Privacy Policy

This is the privacy policy for the Greenlit Android app (com.greenlit.app) and the Greenlit web service (https://greenlit-three.vercel.app).

Effective date: 16 June 2026

1. Introduction & roles

Greenlit ("Greenlit", "we", "us") provides a multi-tenant HR & Payroll software-as-a-service product for Indian companies. The Greenlit Android app is a native shell that loads our live web service in a secure WebView; there is no separate mobile backend.

Greenlit is a business-to-business service. In the language of India's Digital Personal Data Protection Act, 2023 (DPDP Act):

• The customer — the employer/company that subscribes to Greenlit — is the Data Controller (Data Fiduciary). The employer decides what employee data is entered and for what purpose.
• Greenlit acts as the Data Processor on behalf of the Data Fiduciary. We process personal data only on the documented instructions of the customer, to operate the service.

Employee records are created and managed by the employer's HR or admin users. Employees do not self-register. If you are an employee and have questions about your data, please contact your employer's HR/admin first; we can also be reached at the address in Section 12.

2. Information we collect

We collect and process the following categories of personal data, all entered by, or generated on behalf of, the employer customer:

Account & contact information

• Employee name, work email address, phone number
• Date of birth, gender, address
• Reporting manager
• Login credentials: email and password (passwords are stored only as a secure hash; sessions are managed via Auth.js v5)

Statutory identifiers

• PAN
• Aadhaar number
• UAN (Provident Fund)
• ESI number

Aadhaar and bank account numbers are masked in the user interface to the last 4 digits and are never written to application logs.

Financial & payroll data

• Salary structures and CTC
• Payslips
• Bank account number and IFSC
• Statutory computations: Provident Fund (PF), Employees' State Insurance (ESI), Professional Tax (PT), and Tax Deducted at Source (TDS)
• Tax declarations

Attendance & leave data

• Attendance (clock-in/clock-out times, hours worked)
• Leave applications and balances
• Expenses, assets, and performance records

Technical & diagnostic data

• Error and performance telemetry used to keep the service reliable. Personal data in diagnostics is scrubbed or minimised.

The Android app requests the INTERNET permission only. It does not access device location, contacts, SMS, camera, or microphone.

3. How we use information

We use the information above solely to operate and support the service, including to:

• Provide HR and payroll functionality to the employer customer (people records, attendance, leave, payroll runs, payslips, expenses, assets, performance)
• Compute statutory deductions and generate compliant documents
• Authenticate users and maintain secure sessions
• Send transactional communications (invitations, notifications)
• Maintain audit logs of financial mutations for accountability and integrity
• Diagnose errors and monitor performance to keep the service secure and reliable

We do not use personal data for advertising, ad targeting, or profiling, and we do not sell personal data.

4. Legal basis

As the Data Processor, we process personal data on behalf of, and on the instructions of, the employer customer (the Data Fiduciary). The customer is responsible for establishing the appropriate legal basis under the DPDP Act, 2023 for the data it enters. Typical bases relied upon are:

• Performance of the employment relationship / contract — to administer HR and payroll for employees.
• Compliance with a legal obligation — to meet statutory payroll, tax, and labour obligations under Indian law (e.g. PF, ESI, PT, TDS).
• Consent, where required, obtained by the employer from its employees.

We do not determine these purposes ourselves; the customer does.

5. Sub-processors

We use the following sub-processors to operate the service. Each is bound to process data only as needed to provide its function:

6. Data sharing & disclosure

We do not sell personal data. We do not use it for advertising or ad targeting. We do not share it with third parties except the sub-processors listed in Section 5, who process it only to operate the service on our behalf.

We may disclose data where required to comply with applicable law or a valid legal request, or to protect the rights, safety, and security of users and the service.

7. International transfers

Our primary database is hosted in an India region (Mumbai, ap-south-1) or Singapore. Some sub-processors (Vercel, Sentry, Resend) operate from, or route through, infrastructure outside India, principally the United States. Where personal data is transferred outside India, we rely on the contractual protections of these sub-processors and process such data only as needed to deliver the service, consistent with the DPDP Act, 2023.

8. Security

• In transit: all traffic is encrypted using HTTPS/TLS. The Android shell sets usesCleartextTraffic=false, so no unencrypted traffic is permitted.
• At rest: data is encrypted at rest by our storage providers.
• Masking: Aadhaar and bank account numbers are masked to the last 4 digits in the UI and are never written to application logs.
• Access control: role-based access control with Admin, HR, Manager, and Employee roles restricts each user to the data appropriate to their role.
• Auditing: financial mutations are recorded in an audit log (actor, entity, before/after) for accountability.

No system is perfectly secure, but we apply these measures to protect personal data against unauthorised access, alteration, disclosure, or destruction.

9. Data retention & deletion

• Customer data is retained for the life of the company's subscription.
• On account or workspace closure, or on written request to the address in Section 12, data is deleted within 90 days.
• Encrypted backups (point-in-time recovery and nightly dumps) are retained on a rolling window of approximately 30 days, after which they expire automatically.

10. Your rights

Under the DPDP Act, 2023 you may have the right to access, correct, and request erasure of your personal data, and to grievance redressal.

Because Greenlit processes employee data on behalf of the employer (the Data Fiduciary), the most direct route to exercise these rights is through your employer's HR/admin, who controls your records. You may also contact us at the email in Section 12, and we will assist the relevant employer customer in responding to your request.

11. Children

The service is a workplace tool intended for employees and other adults. It is not directed to children under 13, and we do not knowingly collect personal data directly from children.

12. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by updating the effective date at the top of this policy and, where appropriate, by notifying customers. Continued use of the service after an update constitutes acceptance of the revised policy.

13. Contact