Privacy Policy

1. Who we are and our role

This Privacy Policy explains how USR INFOTECH Solutions Private Limited (“USR INFOTECH”, “we”, “our” or “us”) collects, uses, shares and protects personal data. It is written to meet India’s Digital Personal Data Protection Act, 2023 (DPDP Act) and the EU General Data Protection Regulation (GDPR), and other applicable laws.

Our role depends on the data:

• Platform data (employee and performance data inside aim performance™, OKR Stars™, Skills2Talent™ Essential and USR Apps™): the Customer or End Client is the data fiduciary (controller). We act as their data processor and follow their instructions.
• Our own business data (website visitors, enquiries, partner and customer contacts): USR INFOTECH is the data fiduciary (controller).

If you are an employee using a Platform through your employer, please contact your employer first about your personal data. We will support them in responding to you.

2. Information we collect

• Identity and contact details: name, work email, phone number, employee ID.
• Work information: company, department, job title, reporting manager, location.
• Performance and talent data: goals, OKRs, KPIs, reviews, ratings, feedback, competencies, and similar content entered into the Platforms.
• Account and login data: username, encrypted credentials, single sign-on identifiers.
• Usage and device data: IP address, browser, device identifiers, access logs and audit trails.
• Enquiry data: details you share through website forms, chat, email, calls or demo bookings.

We collect this from you directly, from your employer or our Reseller Partner when they set up accounts, from integrations your employer enables (such as an HRMS or Google Workspace), and through cookies on our website (see our Cookie Policy).

3. How we use information and why

We do not sell or rent personal data.

4. AI features

Where a Customer enables AI-assisted features, the relevant Platform data is processed only to deliver that feature to the Customer, for example to suggest goals or summarise feedback. The content of each AI request is sent to the large language model provider that serves the feature, which may be located outside India or the EU, such as OpenAI in the United States. Where we offer a choice of model or provider, the Customer decides which one is used. We do not use Customer Data to train general-purpose AI models. Our AI management system is certified to ISO/IEC 42001, which covers AI risk and impact assessment and human oversight.

5. How we share information

• Sub-processors that help us run the Services, such as cloud hosting (Amazon Web Services and Hetzner Online), AI model providers, email and communication tools, and analytics, under written contracts with data protection terms. See our current list of sub-processors.
• Reseller Partners for End Clients they serve, under their partner agreements.
• Integrations that a Customer chooses to connect, such as an HRMS or single sign-on provider.
• Authorities where required by law, or to protect our rights, users or the Services.
• A successor in the event of a merger or acquisition, subject to this Policy.

6. Where data is stored and international transfers

Platform data is hosted on Amazon Web Services in Mumbai (India) and with Hetzner Online in Germany (European Union). Customers can choose the location that suits their data residency needs. On request, a Customer may instead be hosted on another cloud provider in a region it chooses, or in its own private cloud or on-premises data centre; the hosting location is then stated in its agreement. AI requests may be processed by model providers in other countries, as listed on our Sub-processors page. Where personal data is transferred across borders, we do so as permitted by the DPDP Act and, for EU data, using appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

7. How long we keep data

We keep Platform data for the duration of the Customer’s subscription and then return or delete it as set out in the Customer’s agreement. Backups are overwritten on a rolling cycle. Enquiry and business contact data is kept for as long as needed for the purpose it was collected, or as required by law, and then deleted.

8. How we protect data

Our information security management system is certified to ISO/IEC 27001:2022 and audited independently every year. Measures include encryption in transit and at rest, role-based access, single sign-on, audit logs, backups and incident response. Read more on our Data Security page and our InfoSec, Audits & Risk Assessments page.

If a personal data breach affects Customer Data, we will notify the affected Customer without undue delay and support them in meeting their own notification duties to the Data Protection Board of India, EU supervisory authorities and affected individuals.

9. Use of Google Workspace APIs

Some Platforms may request access to Google Workspace APIs, such as Google Sheets, only to deliver features the user asks for. We affirm that:

• We do not use Google Workspace API data to develop, improve or train generalised AI or machine learning models.
• Data accessed through Google APIs is used only to provide the requested feature, such as syncing performance data with Google Sheets.
• We do not share this data with third parties unless the user authorises it or the law requires it.
• Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

10. Your rights

Depending on where you are, you have the right to:

• access a summary of your personal data and how it is processed;
• correct, complete or update your personal data;
• request erasure of your personal data;
• withdraw consent, where processing is based on consent;
• object to or restrict certain processing, and receive your data in a portable format (GDPR);
• nominate another person to exercise your rights in the event of death or incapacity (DPDP Act);
• raise a grievance with us, and then complain to the Data Protection Board of India or your local data protection authority.

To exercise your rights, email support@usrinfo.tech with the subject “Data rights request”. We may need to verify your identity. If your request concerns Platform data, we will pass it to, and act on the instructions of, your employer.

11. Children

Our Services are designed for business use and are not directed at anyone under 18. We do not knowingly collect personal data from children.

12. Third-party links

Our website and Platforms may link to third-party sites and apps. Their privacy practices are their own, so please read their policies.

13. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version here with a new “last updated” date, and notify Customers of material changes.

14. Contact and grievance officer