1. Overview

This Privacy Policy describes how Cybrosys Technologies Pvt. Ltd. ("Cybrosys", "we", "us", or "our") collects, uses, and shares information when you use Horilla HRMS software, the Horilla Cloud service, this website (horilla.com), and related services (collectively, the "Services").

By using our Services, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

2.1 Information you provide directly

• Account information: Name, email address, company name, and password when creating a Horilla Cloud account.
• Contact information: Information submitted through contact forms, support tickets, or demo requests.
• Payment information: Billing details processed by our payment processor (Stripe). We do not store full card numbers.
• Employee data (Cloud): HR data you or your organization enters into Horilla Cloud, including employee records, payroll information, and attendance data. You are the data controller for this data; we are the processor.

2.2 Information collected automatically

• Usage data: Pages visited, features used, time spent, and interaction patterns on our website and Cloud service.
• Device information: Browser type, operating system, screen resolution, and IP address.
• Cookies: See Section 8 for details on our cookie usage.

3. How We Use Information

We use collected information to:

• Provide, operate, and improve the Services
• Process transactions and send related information (receipts, invoices)
• Send service announcements, security alerts, and support messages
• Respond to support requests and inquiries
• Monitor and analyze usage trends to improve user experience
• Detect, investigate, and prevent security incidents
• Comply with legal obligations

We do not use employee HR data entered into Horilla Cloud for any purpose other than providing the Service to you.

4. Sharing & Disclosure

We do not sell, rent, or trade your personal information. We may share information in the following circumstances:

• Service providers: With vendors that help us operate our services (hosting, payment processing, analytics). These providers are bound by data processing agreements.
• Legal compliance: When required by law, court order, or government request.
• Business transfers: In connection with a merger, acquisition, or sale of assets — with advance notice.
• With your consent: For any other purpose with your explicit consent.

5. Data Retention

We retain your account information for as long as your account is active or as needed to provide Services. Employee data in Horilla Cloud is retained for the duration of your subscription. Upon cancellation, you have 30 days to export your data. After 30 days, data is permanently deleted.

You may request deletion of your data at any time by contacting privacy@cybrosys.com.

6. Security

We implement industry-standard security measures including:

• AES-256 encryption at rest for all stored data
• TLS 1.3 encryption in transit
• SOC 2 Type II audit in progress
• Regular security audits and penetration testing
• Role-based access controls
• Two-factor authentication for admin accounts

No method of transmission or storage is 100% secure. If you discover a security vulnerability, please report it to security@horilla.com.

7. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of personal data we hold about you.
• Correction: Request correction of inaccurate information.
• Deletion: Request deletion of your personal data ("right to be forgotten").
• Portability: Receive your data in a machine-readable format.
• Objection: Object to certain uses of your data.
• Restriction: Request we limit how we use your data.

To exercise any of these rights, contact us at privacy@cybrosys.com. We will respond within 30 days.

8. Cookies

We use cookies and similar tracking technologies on our website. These include:

• Strictly necessary cookies: Required for the website to function (session management, security).
• Analytics cookies: Help us understand how visitors interact with our site (e.g., page views, referrers). We use anonymised data only.
• Preference cookies: Remember your settings (e.g., language, billing period selection).

You can control cookies through your browser settings. Disabling cookies may affect some site functionality.

9. Children's Privacy

Our Services are not directed to individuals under 18 years of age. We do not knowingly collect personal information from children. If you believe we have inadvertently collected such data, please contact us and we will promptly delete it.

10. International Data Transfers

Cybrosys is headquartered in Kochi, Kerala, India. If you are located outside India, your information may be transferred to and processed in India or other countries where our service providers operate. We ensure appropriate safeguards are in place for such transfers.

For users in the European Economic Area (EEA), data transfers are conducted under Standard Contractual Clauses (SCCs) approved by the European Commission.

11. Self-Hosted Instances

If you deploy Horilla on your own infrastructure (self-hosted), Cybrosys has no access to the data you store in that instance. You are the sole data controller for all data in a self-hosted Horilla installation. Cybrosys collects no telemetry or usage data from self-hosted instances unless you opt in to anonymous usage statistics.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email (for Cloud customers) and by posting the updated policy on this page with a revised "Last updated" date. Your continued use of the Services after changes take effect constitutes acceptance of the updated policy.

13. Contact Us

If you have questions about this Privacy Policy or our privacy practices, please contact us:

• Email: privacy@cybrosys.com
• Post: Cybrosys Technologies Pvt. Ltd., Kochi, Kerala, India
• Data Protection Officer: dpo@cybrosys.com

See also: Terms of Service · Security