Who we are
EpicHRM is operated by EpicKOD (SMC-PVT) Ltd., Flat 31 Punjab Center, M.B.Din (“EpicHRM”, “we”, “us”). This policy explains how we handle personal data on epichrm.com, in the EpicHRM web app at app.epichrm.com, and in the EpicHRM apps for Android, iOS, Windows and macOS.
Questions or requests: info@epickod.com. Grievance Officer and Data Protection Officer: [name and email].
Our two roles
For our customers’ HR data, we act on their behalf. When a company uses EpicHRM, the company decides what it records about its people and why. For that data the company is the controller (a “data fiduciary” in India, a “business” in California) and we are its processor or service provider. We process it only under the company’s instructions and our Data Processing Agreement. If you are an employee of one of our customers, please send requests about your HR records to your employer first; if you contact us, we will pass your request on to them.
For everything else, we are the controller. That covers people who visit our website, ask for a demo, sign up for or administer an account, and contact us.
What we collect
Account and sign-in data
- Name, work email address and the company you belong to.
- Your password, stored only as an Argon2 hash; we cannot read it.
- Passkeys: the public key and a device name. Your fingerprint, face or PIN never leaves your device.
- A session token in a cookie while you are signed in (see the Cookie Policy).
HR data our customers enter (processed on their behalf)
Depending on how a company uses EpicHRM, this can include:
- Identity and contact details: name, photo, date of birth, national ID number, home address, phone, emergency contact.
- Employment details: employee ID, department, designation, manager, branch, join date, shifts, holidays.
- Attendance: check-in and check-out times and corrections. EpicHRM does not record your location.
- Leave requests and balances, expense claims and receipts, approvals and their history.
- Salary, payroll results, payslips and bank account details for payment.
- Documents the company or employee uploads, such as contracts, passports or work permits.
- Blood group, if the company chooses to print it on ID cards. This is health data and is treated as sensitive.
- Announcements and notifications sent inside the company.
Data from your use of the service
- Records of significant changes (for example, who changed an employee’s photo or role, and when).
- IP address and request details in server logs and rate-limit counters, used to keep the service secure.
Data you send us
- Demo requests and emails: your name, company, contact details and what you tell us.
Our website sets no cookies and uses no analytics or advertising trackers.
How we use it, and our legal bases
| Purpose | Legal basis (GDPR / UK GDPR) |
|---|---|
| Provide the service: sign-in, the HR features, emails such as invitations, approvals and payslip notices | Performance of our contract with the customer; for HR data, the customer’s instructions |
| Keep the service secure: authentication, rate limiting, change records, abuse prevention | Legitimate interests in protecting our customers and our service |
| Answer demo requests and support questions | Legitimate interests; steps taken at your request before a contract |
| Billing, tax and accounting records | Legal obligation |
| Comply with law and enforce our terms | Legal obligation; legitimate interests |
Under India’s Digital Personal Data Protection Act, 2023, we process personal data for which we are the data fiduciary on the basis of your consent or for the legitimate uses the Act allows, including employment purposes on behalf of our customers. You can withdraw consent at any time by writing to info@epickod.com.
We do not sell personal data, share it for cross-context behavioural advertising, or use customer data to train AI models.
The EpicHRM assistant
If your company turns the assistant on and you use it, your message and the records needed to answer it (only records your role already lets you see) are sent to Cloudflare Workers AI to generate a reply. The assistant never changes anything until you confirm the action it proposes.
- Your conversation is kept in your own browser, not on our servers.
- A proposed action is stored on our servers for up to 24 hours so it can be confirmed once, then it is deleted automatically.
- Replies can be wrong. Check anything important before you rely on it.
International transfers
Customer data is stored in [database region], and the application runs in [hosting region]. Some subprocessors process data in other countries, including the United States.
When personal data leaves the European Economic Area, the United Kingdom, or another country that restricts transfers, we rely on an adequacy decision or on safeguards the law recognises, such as the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum. For transfers out of India, Saudi Arabia, the UAE and Pakistan, we follow the conditions those countries’ laws set. You can ask us for a copy of the safeguards we use.
How long we keep it
- Account data: for as long as the account exists.
- Customer HR data: for the subscription, then deleted within 30 days after it ends, unless the customer exports or deletes it sooner.
- Backups: overwritten within 30 days.
- In-app notifications: deleted automatically after 180 days.
- Sign-in sessions: end after 30 days, or when you sign out.
- Records we must keep by law, such as invoices: for the period the law requires.
Your rights
Write to info@epickod.com to use any of these rights. We will answer within the time your law sets (one month under the GDPR, 45 days under the CCPA), and may need to confirm your identity first. We will not treat you differently for using them. For HR records, we will involve your employer, who controls that data.
European Union and United Kingdom
Access, rectification, erasure, restriction, portability, objection to processing based on legitimate interests, and withdrawal of consent. You can also complain to your data protection authority. EU representative: [EU representative]. UK representative: [UK representative].
India
Under the Digital Personal Data Protection Act, 2023: to get a summary of your data and how it is processed, to correct, complete, update or erase it, to have grievances addressed by our Grievance Officer, and to nominate someone to act for you. If our response does not resolve your grievance, you may complain to the Data Protection Board of India.
California, United States
Under the CCPA as amended by the CPRA: to know what personal information we collect, use and disclose; to delete and correct it; to opt out of its sale or sharing (we do neither); and to limit the use of sensitive personal information (we use it only to provide the service). An authorised agent may make a request for you.
Saudi Arabia and the United Arab Emirates
Under Saudi Arabia’s Personal Data Protection Law and the UAE’s Federal Decree-Law No. 45 of 2021: to be informed, to access, correct and request destruction of your data, and to withdraw consent. You may complain to the Saudi Data and AI Authority (SDAIA) or the UAE Data Office.
Pakistan
We handle personal data in line with applicable Pakistani law, including the Prevention of Electronic Crimes Act, 2016. We will update this policy when Pakistan’s personal data protection legislation comes into force. You can ask us to access or correct your data at any time.
Security
We protect data with company-level isolation on the server, role-based access, encryption in transit and at rest, passkey sign-in, and private file storage with short-lived links. Our Security page has the details. If we learn of a breach affecting your data, we will notify the affected customers and authorities as the law requires.
Children
EpicHRM is a workplace tool and is not meant for children. We do not knowingly collect data about anyone under 16 except as an employer’s records require, under that employer’s control.
Changes to this policy
We will post changes here and update the effective date. If a change materially affects how we use personal data, we will tell account administrators by email before it takes effect.