic to flag anomalies (for example, unusual attendance patterns or potential location spoofing) for human review by the Customer’s HR/admin team. We do not use fully automated decision-making to take adverse employment action without human oversight.
14. Changes to This Policy
We may update this Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. We will post the revised Policy on this page with an updated date, and for material changes, we will provide additional notice (such as an email or in-app notification) where required by law. Continued use of our website, Platform, or engagement with our advertising after an update constitutes acceptance of the revised Policy.
15. Governing Law and Contact Us
- Email: support@diyostech.com
- Phone: +91 7799799706
- Address: Diyos Infotech (TruHR Development Team), M One, Plot No: 29, 3rd Floor, Matha Bhuvaneswari Society, near Yashoda Hospital, Madhapur, Hyderabad, Telangana 500081
This Policy is governed by the laws of India, including the Information Technology Act, 2000, the Information Technology Rules, 2011, and the DPDP Act, and, where applicable, the GDPR and CCPA. Any disputes arising out of or in connection with this Policy shall be subject to the exclusive jurisdiction of the courts at Hyderabad, India.
For privacy inquiries, data requests, or concerns, please contact our Data Protection/Grievance Officer:
