This page is not fully configured yet: set PLATFORM_LEGAL_NAME, PLATFORM_PRIVACY_EMAIL and PLATFORM_ADDRESS in the server environment.

Privacy Policy

Last updated: 23 September 2026

This policy explains how [legal name] ("ThirdEyee", "we") handles personal data in the ThirdEyee workforce-management platform, in line with India's Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025.

1. Two different roles

Employee monitoring data. When an organisation (your employer) uses ThirdEyee, that organisation decides what is collected about its people and why. It is the Data Fiduciary; we process that data only on its instructions, as its Data Processor. If you are an employee, your employer's monitoring notice (shown when you first sign in) and your employer's policies apply, and requests about that data go to your employer — you can raise them from the My Data page.
Account and billing data. For the people who sign up and administer a workspace, and for billing, we decide how the data is used and are the Data Fiduciary.

2. What we process

Account data: name or username, work email, company name, role, hashed password, sign-in records.
Billing data: plan, seats, invoices and payment status. Card and UPI details are handled by our payment provider (PhonePe); we never see or store them.
Monitoring data (on behalf of employers): application names and window titles, website domain and path (without URL parameters), keyboard/mouse activity counts (never keystrokes), idle time, IP address, Wi-Fi network name, screenshots and live screen view if the employer enables them, GPS location only when the person clicks "Verify My Location", attendance, leave, timesheet and performance records. The exact list for a given company is shown in that company's monitoring notice.

3. Why

To provide the service the employer has asked for: attendance, working time, payroll inputs, productivity and project reporting, and protection of company information.
To create and secure accounts, bill for the service, provide support and meet legal obligations.

We do not sell personal data and do not use monitoring data for advertising or for any purpose of our own.

4. Who else receives data

We use service providers to run the platform: cloud hosting and database, email delivery, the payment gateway, and (only if a company enables it) Google or Microsoft sign-in. They process data only for these purposes and under contract.

5. How long we keep it

Monitoring data is deleted automatically according to the employer's retention settings (screenshots between 7 and 365 days; activity records between one and five years).
When a workspace is deleted, all its data is permanently erased after a 30-day grace period. Invoices and payment records are kept (without the payer's username) for as long as tax law requires.
Security and access logs are kept for at least one year, as the DPDP Rules require.

6. Security

Passwords are stored as salted hashes. Screenshots and live screen frames are stored outside the public web folder and are only shown to authorised people in the same organisation; every such access is logged. Connections to the platform are encrypted (HTTPS). If a personal-data breach occurs, we will inform affected organisations, the Data Protection Board of India and — directly or through the organisation — affected individuals, as the law requires.

7. Your rights

You can ask for a summary of your personal data, a correction or erasure, raise a grievance, or nominate someone to exercise these rights for you.

Employees: use the My Data page in the portal (download a copy, or raise a request). Your employer must respond within 90 days.
Account and billing data: write to [privacy email].

If a grievance is not resolved, you can complain to the Data Protection Board of India.

8. Grievance officer

[legal name]
Email: [privacy email]
Address: [registered address]

9. Children

ThirdEyee is a workplace tool and is not intended for anyone under 18.

10. Changes

We will post changes here and update the date above. If a change affects what is collected about employees, they are shown the updated monitoring notice again.