Privacy policy

Vetanly is attendance, HR and payroll software for businesses, provided by Vetanly Technologies Private Limited, 37, Bajrang Soc., Near Aeristro villa Soc., Karamsad, Anand, Gujarat 388325, India ("Vetanly", "we", "us"). This policy covers the Vetanly website, the dashboard, the mobile app and the attendance kiosk app.

We hold personal data in two different roles:

• For our customers' employees, the employer that uses Vetanly decides what is collected and why. Under India's Digital Personal Data Protection Act, 2023 ("DPDP Act") the employer is the Data Fiduciary and we process the data on its behalf and on its instructions. Questions about your employer's use of your data should go to your employer first; we will help them answer.
• For people who sign up, visit our website or contact us, we are the Data Fiduciary and this policy applies to us directly.

Account details. Name, mobile number and, if you sign in with Google, the name and verified email address on your Google account.

Organization details. Business name, branches and their addresses, GSTIN and billing contacts, plan and invoices.

Employee records that an employer enters, depending on the features it uses:

• Identity and contact details: name, phone, email, date of birth, gender, blood group, address and emergency contact.
• Employment details: employee code, job title, department, branch, shift, joining and exit dates, manager.
• Attendance: check-in and check-out times, the kiosk or device used, and, when the employer turns on GPS check-in, the location and its accuracy at the moment of check-in.
• Face templates for kiosk attendance (see section 3).
• Payroll and statutory details: salary and its components, bank account and IFSC, PAN, UAN, PF and ESI details, tax regime and tax declarations, loans and advances, bonuses and final settlements.
• Leave, overtime, regularization requests, expense claims with their receipts, uploaded documents and company assets issued.

Technical data. IP address, the date and time of actions in the dashboard (kept in an audit log for the organization), and for kiosks the device model, app version and connection status.

Messages to us. Anything you send when you contact us for support or sales.

When an employer enrolls an employee on a Vetanly kiosk, the kiosk turns several camera frames into a face template: a list of numbers that describes the face. We do not store face photos. Templates are stored with the employer's data and copied to that employer's kiosks so that matching works on the device, including when it is offline.

• Templates are used only to recognize employees for attendance at their own employer's kiosks. They are never sold, shared with other customers or used to train models.
• Each kiosk runs a liveness check so that a photo held up to the camera is not accepted.
• An admin can revoke an employee's templates at any time. Revoked templates are no longer used for matching and are removed from the kiosks at their next sync. All templates are erased when the organization is deleted.
• The employer is responsible for informing employees and obtaining their consent before enrolling their face, as the DPDP Act requires. An employer should offer another way to mark attendance to anyone who does not consent.

• To provide the service: record attendance, calculate payroll and statutory deductions, produce payslips, reports and registers, and run the other features the employer turns on.
• To sign you in and keep accounts secure: sending one-time login codes, limiting repeated attempts and keeping an audit log.
• To send service messages, such as login codes, approvals and, when the employer turns them on, payslips and alerts by SMS, WhatsApp or email.
• To bill organizations and keep accounting records.
• To provide support, fix problems and improve the product.
• To comply with the law and respond to lawful requests from authorities.

We do not sell personal data, and we do not use it for advertising.

Inside an organization, people see data according to their role: employees see their own records, branch managers see their branches, and HR, admins and owners see more. The employer controls these roles.

We use service providers that process data for us under contract, only to run Vetanly:

• Cloud hosting, where the application and database run.
• SMS and WhatsApp providers, to deliver login codes and the messages an employer chooses to send.
• Google, if you choose to sign in with Google.
• Google Analytics, only if you accept analytics cookies on our website.
• Email delivery and file storage providers, when the related features are in use.

We may also disclose data when the law requires it, to protect people's safety, or as part of a merger or sale of our business, in which case this policy continues to apply.

• All traffic is encrypted with HTTPS.
• Bank account numbers, PAN and provider API keys are encrypted in the database; only the last digits are shown.
• Documents and receipts are private and opened through short-lived signed links.
• Access is limited by role and branch on the server, and every change is recorded in the audit log.
• Each kiosk has its own key, which can be rotated or disabled immediately.

No system is perfectly secure. If a breach affects your personal data, we will inform the affected organizations and, as the DPDP Act requires, the Data Protection Board of India.

See our security page for more.

• An organization's data is kept while its account is active, so that its attendance and payroll history remain available.
• When the owner deletes an organization, it is scheduled for deletion and erased, including its files, after a 30-day window in which the owner can change their mind.
• In-app notifications are deleted automatically after 90 days.
• Backups are overwritten in the normal backup cycle.
• Invoices and accounting records may be kept longer where tax law requires it.

Employers may have their own legal duty to keep payroll and attendance records for several years. They should export what they need before deleting their organization.

Under the DPDP Act you can ask for:

• a summary of the personal data held about you and how it is used;
• correction, completion or updating of inaccurate data;
• erasure of data that is no longer needed, unless the law requires it to be kept;
• withdrawal of consent, where processing is based on consent, without affecting what was done before;
• nomination of a person to exercise these rights if you die or become unable to;
• redressal of a grievance.

Employees should send requests to their employer, which controls their records; we will help the employer respond. For your own account, contact our Grievance Officer at support@vetanly.com. We aim to respond within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India.

The website uses Google Analytics cookies only if you accept them in the cookie banner. They tell us how visitors find and use the site, such as which pages are viewed and from which country; Google processes this data for us. If you reject them, or never choose, no analytics cookie is set. You can change your choice at any time with "Cookie settings" at the bottom of every page. The website uses no advertising cookies.

The dashboard stores your sign-in tokens in your browser's local storage to keep you signed in, and a cookie that remembers whether the sidebar is open. Signing out removes the tokens.

Vetanly is a workplace tool for adults. We do not knowingly collect data about anyone under 18. An employer that employs minors where the law allows is responsible for obtaining verifiable parental consent before entering their data.

We will update this page when our practices change and change the date at the top. For significant changes, we will also notify organization owners in the dashboard or by message.

For questions about this policy or to exercise your rights, contact our Grievance Officer at support@vetanly.com.