Privacy Policy

1. Scope & Role as Data Processor

This Privacy Policy explains how Finnovo Tech Functional Private Limited ("yfy.ai", "we", "us", or "our") processes enterprise workforce information, statutory records, and technical telemetry through our statutory compliance and contractor verification platform.

Under the Digital Personal Data Protection Act 2023 (DPDPA) and the Information Technology Act 2000, our enterprise customers (Principal Employers and Staffing Agencies) act as Data Fiduciaries (or Data Controllers). yfy.ai operates strictly as a Data Processor carrying out automated statutory computations, ECR verification, and proof pack compilation strictly on behalf of and under documented instructions from our licensed customers.

2. Categories of Workforce Data Processed

To perform statutory compliance audits, muster reconciliation, and payroll filings, the platform processes data provided by employers:

• Statutory Identifiers: Universal Account Numbers (UAN), ESIC Insurance Numbers (IP), Permanent Account Numbers (PAN), and Labour Identification Numbers (LIN).
• Wage & Payroll Records: Gross earnings, basic wages, dearness allowances, overtime records under Factories Act §59, statutory deductions (EPF, ESI, Professional Tax, LWF), and net disbursement registers.
• Time & Muster Logs: Shift timestamps, biometric punch logs, GPS gate records, and supervisor-approved muster rolls.
• Compliance Proofs: TRRN challans, bank payment confirmations, Form 5A returns, and contractor license documentation.

3. Data Residency & Indian Sovereign Hosting

All workforce records, payroll inputs, and compliance evidence are hosted strictly within the sovereign territory of the Republic of India (Tier IV data centers in Mumbai and Hyderabad).

No employee personal data or statutory wage information is ever transferred or processed outside India. Data at rest is encrypted using industry-standard AES-256, and all communications in transit are secured via TLS 1.3. Multi-tenant customer accounts are cryptographically and logically isolated using strict PostgreSQL Row-Level Security (RLS).

4. Absolute Zero Data Monetization

yfy.ai generates revenue exclusively from software licensing fees. We do not sell, rent, monetize, or broker workforce data, payroll records, or contractor information under any circumstances.

We do not engage in behavioural tracking, third-party advertising, or profiling of our customers' employees or contractor personnel.

5. Data Retention, Purge & Grievance Redressal

Customer records are retained strictly in accordance with statutory requirements (such as 5-year retention under CLRA §21 and the EPF Scheme) or as dictated by the customer's Data Retention Schedule. Upon contract termination, data is exported to the customer in structured formats and cryptographically purged from our production databases within 90 days.