Privacy policy
DRAFT — to be reviewed by a lawyer before publication. This draft is written to follow India’s Digital Personal Data Protection Act, 2023 (DPDP Act) and its Rules, and the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL). Items in [square brackets] must be completed. It is not legal advice.
Last updated: [date]
1. Who we are
Section titled “1. Who we are”HashBook (“HashBook”, “we”, “us”) is a business management web application provided by [legal entity name], [registered address] (“the Company”). This policy explains how we handle personal data when you visit hashbook.one or help.hashbook.one, or use the HashBook app at app.hashbook.one.
Contact for privacy questions: [[email protected] / [email protected]] Grievance Officer (India, DPDP Act): [name, designation, email]
2. Our two roles
Section titled “2. Our two roles”| When… | Our role | Who decides how the data is used |
|---|---|---|
| A business (our customer) stores data in its HashBook workspace — e.g. its leads, customers, employees, candidates, invoices and payroll | Data Processor (DPDP) / Processor (PDPL) | The customer, as Data Fiduciary / Controller |
| We run our own business — customer account details, billing, support emails, website visits | Data Fiduciary / Controller | HashBook |
If you are an employee, lead, customer or candidate of a business that uses HashBook, that business is responsible for your data. Please send requests about it to that business. We will help them respond.
3. Data we collect as Data Fiduciary / Controller
Section titled “3. Data we collect as Data Fiduciary / Controller”- Account data: name, work email, phone, company name, workspace name, role.
- Billing data: plan, invoices, payment records (we do not store card numbers).
- Support data: emails and messages you send to [email protected].
- Security and usage data: sign-in times, IP address, browser and device type, audit-log entries, error logs.
- Website data: the help and marketing sites do not use advertising or tracking cookies. [Update if analytics are added.]
4. Why we use it (purpose and legal basis)
Section titled “4. Why we use it (purpose and legal basis)”| Purpose | Basis |
|---|---|
| Provide and secure the service, sign you in, prevent fraud and abuse | Contract with your organisation; legitimate uses / legitimate interests permitted by law |
| Billing, renewal reminders and receipts | Contract; legal obligations (tax and accounting records) |
| Answering support requests | Your request; consent where required |
| Product announcements | Consent, which you can withdraw at any time |
| Complying with law, court orders and lawful requests from authorities, including CERT-In reporting | Legal obligation |
We do not sell personal data and do not use customer workspace data to train AI models or for advertising.
5. Customer workspace data (as Processor)
Section titled “5. Customer workspace data (as Processor)”We process workspace data only on the customer’s documented instructions — to host, secure, back up and support the service. Our staff cannot see a customer’s records unless the customer’s owner grants time-limited support access, which is logged in the customer’s audit log.
6. Who we share data with (sub-processors)
Section titled “6. Who we share data with (sub-processors)”| Provider | What for | Location |
|---|---|---|
| DigitalOcean | Application servers and database | India (Bangalore) |
| Cloudflare | Network security, DNS, website hosting, encrypted backup storage, email routing | Global network |
| Brevo | Sending system emails (invitations, password resets, alerts) | [EU] |
| [Others, e.g. Google Workspace for support email] | [ ] | [ ] |
Customers can also connect their own services (their email server, Meta, Google Ads, IndiaMART, WhatsApp). Data sent to those services is under the customer’s own agreements with them.
7. Transfers outside India or the UAE
Section titled “7. Transfers outside India or the UAE”Some providers process data outside the country where it was collected. We transfer data only as permitted by the DPDP Act (to countries not restricted by the Government of India) and the PDPL (to countries with adequate protection, or with appropriate safeguards such as contractual clauses). [Lawyer to confirm transfer mechanism for UAE customers.]
8. How long we keep data
Section titled “8. How long we keep data”- Account and support data: while the account is active and [X] years after it closes.
- Billing and accounting records: as long as tax law requires (India: generally 8 years; UAE: generally 5 years). [Lawyer to confirm.]
- Security logs: [X] months.
- Customer workspace data: until the customer deletes it or closes the workspace, then removed from live systems within [X] days and from backups within [35 days / 13 months for monthly backups].
- Closed recruitment applications are deleted automatically 12 months after closing.
9. How we protect data
Section titled “9. How we protect data”Encryption in transit (HTTPS / TLS) and of backups; encryption of stored logins and identity numbers; database row-level security separating every workspace; two-step verification; least-privilege staff access; audit logs; regular backups and restore tests. No system is perfectly secure, but we work to protect your data and will notify affected customers and authorities of a personal data breach as required by law (DPDP: the Data Protection Board and affected Data Principals; CERT-In within 6 hours for reportable incidents; PDPL: the UAE Data Office).
10. Your rights
Section titled “10. Your rights”Depending on the law that applies, you may have the right to:
- get a summary of your personal data and how it is used, and a copy of it;
- correct, complete or update it;
- have it erased when it is no longer needed (unless the law requires us to keep it);
- withdraw consent at any time (this does not affect processing already done);
- object to or restrict certain processing (PDPL);
- nominate someone to exercise your rights if you die or become incapable (DPDP);
- have a grievance addressed by us, and then complain to the Data Protection Board of India or the UAE Data Office.
To use these rights, email [privacy contact]. We reply within [30] days. We may need to check your identity first. If your data is held in a business’s workspace, contact that business — it can export or erase your data from HashBook.
11. Children
Section titled “11. Children”HashBook is a business tool and is not meant for children. We do not knowingly collect data of children (under 18 in India). If you think a child’s data has been provided to us, contact us and we will delete it.
12. Changes to this policy
Section titled “12. Changes to this policy”We will post changes here and update the date above. For significant changes we will notify account owners by email.
13. Contact
Section titled “13. Contact”[legal entity name], [registered address] — [privacy contact email]