Privacy Policy

This policy describes how Demystify Systems LLP ("ASHR.work", "we", "us") collects, uses, stores and protects personal data through the ASHR.work HRMS platform. It reflects what the product actually does today — every factual claim below (hosting region, retention window, sub-processors, certifications) is checked against the running system, not aspirational.

Two different roles. When your employer (a "tenant") uses ASHR.work to manage its workforce, ASHR.work acts as a data processoron that employer's behalf — your employer is the data controller for your HR records, and decides what is collected and how long it is kept. For our own marketing site, leads, and the account holder who signs up for a workspace, ASHR.work acts as the data controller. If you are an employee with a question about your own HR data, your employer's admin team is usually the fastest route to an answer; we are glad to help either of you directly.

Data we collect

• Account & workspace data — name, work email, company, role, and billing contact details for the person who creates or administers a workspace.
• Employee HR recordsyour employer uploads or enters — profile details, leave and attendance, performance reviews, documents, payroll figures, recruitment records, and anything else the product is used to manage. This is your employer's data; we process it on their instructions.
• Usage data — pages visited, timestamps, IP address, user agent, and in-product actions we write to an append-only audit log for security and support purposes.
• Support and sales conversations — anything you send us by email or through the in-product help widget.
• AI feature inputs — if your workspace turns on an AI-powered feature (for example, a job-description draft or a candidate summary), the specific text you submit for that feature is sent to the configured AI provider to generate a response. This only happens for features you or your admin actively use, and only with an AI key your workspace or ASHR.work has configured — never silently in the background.

How we use data

• Provide and operate the ASHR.work platform for the workspace you belong to
• Communicate with you about your account, billing, and service updates
• Provide customer support when you contact us
• Detect, investigate and prevent fraud, abuse and security incidents
• Improve reliability and product quality — for our own site, using cookieless, first-party analytics (Vercel Web Analytics) that does not track you across other websites
• Meet our obligations under applicable law, including EU/UK GDPR, US state privacy laws (e.g. CCPA), and India's Digital Personal Data Protection Act (DPDP)

We do not sell personal data, and we do not use employee HR data to serve advertising.

Who we share data with

We use a small number of sub-processors to run the service. Each only receives the data it needs to do its job:

• Supabase — database, authentication and file storage, for every workspace.
• Vercel — application hosting and cookieless web analytics, for every workspace.
• Resend — transactional email delivery, for every workspace.
• Razorpay — payment processing, for every workspace.
• Finocket — invoicing, for every workspace.
• Slack — in-app notifications, only if an admin connects it.
• Demystify ID — sign-in, only if an admin turns it on.
• AI provider (e.g. Anthropic) — generating AI-feature responses, only for that request.

We never send data to an AI provider for training their models, and a workspace that hasn't configured or enabled an AI feature never has any data leave the platform for that purpose. We do not store your card details ourselves — that goes directly to our payment processor.

A standard, signed Data Processing Agreement covering these sub-processors is not yet published as a self-serve document — email hello@ashr.work to put one in place as part of your contract.

Where your data is hosted

Every workspace's data is stored on Supabase, hosted on AWS in Mumbai, India (ap-south-1). That is the only region in use today — there is currently no option to choose a different hosting region for your workspace. Some of our sub-processors (payment and email delivery) may process data outside India as part of routing a payment or delivering an email; each operates under its own data-protection terms.

How we protect it

• Every tenant's data is isolated by a database-enforced row-level-security policy — not just an application-layer check — so one workspace's data is never readable from another, even by a bug in our own code.
• Data is encrypted at rest (AES-256) and in transit (TLS), using Supabase's platform-level encryption.
• Sensitive actions — role changes, data exports, admin access — are written to an append-only audit log.
• Admin accounts can require a second authentication factor (MFA) for sensitive actions.
• Uploaded files are validated by their real content, not just a filename, before being accepted.

ASHR.work does not currently hold an independent security certification such as SOC 2 or ISO 27001. We answer security questionnaires directly — email hello@ashr.work.

How long we keep data

While your workspace is active, data is kept for as long as your employer's workspace exists. If a workspace leaves ASHR.work, it is suspended first and kept whole — nothing deleted or altered — for a 30-day window before it becomes eligible for deletion, so a workspace can be restored as-is if that was a mistake. After that window, deletion is a manual, audited action, never an automatic sweep.

Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing (for example, under GDPR Articles 15 and 17, or India's DPDP Act). If you are an employee, your employer's admin can usually action most of these requests for you directly inside the product today. For anything else, email support@ashr.work and we will process your request promptly.

Cookies

We use strictly-necessary cookies to keep you signed in and to remember your session — nothing more on the product itself. Our marketing site uses Vercel Web Analytics, which is cookieless by design and does not track you across other websites. We do not use third-party advertising or cross-site tracking cookies.

Children's data

ASHR.work is a business tool for employers and their employees. It is not directed at children, and we do not knowingly collect personal data from anyone under the age of 16.

Changes to this policy

If we make a material change to how we handle personal data, we will update the date at the top of this page and, where required by law, notify affected workspace admins.

Contact

For privacy questions or to exercise your rights, email support@ashr.work.