Privacy Policy

Last updated: 15 August 2026

Klok is built and operated by BeyondBoxAI Technologies Pvt. Ltd. (“we”, “us”), an Indian company. This policy explains what personal data we handle, why, and what rights you have over it. It is written to be read, not skimmed past — if anything here is unclear, write to us and we will answer plainly.

The two roles we play

Klok is HR software, so we handle personal data in two distinct capacities, and your rights run differently under each:

For visitors and trial signups — people who browse this site, download a template, take the HR health check or start a trial — we decide what is collected and why. We are the data fiduciary under India's Digital Personal Data Protection Act, 2023 (DPDP Act).
For employees of our customers — the people whose attendance, leave, salary and documents live inside a Klok account — the employer is the data fiduciary and decides what is processed. We process that data on the employer's instructions as their processor. If you are an employee with a question about your record, your first stop is your employer's HR; we support them in answering it.

What we collect, and why

From visitors and signups

What you give us — name, work email, company name, approximate headcount and phone number when you start a trial, request a download, submit the contact form or take the HR health check. We use it to create your account, respond, and follow up on your interest.
What the site records — pages viewed and referrers, tied to a session rather than to advertising profiles. You can decline analytics cookies from the banner, and we honour that with a two-year opt-out cookie whose only job is remembering that you said no.

Inside a customer account

Employee master data — identity, contact, employment and statutory details (PAN, UAN, ESIC and similar), entered by the employer or confirmed by the employee.
Sensitive fields are encrypted at rest — bank account numbers, IFSC codes, national identity numbers and travel-document numbers are stored encrypted at the application level, on top of transport encryption.
Attendance and, where enabled, location — punch times, and GPS only where the employer has switched field tracking on and the employee has recorded consent in the app. Location capture is bounded to working hours by design.
Documents and their AI reading — files dropped into the vault (offer letters, IDs, receipts) are read by an AI model to draft the record; a human confirms before anything is saved. See “AI” below.

What we never do

We do not sell personal data, to anyone, for anything.
We do not use one customer's data to benefit another. Every company's data is isolated to that company by a tenancy boundary enforced in the software and covered by automated tests.
We do not let AI write to records on its own. Every AI-drafted entry waits for a human to confirm it — that is the product's founding rule, and it is also a privacy control.

AI, honestly described

Klok's AI features (document reading, drafting, Klokee) send the relevant text or image to external model providers — currently Anthropic (Claude) and Google (Gemini) — under their business terms, which do not permit use of the data to train their models. The AI's output is a draft; nothing enters the record until a person confirms it, and the audit trail records who did.

Who else touches the data (sub-processors)

These are our sub-processors — the only third parties that handle personal data on our behalf. We keep the list short and each entry has one job:

Hosting — our application and database run on managed servers operated by Hostinger.
Messaging — payslips, alerts and OTPs sent over WhatsApp go through Meta's WhatsApp Business platform; email is sent through the employer's own configured mailbox where set, or ours.
AI model providers — as described above, only for the AI features and only the content needed for the task.
Payments — when online payment is offered, card and bank details are entered directly with an RBI-authorised payment gateway. We never see or store card numbers.

How long we keep it, and how you leave

Account and employee data stays for as long as the customer's account is active, plus what statute requires an employer to retain (payroll and statutory registers carry their own legal retention periods, which belong to the employer).
Leaving is always possible. A customer can export everything — employees, attendance, payroll history, documents — at any time, in usable formats, without asking permission. On termination we delete the account's data after the export window, except what law obliges anyone to keep.
Encrypted daily backups exist for disaster recovery and are pruned on a fixed schedule; deleted data leaves the backup cycle as those backups expire.

Your rights

Under the DPDP Act you may ask us (or, for employee records, ask your employer, whom we will assist) to access, correct, or erase your personal data (the right to erasure), and you may withdraw a consent you gave — such as field-location consent — from within the app. We answer requests at the address below, and we do not make you prove more than your identity to exercise a right.

If something goes wrong

If a breach affects your personal data we will notify the affected customers and the Data Protection Board as the DPDP Act requires, tell you what happened in plain language, and what we are doing about it. Every change to a record in Klok is written to an audit trail that cannot be edited afterwards, which is what makes an honest account of any incident possible.

Children

Klok is workplace software for employers and their staff. It is not directed at children and we do not knowingly process children's data.

Grievances and contact

Grievance contact under the DPDP Act:
Amreesh Nehra, BeyondBoxAI Technologies Pvt. Ltd.
sales@beyondboxai.com · +91 81304 68801

We reply to privacy grievances within the timelines the law sets, and usually much faster.

Changes to this policy

When we change this policy we change the date at the top and, for material changes, tell account owners directly. We do not weaken a commitment quietly.