Privacy policy
1. Who we are
Hvexa is an HR software service operated by Orvexa AI Technologies Pvt Ltd ("Hvexa", "we"), registered office 209, Kohinoor Enclave, Jalandhar, Punjab, India - 144009. Questions about this policy: privacy@orvexatechnologies.com.
2. Our role
Companies use Hvexa to run HR for their employees. For employee data, your employer decides what is collected and why (it is the Data Fiduciary under India's Digital Personal Data Protection Act, 2023), and Hvexa processes that data on its instructions (as a Data Processor). For people who visit this website or contact us, and for the administrators who manage a company's account, Hvexa is the Data Fiduciary.
If you are an employee, please contact your employer's HR team first about your data. We will help them answer you.
3. What we collect
| Who | Data |
|---|---|
| Website visitors | If you ask for a demo or a license: your name, work email, mobile number, company, company size, the plan or demo date you choose, your message, the campaign link you came from, and your IP address (to stop abuse). Anything you send us by email. This website uses no analytics or advertising cookies. |
| Company administrators | Name, work email and phone, company details, billing details, and how you use the admin portal. |
| Employees (on behalf of the employer) | Name, employee code, work email and mobile number, designation, role, manager, location, department and grade, joining and leaving dates; emergency contacts you or your employer add (their name, relation and phone number); documents your employer uploads, such as ID and address proof, PAN, education and experience letters, offer letters and contracts; leave requests; attendance punches with time, device information and, when you punch, the location reported by your phone (if you allow it); a selfie photo, only when your location can't be confirmed and you allow selfies, kept 90 days; your answers to the location and selfie questions, with when you gave them; expense claims, advances and the receipt photos or PDFs you add; help desk tickets and the messages in them; announcements you post, your comments and reactions, and which posts you have opened; reports you make about a post or comment and the people you block; your date of birth, only if you choose to add it to show your birthday; payslips your employer uploads (pay, deductions and details such as paid days and a masked bank account) and when you first opened each; the notifications Hvexa sends you, whether you have read them, and your choices about push and email; other HR records your employer keeps in Hvexa. |
| People who use Ask Hvexa | Your questions and Hvexa's answers, with any requests it prepared, visible only to you and deleted 30 days after your last message. |
| HR and managers who run reports | Which reports you download (report, dates, filters and number of rows), kept in the audit log, and the scheduled reports you set up or receive. |
| Everyone who signs in | Your mobile number or email, to send a one-time sign-in code; the device name you sign in from; if you turn on notifications in the app, the push token your phone gives us, kept only while you stay signed in on that phone. |
Location and selfies. The app reads your location only when you punch in or out, and on iPhone only with "While Using the App" permission. We do not track your location in the background. Before the first reading, and before the first selfie, the app asks whether you allow it. Saying no never stops you punching: the punch is saved without it and your manager sees "No location" or "Selfie not taken". The blink check on a selfie runs on your phone, and we do not build a face template. You can change either answer at any time in the app's Privacy centre (Me › Privacy centre) or in the admin portal, and every answer is kept with its date.
Privacy centre. In the app and the admin portal you can see what you have agreed to, see why a punch of yours was flagged and what you can do about it, and download a copy of your own data (an Excel workbook and the same data as JSON). The copy holds what is about you and what you could already see in Hvexa; selfie photos and documents are listed rather than included. Each download is recorded in the audit log.
Announcements and comments. What you post or comment is seen by everyone the post was meant for (the whole company, a location or a team). The author of a post and your HR team can see who has opened it. If you share your birthday, colleagues see only the day and month, never the year, and you can turn it off at any time. Reports you make are seen by your HR team, not by the person you reported.
Notifications. Hvexa tells you when something needs you or changes on your own requests (an approval waiting, a decision, a help desk reply, a new announcement, a payslip ready, and for HR a reported post). Every notification is in the app's inbox. Push notifications and emails are optional and you choose them per kind in Settings; the app asks for permission only when you tap "Turn on". Push notifications can show on your lock screen, so we keep them short: a payslip notification never shows amounts, and a confidential help desk ticket shows only its number. Signing out removes your phone from push.
Payslips. Your employer uploads payslips from their payroll register or payroll provider; Hvexa does not calculate your pay. Only you and the HR people your employer allows to manage payslips can see yours; your manager cannot. Each time HR opens someone else's payslip it is recorded in the audit log. Downloaded payslip PDFs are not password protected, so keep them safe once saved to your device.
No surveillance. Hvexa does not log keystrokes, take screenshots or produce individual productivity scores.
4. How we use it
- To provide the service your employer has set up: sign-in, leave, attendance, approvals and related HR work.
- To send sign-in codes: first on WhatsApp, then by SMS or to the email on file if WhatsApp does not work.
- To send the invitation to join Hvexa when your employer asks us to (on WhatsApp or by email). It contains no password or code.
- To handle expenses: checking claims against your employer's limits, spotting a receipt used twice, and recording payments.
- To run the help desk: routing your ticket to the right people, tracking response times and keeping the conversation.
- To run announcements safely: showing posts to the right people, filtering abusive words, and letting HR act on reports (hiding content and pausing comments), as app store rules on user content require.
- To send you notifications in the app, as push notifications and by email, as you choose.
- To give your HR team and managers reports (attendance, leave, expenses, headcount) and Excel downloads of them. Managers see only the people who report to them; leave reasons are never in reports. Scheduled reports are not emailed as files: the email only says a report is ready, and it opens after sign-in.
- To keep accounts secure: rate limits, detecting stolen sessions, and audit logs of changes.
- To answer support requests from your company’s HR team or owner: the message, who sent it, the company and the app version go to our support inbox by email.
- To answer demo and license requests from this website: we contact you about your request only, and do not add you to marketing lists without asking.
- To support and bill our customers, and to meet legal obligations.
5. AI features
- Hvexa uses AI to help with routine HR tasks, such as understanding a leave request written in your own words or checking whether an attendance punch looks unusual.
- Receipt reading is on unless your employer turns it off. When it is on, the photo of a receipt you add is sent to the AI model to fill in the date, amount, shop and category for you to check. The model is told not to return personal details, and you can always change what it filled in.
- Ask Hvexa is on unless your employer turns it off. It answers questions from the records you can already see in Hvexa (your leave, attendance, expenses and help desk tickets; for managers, their team's leave and what waits for their approval) and can prepare a request for you to check. Nothing is sent unless you confirm it. People's names are replaced with placeholders before anything goes to the AI model and put back on our servers; pay and payslip amounts are never sent. Your chats are visible only to you (not to your employer), are deleted 30 days after your last message, and you can delete them yourself at any time. Your employer's audit log records only that a question was asked, not what it said.
- We send AI models the least data needed. Free text is scrubbed of email addresses, phone numbers, Aadhaar and PAN numbers first, and we never send Aadhaar, PAN or bank details.
- Today some AI tasks use Google's Gemini API under paid terms, where Google does not use the data to improve its products. We are moving these tasks to our own Orvexa models, trained on labelled, de-identified examples.
- AI never makes the final decision on hiring, firing or pay. Where your employer lets Hvexa approve routine requests automatically, every decision records its reasons and can be reviewed and reversed by a person.
- Mood and attrition insights are shown only for teams of five or more people, never for individuals.
6. Who we share it with
We do not sell personal data. We share it only with your employer (for employee data) and with these service providers, who process it for us under contract:
| Provider | Purpose | Location |
|---|---|---|
| Amazon Web Services | Hosting and storage | [AWS Region, e.g. Mumbai, India] |
| Meta (WhatsApp Business Platform) | Sign-in codes and WhatsApp messages | Meta's global infrastructure |
| [SMS provider] | Sign-in codes by SMS | India |
| Resend | Sign-in codes, service emails, notification emails and notifying our sales team of your request | United States |
| Expo (650 Industries) | Delivering push notifications to phones, through Apple and Google: the notification text and your phone's push token | United States |
| Google (Gemini API) | AI processing described in section 5 | [Region per Google's terms] |
We may also disclose data where Indian law requires it.
7. Where it is stored and for how long
- HR data is stored in India. Some providers above process limited data, such as a phone number or email for a sign-in code, outside India, as permitted by law.
- Demo and license requests are kept while we are in touch about them and deleted within [12] months of the last contact unless you become a customer.
- Sign-in codes expire after 5 minutes and are stored only in scrambled (hashed) form. You stay signed in for up to 30 days of inactivity.
- Employee data is kept for as long as your employer's contract with us lasts, and returned or deleted within [90] days after it ends, unless the law requires us to keep it longer.
8. How we protect it
Encryption in transit; each company's data kept separate and checked on every request; sign-in codes and tokens stored only as hashes; role-based access; and audit logs of changes and AI decisions. No system is perfectly secure. If a breach affects your data, we will inform the affected customers and the Data Protection Board of India as the law requires.
9. Your rights
Under the DPDP Act you can ask for a summary of your data and how it is used, ask us to correct, complete or erase it, withdraw consent where processing is based on consent (for location and selfies, in the Privacy centre), download a copy of your own data from the Privacy centre, nominate someone to act for you, and raise a grievance. Employees should start with their employer; everyone else can write to privacy@orvexatechnologies.com.
10. Grievance officer
Priya Thakur, Grievance Officer, Orvexa AI Technologies Pvt Ltd, 209, Kohinoor Enclave, Jalandhar, Punjab, India - 144009 · office@orvexatechnologies.com. We will respond within the time required by law. If you are not satisfied, you may complain to the Data Protection Board of India.
11. Children
Hvexa is a workplace service for adults. We do not knowingly collect data about anyone under 18.
12. Changes
We will post any change here with a new effective date, and tell customers by email about important changes.