What we hold, why, for how long, and what you can make us do about it.

Two different relationships

This matters more than it sounds. For the personal data of your employees, you are the Data Fiduciary and the company operating Flabido is a Data Processor: we hold it on your instructions and act on them. For the account holder’s own details — the person who signs in and pays — we are the Data Fiduciary.

What we hold about your employees

Whatever you put in: names, contact details, employment history, salary, statutory identifiers such as PAN, Aadhaar, EPF and ESI numbers, leave and attendance, and documents you upload. Salary, bank details and identity numbers are encrypted with a key belonging to your organisation alone.

What we hold about you

The email address you sign in with, your name, your organisation’s billing details and GSTIN, and a record of what you did in the product — the audit trail, which exists so that you can answer that question too.

Why

To provide the service you asked for, to bill you for it, and to meet obligations we have under law. We do not sell personal data, we do not use it for advertising, and we do not use it to train models.

Who else sees it

Infrastructure and delivery providers we use to run the service — hosting, email, payment processing — each acting on our instructions and no further. A current list is available on request. We do not otherwise disclose personal data unless the law requires it, and where we are permitted to tell you that it has been required, we will.

How long

For as long as your account exists. When you close an account we destroy its encryption keys and overwrite personal data, which makes what remains unreadable rather than merely deleted. Where we must keep something for a statutory period — invoices, for instance — we keep only that.

Your rights

You may ask for a copy of the personal data we hold about you, ask us to correct it, ask us to erase it, and nominate somebody to exercise these rights on your behalf. The product answers these requests directly: a Data Principal request can be raised and fulfilled inside the account without emailing anybody.

If you are an employee of a company using Flabido, your rights are against your employer, who decides what is held about you. Ask them first — they have the tools to answer, and we cannot act on their data without their instruction.

Complaints

Email support@flabido.com. You also have the right to complain to the Data Protection Board of India.