Privacy
What VEYRA collects, why, and how it's protected, in plain terms.
This policy explains what VEYRA collects, why, and how it's handled, across the marketing site, the tenant application, and the employee exit-interview portal. VEYRA is operated by Acecoderz Infosolutions Private Limited, based in Lucknow, Uttar Pradesh, India. This policy is written to meet the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (the "SPDI Rules"), and the Digital Personal Data Protection Act, 2023 (the "DPDPA").
Under the DPDPA, your organisation is generally the Data Fiduciary for the personal data of the employees it enters into VEYRA, and VEYRA acts as its Data Processor. For the account and billing data an organisation gives us directly, and for this marketing site, VEYRA is the Data Fiduciary. If you're a departing employee, you're a Data Principal, with the rights set out below.
Organisation and admin contact details submitted at registration or by an admin. Exit case data entered by HR: employee name, role, and departure details. Interview content: written responses, recorded video, and any documents an HR admin uploads as pre-interview context, which can include Sensitive Personal Data or Information under the SPDI Rules, such as health or financial details an employee chooses to share. HRIS data synced from BambooHR when an organisation connects it. Billing details processed through Razorpay for INR invoices. Messages sent to the support chat widget. Standard technical data: IP address, browser, and timestamps, kept in the audit trail for security purposes.
Before an interview begins, the employee portal walks the departing employee through confidentiality and consent screens, including whether recording is enabled for that organisation, and records that choice. Where any of the information collected is Sensitive Personal Data or Information, we rely on this consent, obtained as required under the SPDI Rules and the DPDPA, before it's processed.
To run the exit interview process end to end: classifying departures, matching them to the right Exit Blueprint, scheduling and conducting interviews, and producing structured reports. To respond to support and registration requests. To secure the platform, including the audit trail every action is logged to. We don't use personal data for any purpose beyond what it was collected for.
An organisation can enable AI assistance to help surface patterns across interview evidence and draft a first read of a case. Which AI provider is used is configured per organisation, and can be a self-hosted model that never leaves the organisation's own infrastructure. Where a configured provider is based outside India, this involves a transfer of personal data outside India, which the DPDPA permits unless the Central Government has specifically restricted that destination. A human always reviews the diagnosis before it becomes part of the case record; AI output is never the final word.
We don't sell personal data. Data is shared only with: the cloud infrastructure providers hosting the platform; BambooHR, if an organisation connects it; Razorpay, for INR billing; the AI provider an organisation has configured, if AI assistance is enabled; and an accredited partner agency, only for cases an organisation explicitly delegates to it, with cross-organisation data isolation enforced.
Retention is configurable per data type by an organisation's own admins. Nothing is archived or deleted until a retention policy is explicitly enabled for that data type, and enabled policies are applied nightly. In line with the DPDPA, personal data is not kept beyond what's needed for the purpose it was collected for, or beyond any legal retention requirement that applies to it.
We follow reasonable security practices and procedures as required under the SPDI Rules. Interview assessments and case evidence are encrypted at rest, not just access-controlled. Executive and critical-talent cases route only to authorised reviewers. Every classification, action, and access is logged and traceable back to evidence.
If we become aware of a personal data breach, we'll notify affected organisations without undue delay, in line with the DPDPA's breach-notification requirements, and report reportable cyber incidents to the Indian Computer Emergency Response Team (CERT-In) within the timeline its directions require.
Under the DPDPA, you can ask for a summary of the personal data we hold about you and how it's been processed, ask us to correct or complete it, ask us to erase it once it's no longer needed for the purpose it was collected for, withdraw consent you previously gave, and nominate another individual to exercise these rights on your behalf if you become unable to. To exercise any of these, contact your organisation's admin or reach us directly on the Contact page.
VEYRA is built for the workplace and isn't directed at children. We don't knowingly collect personal data from anyone under 18, and we don't track, monitor the behaviour of, or serve targeted advertising to children, consistent with the DPDPA's requirements for processing children's data.
The platform uses only the cookies needed to keep you signed in and to protect against cross-site request forgery. It does not currently use advertising or third-party tracking cookies.
As required under the IT Act, 2000 and the rules made under it, we've appointed a Grievance Officer to handle complaints about how personal data is processed: Sudhir Prattap Singh, reachable at connect@acecoderz.com. We'll acknowledge a complaint within 24 hours and aim to resolve it within the timeline the law requires. If it isn't resolved to your satisfaction, you can escalate it to the Data Protection Board of India once it's operational.
If this policy changes in a material way, we'll update the date below and, where required, notify organisation admins directly.
This policy is governed by the laws of India. Courts at Lucknow, Uttar Pradesh shall have exclusive jurisdiction over any dispute arising from it.