Privacy policy

Kaerva is company management software. Companies use it to run their HR and administration — and that means companies entrust us with information about their employees. We take that seriously. This page explains, in plain language, what we collect and how we handle it.

What we collect

Account information — when a company registers: the owner's name, username and email, and the company name. Employees who are given access have their own accounts with the same details.

Company records — the information a company enters to run its operations: employee profiles (names, contact details, addresses, dates of birth, emergency contacts, identifiers the company chooses to record), departments and reporting lines, attendance and leave, approvals, letters, salary and payroll-related data, announcements, policies and uploaded documents. This data belongs to the company. The company is the data controller; Kaerva processes it on the company's behalf and only on its instructions.

Enquiries — messages sent through our contact form, with the contact details you provide.

Employee data

Employee records are sensitive. Each company is responsible for collecting and using its employees' personal data lawfully, consistent with India's Digital Personal Data Protection Act, 2023 and any other law that applies to it. We process that data only to provide the service to the company — never for advertising, profiling, or sale. Role-based access inside the product means HR, finance and employees each see only what their role allows, and every change is written to an audit trail.

How data is stored

Records are stored in a managed MongoDB database, scoped to the company that created them. Uploaded files (photos, documents, generated letters) are stored on Cloudflare R2 under keys prefixed per company. Transactional email (password resets, approvals, notices) is delivered through Cloudflare Email Sending. Passwords are stored only as salted bcrypt hashes — we cannot read them. Deleted records sit in a recycle bin the company controls before they are permanently removed.

What we never do

We do not sell personal data. We do not show ads. We do not share company records with third parties except the infrastructure providers named above, strictly to run the service.

Data ownership & deletion

The company owns its data. Companies can export their records (CSV exports are built into the product) and can request full deletion of their account and records at any time via our contact page. Employees who want to see, correct or remove their own data should contact their company, which controls the record.

Changes & contact

If this policy changes materially, company owners will be notified by email. Questions? Reach us through the contact page.