Privacy Policy

Last updated: 1 November 2026

This Privacy Policy explains how Qrew HR, a product of TheTechHacker ("Qrew HR", "we", "us" or "our"), collects, uses, shares and protects personal data when you visit qrewhr.com, sign up for or use the Qrew HR platform at app.qrewhr.com and its mobile apps (together, the "Service"), or otherwise interact with us.

We have written this policy with India's Digital Personal Data Protection Act, 2023 (the "DPDP Act") and its rules in mind. Terms such as "personal data", "Data Fiduciary", "Data Processor" and "Data Principal" have the meanings given to them in the DPDP Act.

1. Who we are

Qrew HR is a product of TheTechHacker, with its office at HITECH City, Hyderabad, Telangana, India. For questions about this policy or your personal data, contact us at hello@qrewhr.com.

2. Our role: Data Fiduciary and Data Processor

We handle personal data in two different capacities, and it helps to understand which applies:

As a Data Fiduciary: for personal data of website visitors, people who contact us, and the account holders and administrators of our customers. We decide why and how this data is processed.
As a Data Processor: for employee and candidate data that our customers (employers) upload to or generate in the Service. Here, the customer is the Data Fiduciary. We process that data only on the customer's instructions and in line with our agreement with them.

If you are an employee of one of our customers and have questions about your HR data, please contact your employer first. They decide what is collected and how it is used. We will support them in responding to your request.

3. Personal data we collect

3.1 Website visitors

Information you submit through forms, such as your name, work email, phone number, company name, team size and message.
Technical data collected automatically, such as IP address, browser type, device information, pages visited, referring pages and the date and time of your visit.
Information collected through cookies and similar technologies, as described in our Cookie Policy.

3.2 Customers and account users

Account details such as name, work email, phone number, job title, company name and login credentials.
Billing details such as billing contact, billing address, GST details and payment records. Card or bank details are handled by our payment service providers; we do not store full card numbers.
Communications with us, including support requests, feedback and demo requests.
Usage data such as features used, log-in times, settings and device and log information, which we use to operate, secure and improve the Service.

3.3 Customers' employee and candidate data (processed on the customer's behalf)

Depending on which modules a customer uses and what they choose to enter, this may include:

Identity and contact details, such as name, employee ID, date of birth, gender, address, phone number and email.
Employment details, such as department, designation, reporting manager, date of joining, work location and employment history.
Attendance and leave records, including check-in and check-out times and, where the employer enables it, location data captured at check-in.
Payroll and statutory details, such as salary components, bank account details, PAN, UAN, ESI number, tax declarations, reimbursements and deductions.
Documents, such as identity proofs, offer letters, certificates and policy acknowledgements.
Performance and recruitment information, such as goals, feedback, review ratings, resumes, interview feedback and offer details.
Helpdesk tickets and messages exchanged within the Service, including queries to the AI Copilot.

Customers are responsible for ensuring they have a valid basis, including any notice and consent required under the DPDP Act, for the employee and candidate data they upload.

4. How we use personal data

We use personal data for the following purposes:

To provide, operate and maintain the Service, including creating accounts and authenticating users.
To process payments, issue invoices and manage subscriptions.
To respond to enquiries, provide demos, onboarding and customer support.
To send service-related communications, such as security alerts, product updates and changes to our terms or policies.
To send marketing communications about Qrew HR, where you have agreed to receive them. You can unsubscribe at any time.
To understand how our website and Service are used so we can improve them.
To detect, prevent and respond to fraud, abuse, security incidents and technical issues.
To comply with legal obligations and enforce our Terms of Service.

When we act as a Data Processor, we use customers' employee and candidate data only to provide the Service to that customer, and not for our own marketing or for any purpose unrelated to the Service.

5. Legal basis and consent

Under the DPDP Act, we process personal data either with your consent or for certain legitimate uses permitted by law. In practice:

Consent: when you submit a form, sign up for an account or agree to marketing communications, we ask for your consent for the purposes described at that point and in this policy. You may withdraw consent at any time by writing to hello@qrewhr.com or using the unsubscribe link in our emails. Withdrawal does not affect processing already carried out, but we may be unable to continue providing some services.
Legitimate uses: we may process personal data without fresh consent where the DPDP Act permits, for example where you have voluntarily provided data for a specified purpose, to comply with a law or court order, or to respond to a medical emergency or similar situation.
Customer instructions: for employee and candidate data, we process data on the basis of our agreement with the customer, who is responsible for the legal basis for that processing.

6. How we share personal data

We do not sell personal data. We share it only as described below:

Service providers (Data Processors): trusted vendors who help us run the Service, such as cloud hosting, email delivery, payment processing, analytics and customer support tools. They may only use personal data to provide services to us and must protect it appropriately.
Within a customer's organisation: data in the Service is visible to the customer's authorised users according to the roles and permissions the customer sets.
Legal and safety reasons: where required by law, regulation, legal process or a government request, or to protect the rights, property or safety of Qrew HR, our customers or others.
Business transfers: in connection with a merger, acquisition, restructuring or sale of assets, subject to this policy continuing to apply to the data transferred.
With your consent: in any other case where you have asked or agreed to us sharing it.

Some of our service providers may store or process data outside India. Where this happens, we do so only to countries not restricted by the Government of India under the DPDP Act and with appropriate safeguards.

7. How long we keep personal data

We keep personal data only as long as necessary for the purposes described in this policy, or as required by law. In general:

Account and billing data is kept for as long as your account is active and afterwards for the period needed to meet tax, accounting and legal requirements.
Customers' employee and candidate data is kept for the duration of the customer's subscription. After the subscription ends, the customer can export its data for a limited period, after which we delete it, except where we are legally required to retain it.
Website enquiries and marketing data are kept until you ask us to delete them, withdraw consent, or the data is no longer needed.

Data in backups is deleted on our normal backup cycle.

8. How we protect personal data

We use reasonable security safeguards to protect personal data against unauthorised access, loss, misuse or alteration. These include role-based access controls, encryption of data in transit using HTTPS/TLS, access logs, regular backups and restricted access to production systems. You can read more on our Security page.

No system is perfectly secure. If a personal data breach occurs, we will take steps to contain it and will notify affected customers, individuals and authorities as required by the DPDP Act.

9. Your rights

Subject to the DPDP Act, you have the right to:

Access: obtain a summary of the personal data we process about you and the processing activities involved, and the identities of those we have shared it with.
Correction and completion: ask us to correct inaccurate or misleading data, complete incomplete data and update your data.
Erasure: ask us to erase personal data that is no longer necessary for the purpose for which it was collected, unless we must keep it by law.
Withdraw consent: withdraw consent you have given, as easily as you gave it.
Grievance redressal: have your complaints about our handling of your personal data addressed by us.
Nominate: nominate another person to exercise your rights in the event of your death or incapacity.

To exercise these rights, write to hello@qrewhr.com. We may need to verify your identity before acting on a request. If your request relates to employee data held by your employer in Qrew HR, we will refer it to your employer or assist them in responding.

10. Grievance redressal

If you have a concern or complaint about how we handle personal data, please contact our grievance contact:

Email: hello@qrewhr.com (subject line: "Privacy Grievance")
Address: Qrew HR, a product of TheTechHacker, HITECH City, Hyderabad, Telangana, India

We will acknowledge your grievance and aim to resolve it within the time required under the DPDP Act and its rules. If you are not satisfied with our response, you may approach the Data Protection Board of India.

11. Cookies

Our website uses cookies and similar technologies to keep the site working, understand how it is used and remember your preferences. For details and how to manage cookies, see our Cookie Policy.

12. Children's data

Qrew HR is a business service and is not intended for children. We do not knowingly collect personal data of anyone under 18 through our website. Where a customer needs to process data of a person under 18 (for example, an apprentice or intern), the customer is responsible for obtaining verifiable consent from a parent or lawful guardian as required by the DPDP Act. If you believe we have collected a child's data without proper consent, contact us and we will delete it.

13. Third-party links

Our website and Service may link to third-party websites or services. We are not responsible for their privacy practices, and we encourage you to read their policies.

14. Changes to this policy

We may update this Privacy Policy from time to time, for example to reflect changes in the Service or the law. When we do, we will update the "Last updated" date above. If the changes are significant, we will notify customers by email or through the Service before they take effect.

15. Contact us

For any questions about this Privacy Policy or our data practices, write to hello@qrewhr.com or visit our Contact page.