Privacy Policy
Last updated August 2026.
XcodeFix HRMS is HR software used by employers to run their own HR processes. Your employer controls the personal data held about you in this system; we process it on their instructions as their service provider.
What we hold
- Account data — name, work email address, employee code and role, so you can sign in.
- HR records — department, designation, location, reporting line, joining date and employment status.
- Activity you create — leave applications, attendance punches, helpdesk tickets, documents and feed posts.
- Technical data — IP address, browser user-agent and timestamps, kept to secure the account and investigate misuse.
- Activity monitoring — where your employer enables the optional Activity Tracking module and installs its desktop agent on a work device, we hold the active application and website host, active and idle time, keyboard and mouse activity levels (counts only, never the keys pressed), and periodic screenshots, used for timesheets and productivity reporting.
Activity monitoring
Activity Tracking is off unless your employer turns it on. When it is on, the default is a visible posture: the agent shows a tray icon and you can review your own recorded activity under "My Activity". Your employer may run it silently where local law allows. We never capture the actual keys you type, and screenshots can be blurred. Raw activity and screenshots are automatically deleted after the retention period your employer sets. Direct questions about monitoring to your employer, who decides whether and how it is used.
Sensitive identifiers
Where your employer records statutory identifiers such as PAN, Aadhaar or bank account details, those fields are encrypted before they are written to the database and are shown only to you and to staff your employer has authorised.
How the data is separated
Every organisation's records are isolated. A request is bound to exactly one organisation, and the data layer applies that boundary to every query, so one employer's staff cannot read another's.
Transactional email — invitations, password resets, approval notifications — is sent on your employer's behalf. Employers may configure their own mail server, in which case delivery happens through their provider under their own policies.
Retention
HR records are kept for as long as your employer's account is active, plus any period their own policy or the law requires. Sessions, password-reset links and verification links expire automatically. Audit entries are retained for two years.
Your rights
Requests to access, correct or erase your personal data should go to your employer's HR team, who control this record. If you contact us directly we will pass the request to them.
Security
Traffic is encrypted in transit. Passwords are stored using Argon2id hashing and are never recoverable. Access is controlled by role, and administrative actions are recorded in an audit trail.
Contact
Questions about this policy: support@hrms.xcodefix.com.