Privacy Policy

1. Who we are & scope

Zetta HRM is a multi-tenant human-resource management platform operated by Zettabyte Technology Inc. This policy covers our marketing site, web application, and related services (the "Service").

For personal data that a customer (an employer) uploads about its employees, the customer is the data controller and Zetta HRM acts as a processor on their behalf. For account and billing data we collect directly, we act as the controller.

2. Information we collect

• Account & profile data — name, work email, role, and authentication details.
• Company & employee records you enter — employee profiles, departments, designations, documents, and contacts.
• Operational HR data — attendance, leave, shifts, payroll, provident fund, loans, and separation settlements you process.
• Billing data — processed by our payment provider (Stripe). We do not store full card numbers.
• Usage & device data — log data, IP address, browser, and in-app actions, used for security and the audit trail.
• Cookies & similar technologies — used to keep you signed in and secure.

3. How we use information

• Provide, operate, and maintain the Service.
• Process the payroll, attendance, leave, and HR workflows you configure.
• Authenticate users and enforce role-based access and data scoping.
• Maintain audit trails, detect abuse, and keep the platform secure.
• Process subscriptions, trials, and billing.
• Send service, security, and support communications.
• Comply with legal, tax, and regulatory obligations.

4. Multi-tenant isolation & data ownership

Each company’s data is logically isolated from every other tenant. Your organization owns the data it submits. We access it only to provide, secure, and support the Service, or as instructed by you.

5. How we share information

We do not sell personal information. We share it only:

• With sub-processors that help us run the Service — payment processing (Stripe), cloud hosting, and email/SMS delivery — under appropriate contractual protections.
• With your company’s authorized administrators, according to role-based access.
• When required by law, or to protect the rights, safety, and security of users and the Service.
• In connection with a merger, acquisition, or asset transfer, subject to this policy.

6. Data retention

We retain data for as long as your account is active or as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce agreements. Customers may request export or deletion of their data, subject to legal retention requirements such as payroll and tax records.

7. Security

We protect information using layered safeguards. No method of transmission or storage is completely secure, but our controls include:

• Role-based access control with field-level data scoping.
• Route-level permission gates on every page and action.
• Encryption of data in transit.
• Audit logging of changes and access events.
• Strict tenant isolation and least-privilege access.

8. Your rights & choices

Depending on your jurisdiction, you may have rights to access, correct, export, or delete your personal data, and to object to or restrict certain processing.

Employees should direct such requests to their employer (the controller); we will assist our customers in responding. You can contact us to exercise rights relating to account data we control.

9. Cookies

We use essential cookies to keep you signed in and secure (for example, the session and company-context cookies) and limited functional cookies. We do not use advertising cookies.

10. International transfers

Your information may be processed in countries other than your own. Where required, we use appropriate safeguards for such transfers.

11. Children’s privacy

The Service is intended for use by businesses and is not directed to children. We do not knowingly collect personal information from children.

12. Changes to this policy

We may update this policy from time to time. Material changes will be posted on this page with a new “last updated” date.