Vyntez Solutions
We're hiringLet's talk
Legal

Privacy Policy

Effective 17 October 2026. Applies to all Vyntez products.

This Privacy Policy explains how Vyntez Solutions Private Limited ("Vyntez", "we") handles personal data across the Services. It is written to meet the Digital Personal Data Protection Act, 2023 and Rules, 2025 (India), the Information Technology Act, 2000 and the SPDI Rules, 2011, the EU and UK General Data Protection Regulation (GDPR), and the California Consumer Privacy Act as amended by the CPRA. The Data Privacy and DPDP Notice gives the India-specific notice, your rights and how to use them.

1. Who is responsible

  • Vyntez Solutions Private Limited, Sindhora Road, Varanasi, Uttar Pradesh 221001, India, is the Data Fiduciary (the "controller" under the GDPR) for personal data it decides how and why to process: for example your account, billing, website and support data, and data in the consumer Services.
  • Where a business uses a Service to handle its own people's or customers' data (for example an employer using Vyntez People or VyntezCare ACA, a company using VyntezMail or VyntezConnect, or a clinic using VyntezCare), that business is the Data Fiduciary and Vyntez is its Data Processor. Ask that business about its privacy practices; we help it answer your requests. The table on the Legal page shows our role in each product.
  • Contact: Grievance Officer, Vyntez Solutions Private Limited, Sindhora Road, Varanasi, Uttar Pradesh 221001, India. Email: grievance@vyntez.com (Monday to Friday, 10:00 to 18:00 IST).

2. Personal data we collect

  • Account and identity: name, email, phone number, password (stored only as a salted hash), profile photo, organisation, role, language and preferences.
  • Vyntez People (for the employer): employee code, designation, department, manager, date of joining and leaving, date of birth, gender, address, emergency contact, PAN, UAN, bank account (verified), salary and CTC, payslips, tax-regime choice and Form 124 declarations with proofs, loans and reimbursements, attendance punches with time, approximate location and a selfie, a face template for attendance matching (biometric data), leave including medical leave and its certificate, documents, performance notes and helpdesk tickets.
  • VyntezMail and VyntezConnect: emails, attachments, contacts, calendar entries, chat messages, files, and call and meeting metadata (who, when, how long). We do not record calls or meetings unless a participant turns recording on.
  • Vyntez AI and AI features: the questions, files and prompts you submit and the answers, and the context the feature uses (for example your leave balance when you ask about leave).
  • VyntezCare: health data such as symptoms, medical history, prescriptions, reports, appointments and clinician notes.
  • VyntezCare ACA (for the employer): employee and dependant names, US taxpayer identification numbers, dates of birth, hours, health-coverage offers and enrolment.
  • Vyntez Travels, Vyntez Buddy and Vyntez Park: bookings, travellers' names, ages, ID or passport details where the supplier requires them, addresses, vehicle number, order and delivery details, and reviews.
  • Vyntez Social: profile, posts, videos, comments, likes, follows and messages.
  • Payments: invoice and billing details, GSTIN, and payment status. Card, UPI and bank details are collected and stored by our payment gateways (Razorpay, Cashfree), not by Vyntez.
  • Device and usage: IP address, device and browser type, app version, crash reports, pages and features used, and security logs (sign-ins, failed attempts, sessions).
  • Careers: CV, work history, qualifications and interview notes.

3. Why we use it (purposes and legal bases)

  • To provide the Services you or your organisation signed up for, including accounts, payroll, email delivery, bookings and AI answers. DPDP: consent or a legitimate use under section 7; GDPR: contract.
  • For an employer's employment purposes in Vyntez People (attendance, payroll, statutory deductions such as PF, ESI, PT and TDS, leave and compliance). DPDP: the employer's legitimate use for employment under section 7(i) and its legal obligations; Vyntez processes on the employer's instructions.
  • To verify attendance with a face match and approximate location. This uses biometric data, so the employer must give employees notice and obtain consent where the law requires it (SPDI Rules, 2011 Rule 5; GDPR Article 9). An employer can turn selfie or location checks off.
  • To bill you, collect payment, issue GST invoices and keep tax records. Legal obligation and contract.
  • To keep the Services secure, prevent fraud and abuse, and investigate incidents. Legitimate use under the law, and GDPR legitimate interests.
  • To support you and send service messages (security alerts, invoices, changes to terms). Contract and legitimate interests.
  • To improve the Services using aggregated or de-identified usage data. GDPR legitimate interests; DPDP consent where required. We do not use business customers' content to train AI models.
  • To send marketing only with your consent (or where the law allows to existing customers), with an unsubscribe link in every message.
  • To meet the law, respond to lawful requests from courts and authorities, and establish or defend legal claims.

4. Who we share it with

  • Your organisation: if you use a business account, its administrators can see and manage your data in that Service.
  • Service providers acting for us (Data Processors) under written contracts with security and confidentiality duties: cloud hosting and storage, email delivery, SMS and push notifications (Apple, Google), payment gateways (Razorpay, Cashfree), and banking partners for salary and claim payouts in Vyntez People.
  • AI model providers for AI features: DeepSeek (China), OpenAI (United States) and Google Gemini (United States). We send only what a request needs, under their API terms, which do not allow them to train on API data by default. Business customers can ask us which providers their workspace uses.
  • Travel suppliers, sellers, service providers and parking operators, to fulfil a booking or order you make.
  • Other users, for content you choose to make public or send to them.
  • Government and statutory bodies where the law requires, for example EPFO, ESIC, the Income Tax Department (TDS returns filed by your employer), CERT-In, courts and law enforcement with a lawful order.
  • A buyer or successor if Vyntez is merged, acquired or restructured, under the same protections.
  • We do not sell personal data, and we do not share it for cross-context behavioural advertising.

5. Transfers outside India

  • Data is stored on servers in India and in other countries where our providers operate. The DPDP Act allows transfer outside India except to countries the Central Government restricts; we follow any such restriction.
  • For personal data from the EU, UK or Switzerland, we use the European Commission's Standard Contractual Clauses (and the UK Addendum) or another lawful transfer mechanism, with additional safeguards where needed.

6. How long we keep it

  • Account data: while the account is active, then deleted within 90 days of closure, unless the law requires us to keep it longer.
  • Business customers' data (for example Vyntez People records, mailboxes): for the subscription, plus 30 days to let the customer export it, then deleted from live systems; backups are overwritten within a further 90 days.
  • Payroll, tax and statutory records are kept by the employer for as long as labour and tax laws require (generally eight years); in Vyntez People this is the employer's choice and responsibility.
  • Invoices and accounting records: eight years, as the Companies Act, 2013 and GST law require.
  • Security and access logs: at least one year, as the DPDP Rules, 2025 and CERT-In directions require, then deleted.
  • Consumer accounts on Vyntez Social, Vyntez Buddy and Vyntez Travels that have been inactive for three years are deleted after 48 hours' notice, as the DPDP Rules, 2025 require for these platforms.
  • Face templates in Vyntez People: deleted when the employer resets registration, turns selfie checks off, or when the employee leaves and their record is closed.

7. How we protect it

  • Encryption in transit (TLS) and at rest for stored files; passwords stored as salted hashes; PAN and bank numbers masked in screens and exports.
  • Role-based access with least privilege, multi-factor authentication for administrators, access logs, and separation of each organisation's data.
  • Sensitive files (for example medical certificates, tax proofs, ID documents) are visible only to the person, the roles that need them, and the organisation's Owner.
  • Backups, monitoring, vulnerability management and staff confidentiality obligations, consistent with reasonable security practices under section 43A of the IT Act and the IS/ISO/IEC 27001 approach.
  • If a personal data breach occurs, we tell affected people and the Data Protection Board of India without delay and send the Board a detailed report within 72 hours, as the DPDP Rules, 2025 require; we report cyber incidents to CERT-In within 6 hours; and we tell business customers promptly so they can meet their own duties.

8. Your rights

  • India (DPDP Act): access a summary of your data and how it is processed, correction, completion, updating and erasure, withdrawal of consent, grievance redressal, and nominating someone to act for you if you die or cannot act. See the Data Privacy and DPDP Notice.
  • EU and UK (GDPR): access, rectification, erasure, restriction, portability, objection (including to direct marketing), not to be subject to solely automated decisions with legal or similarly significant effects, and to complain to your data protection authority.
  • California (CCPA/CPRA): know, access, delete and correct personal information, limit use of sensitive personal information, opt out of sale or sharing (we do neither), and not be discriminated against for using these rights. We honour Global Privacy Control signals.
  • To use a right, email the Grievance Officer or use the in-product settings. We verify your identity first. If a business manages your account, we pass the request to it or help it respond.

9. Children

  • The Services are not meant for children under 18 except where a consumer Service allows it. Before processing a child's data, we obtain verifiable consent from a parent or lawful guardian, as the DPDP Act and Rules require. We do not track, monitor the behaviour of, or target advertising at children. If you think we hold a child's data without consent, contact the Grievance Officer and we will delete it.

10. Cookies

  • See the Cookie Policy for the cookies and similar technologies we use and how to control them.

11. Changes and contact

  • We update this policy when our practices or the law change, post the new version here with its effective date, and tell account holders of material changes in advance.
  • Questions or complaints: Grievance Officer, Vyntez Solutions Private Limited, Sindhora Road, Varanasi, Uttar Pradesh 221001, India. Email: grievance@vyntez.com (Monday to Friday, 10:00 to 18:00 IST). You may also complain to the Data Protection Board of India once our grievance process is complete, or to your local data protection authority.

Grievance Officer

  • Grievance Officer
  • Vyntez Solutions Private Limited, Sindhora Road, Varanasi, Uttar Pradesh 221001, India
  • Email: grievance@vyntez.com (Monday to Friday, 10:00 to 18:00 IST)
  • For privacy, content, account, billing and consumer complaints about any Vyntez product. We acknowledge within 24 hours and aim to resolve within 15 days.