Privacy Notice

This notice explains how Prabodhi Life LLP ("FacilityBase", "we") handles personal data in the FacilityBase Service, in line with the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology Act, 2000.

• For agency owners and their team members (account data), we decide how the data is used, so we are the Data Fiduciary.
• For workers, clients and contacts that an agency enters, the agency is the Data Fiduciary and we process that data on its instructions as a Data Processor. Requests about that data are best sent to the agency; we will help it respond.
• For job applicants who apply on a careers page, see section 10.

• Account data: name, mobile number, email, company details (name, state, GSTIN), role, and sign-in records.
• Worker data entered by agencies: name, contact details, date of birth, gender, employment details, attendance (including selfie photos and site QR scans where the agency uses them), salary, bank account and IFSC, PAN, Aadhaar, UAN and ESIC numbers, leave, loans, tax declarations and payslips.
• Client and business data: client names, contacts, sites, contracts, quotations, invoices and payments.
• Usage and device data: pages used, errors and approximate technical details, used to keep the Service working.

Full Aadhaar numbers are collected only because PF, ESI and UAN filings require them. They are hidden in logs and masked from roles that do not need them.

• to provide the Service: attendance, payroll, statutory calculations, invoicing, payslips and reports;
• to send messages the agency or you ask for, such as one-time passwords, payslips and invoices;
• to bill subscriptions and prevent fraud or misuse;
• to secure, support and improve the Service;
• to meet legal obligations, such as tax and audit record-keeping.

We do not sell personal data, and we do not use worker data for advertising.

Only service providers that help us run the Service, under contracts that require them to protect the data:

• Supabase — database, sign-in and file storage
• Vercel — application hosting
• Interakt — WhatsApp messages
• Twilio — SMS one-time passwords
• Resend — email
• Razorpay — subscription payments
• Inngest — scheduled background jobs
• PostHog — product usage analytics
• Sentry — error monitoring
• Google — sign-in, if you choose it

We may also disclose data where the law requires it. Some providers may process data outside India; where they do, we rely on the safeguards the DPDP Act permits.

Each agency's data is isolated at the database level, so one agency cannot read another's. Data is encrypted in transit and at rest. Access inside an agency follows the roles its owner assigns, and salary, bank and identity numbers are masked from roles that do not need them. Changes to payroll, attendance, invoices and statutory data are recorded in an audit log.

We keep data while the agency's account is active. After an account closes, or when an agency asks us to erase a record, we delete or anonymise it, except where the law requires us to keep it (for example payroll, tax and invoice records for the statutory period).

Under the DPDP Act you can ask to:

• access a summary of your personal data and how it is processed;
• correct or complete inaccurate data;
• erase data that is no longer needed, subject to legal retention;
• withdraw consent where processing is based on consent;
• nominate someone to exercise your rights if you cannot;
• have a grievance addressed.

Workers should first contact the agency that employs them. You can also write to support@facilitybase.in; we respond within the time the law requires. If you are not satisfied, you may complain to the Data Protection Board of India.

Rajendra Gamare, Grievance Officer, Prabodhi Life LLP, 104, G Wing, Kailash Industrial Complex, Vikhroli Parksite, Mumbai 400087. Email: support@facilitybase.in.

When you apply for a job on an agency's careers page, you give your mobile number, name, city and work experience to that agency and to FacilityBase. The agency uses it to consider you for jobs and to contact you, including on WhatsApp. We are the Data Fiduciary for this record, and the agency is a Data Fiduciary for its own use of your application.

• We keep one applicant record per mobile number. If you apply to more than one agency that uses FacilityBase, each agency can see that it is the same person, but not what other agencies hold about you.
• We ask for your consent and that you confirm you are 18 or older before you apply, and we record when you agreed and to which version of this notice.
• We keep your application for [retention period — to be confirmed] after your last application, unless you are hired, in which case the agency keeps your record as an employee.
• You can withdraw consent or ask us to delete your applicant record at any time by writing to support@facilitybase.in, or by asking the agency. Withdrawing does not affect anything done before you withdrew.

We will show the date of the latest version at the top of this page and tell account owners about material changes.