Privacy Policy

1. Two roles: account holder vs. data processor

If you sign up for Nexelo on behalf of a company, we collect your name, work email and phone number to create and bill that account — here, we're the data controller.

Once your company is using Nexelo, it enters data about its own employees, customers or event registrants — including, where applicable, biometric attendance data (fingerprint or face templates from devices like eSSL/ZKTeco), salary and bank details, PAN, and documents. For that data, your company is the data controller and Nexelo is the data processor: we act on your company's instructions and don't use that data for our own purposes. It is your company's responsibility to obtain any consents required from its employees or other data subjects before entering their data into Nexelo — including specific consent for biometric data, which Indian law treats as sensitive personal data.

2. What we collect directly

• Account details: name, email, phone, company name and GSTIN.
• Billing details processed through our payment partner (Razorpay) — we don't store full card numbers ourselves.
• Usage data: login timestamps, feature usage and audit logs, used to secure the account and improve the product.
• Support communications you send us directly.

3. What your company stores in Nexelo (as controller)

Depending on which modules are enabled: employee records, attendance and biometric data, payroll and statutory filings (PF, ESI, TDS), documents, CRM leads, inventory/POS transactions, event registrant details, and communications sent through the platform (e.g. bulk email campaigns). This data is siloed per company (tenant) and is not visible to other Nexelo customers.

4. The Nexelo mobile app

The Nexelo app for Android and iOS signs in to the same account and shows the same data as Nexelo on the web. In addition, it:

• Uses the camera only when you choose to scan an event ticket or code, or take a photo to attach (for example, task evidence). Photos are uploaded to your organisation's workspace; scanned codes are only used to look the item up.
• Stores a push-notification token and basic device details (device name, platform, app version) so we can send you notifications and show your signed-in devices. Notifications are delivered through Expo and Google Firebase Cloud Messaging / Apple Push Notification service.
• Offers optional fingerprint, face or device-PIN unlock. This check happens entirely on your device — Nexelo never receives your biometric data.
• Keeps your sign-in token in the phone's secure keychain/keystore. If you download event check-in data for offline scanning, it holds only names, companies, ticket numbers and hashed ticket codes (no emails or phone numbers), stays in the app's private storage, and is deleted when you sign out or a day after the event.
• Does not use your location, contacts or microphone, and contains no advertising.

To delete your account or data, see Delete your account or data.

5. How we use data

To provide and secure the service, process payments, send transactional notifications (e.g. payslip ready, leave approved), respond to support requests, and — only with your account's own notification preferences respected — send product updates. We do not sell personal data.

6. Storage and security

Cloud-hosted data is stored on infrastructure located in accordance with our hosting arrangements at the time of your signup; on-premise deployments keep Customer Data on the Customer's own servers, accessed by Nexelo only through a secured tunnel and only for support purposes the Customer initiates. Access within Nexelo is role-restricted and logged.

7. Sharing

We share data with sub-processors strictly to run the service — for example our payment processor (Razorpay) for billing, and email/SMS providers for transactional messages — under contracts that limit their use of it. We disclose data to authorities only where legally required.

8. Retention and deletion

We retain Customer Data for as long as the account is active, plus a reasonable export window after termination, after which it is deleted or anonymized — except where we're required to retain records for statutory (e.g. tax, labour law) purposes.

9. Your rights

Depending on your relationship with us, you may have rights to access, correct, or request deletion of your personal data. Account holders can update most account data directly in Settings; employees or other data subjects whose data was entered by their employer should contact that employer first, since they control the data.

10. Grievance Officer

In accordance with Indian IT Rules, complaints about the handling of personal data can be directed to our Grievance Officer at privacy@nexelo.in. We aim to acknowledge complaints within a reasonable time and resolve them promptly.

11. Changes to this policy

We'll post updates here with a new "Last updated" date and notify account admins of material changes.