Last updated: 15 October 2026
This Privacy Policy explains how Hitosys (hitosys.com and its subdomains), a product of Growpro Learning Solutions (OPC) Private Limited, collects, uses, and protects personal data.
This Privacy Policy describes how Growpro Learning Solutions (OPC) Private Limited ("Hitosys," "we," "us") handles personal data through the Hitosys platform (HRMS, Payroll, and Recruitment modules, together the "Service"), used by our business customers ("Customer") and the individuals whose data Customers manage through it — employees, job applicants, and authorized account users.
Depending on which modules a Customer uses, this may include: account and contact details of authorized users; employee records such as name, contact details, designation, and employment history; payroll data including salary structure, bank account details, and statutory identifiers (PAN, Aadhaar, UAN, PF/ESI numbers) required for compliance; identity documents an employee or the Customer uploads (for example an Aadhaar card, used to verify the permanent address); attendance, leave, and location data captured for shift and geofence-based attendance verification; check-in photos where the Customer requires them; where the Customer turns on face-recognition attendance and the employee consents, a numeric face pattern (not a photo) used only to confirm the employee at check-in, deleted when they leave or withdraw consent; candidate and applicant data such as resumes, assessment results, and interview scorecards submitted through the Recruitment module; and technical data such as IP address and device information collected automatically for security and error monitoring.
We use this data solely to provide the Service to the Customer that submitted it — running payroll and generating payslips, tracking attendance and leave, managing the hiring pipeline, sending transactional notifications (invites, payslip alerts, approval requests), and maintaining platform security and reliability. We do not use Customer Data to build products for other customers, and we do not sell personal data to third parties.
We share data only with service providers who process it on our behalf to operate the Service, under contractual confidentiality obligations: Supabase (database hosting and authentication — data stored in the Mumbai, India region), Vercel (application hosting — our servers run in the Mumbai, India region), Resend (transactional email delivery), Anthropic (the AI behind our assistant Hito, which answers employees' HR questions, and the reading of the address printed on an uploaded Aadhaar card so a permanent address can be verified — only what is needed for that answer or that card is sent), Razorpay (payment processing for subscription billing — we do not store your card or bank details ourselves), Sentry (error monitoring, used to diagnose bugs, not to profile users), and Backblaze B2 (encrypted off-site backup storage). Resend, Anthropic, Sentry and Backblaze may process data outside India; such transfers are made as permitted under the Digital Personal Data Protection Act, 2023. We do not sell personal data. We may disclose data where required by law, regulation, or a valid legal process.
We retain Customer Data for as long as the Customer's account remains active, and for a reasonable period after termination to allow data export, after which it is deleted or anonymized, except where longer retention is required by applicable labor or tax law (for example, statutory payroll records). Daily backups are retained on a rolling basis and are deleted in the ordinary course as older backups are superseded.
We use industry-standard safeguards including encryption in transit (HTTPS/TLS); encryption of bank account numbers in our payroll database; role-based access control, with salary information visible only to people the Customer allows; row-level database security scoping each Customer's data to that Customer; two-step sign-in (a one-time code, or the device's own fingerprint or face sign-in, which never leaves the device) required for administrators and anyone with salary access; an audit trail of who changed what and when; servers and database in India; and independent daily backups. No system is completely secure, and while we take reasonable measures to protect data, we cannot guarantee absolute security.
Individuals whose data is processed through the Service (employees, candidates) should direct data access, correction, or deletion requests to their employer (the Customer), who controls that data. Where required by applicable law, we will assist Customers in fulfilling such requests. Account administrators may request export or deletion of their company's data directly by writing to us.
We use essential cookies required for login sessions and security, and may use limited analytics to understand product usage. We do not use third-party advertising cookies.
The Service is intended for business use by adults acting on behalf of an employer or candidate. We do not knowingly collect data from children.
In accordance with applicable Indian data protection law, grievances regarding the handling of personal data may be addressed to our Grievance Officer at hitosyshcm@gmail.com. We aim to acknowledge grievances within a reasonable time and resolve them promptly.
We may update this Privacy Policy from time to time. Material changes will be communicated to account administrators by email, and the "Last updated" date below will reflect the most recent revision.
Questions about this Privacy Policy or how your data is handled can be sent to hitosyshcm@gmail.com.
You don't need three tools to run people, payroll and hiring. You only need one.