1. Introduction

Hottrix IT Services Private Limited ("HOTTRIX", "we", "us", or "our") provides HOTTRIX CHAT, a multi-tenant SaaS platform used by Customer organisations ("Companies") for internal communication and workforce management. This Privacy Policy explains what personal data the Service processes, why, and how it is handled. This Policy is written to reflect the Service's actual functionality; it does not describe features that do not exist.

2. Categories of Personal Data

Depending on how a Company configures and uses the Service, the following categories of personal data may be processed:

• Account/identity data: name, email address, phone number, employee ID/code, department, designation, joining date, employment status, and role.
• Authentication data: password (stored only as a salted cryptographic hash, never in plain text), login timestamps, and failed-login/lockout state.
• Company/organisation data: company name, company code, and administrative configuration set by the Company Admin.
• Technical data: IP address and browser/user-agent information captured at points such as login, legal-document acceptance, and grievance submission.
• Communications content: chat messages, and file attachments including images, videos, PDFs, office documents, audio files, and voice notes shared within the Service.
• Location data: if a user chooses to share their location in a chat message, or if their browser location is captured at the time of an attendance clock-in/clock-out (only with the user's browser-level permission — attendance is still recorded even if location is denied).
• Call-related data: who called whom, call type (voice/video), call status (ringing/active/ended), start/end timestamps, and each participant's join/leave status. Technical connection ("signalling") data needed to establish a call — such as session descriptions and network connection candidates — is also processed. See the Voice & Video Calling Policy for detail on what is, and is not, collected during calls.
• Attendance data: clock-in/clock-out timestamps and, where shared, location at the time of the punch.
• Leave data: leave applications, leave type, dates, reason, approval/rejection status, and reviewer comments.
• Payroll data: salary configuration and calculated payroll figures (gross salary, leave-based deductions, other deductions, net salary) as configured and entered by the Company's HR/Admin users.
• Audit and notification data: a record of significant administrative actions (e.g. user created/disabled, leave approved/rejected, payroll calculated) and in-app notifications generated by those actions.
• Support/grievance data: information submitted through the grievance/contact form, described in the Grievance section below.

HOTTRIX does not request or intentionally collect special categories of sensitive personal data (such as health, biometric, or financial account data) as a core part of the Service, beyond what a Company may itself choose to enter into free-text fields (for example, a leave reason) at its own discretion and responsibility.

3. Purposes of Processing

Personal data is processed for purposes including: account authentication and access control; delivering the Service's communication features (chat, file/media sharing, voice notes, voice and video calling); Company administration (user, department, and manager management); attendance, leave, and payroll administration configured by the Company; security, fraud, and abuse prevention; maintaining audit logs for accountability; providing customer/technical support; complying with applicable law; and, where applicable, improving the reliability of the Service.

4. Voice and Video Calls

Voice and video calls are not recorded by HOTTRIX unless a separate recording feature is enabled and the applicable participants are appropriately notified of and have consented to recording. As of the effective date of this Policy, no such recording feature exists in the Service. HOTTRIX does not transcribe calls and does not offer screen-sharing/screen-recording as part of calling functionality. See the Voice & Video Calling Policy for further detail.

5. Legal Basis / Purpose Limitation (India — DPDP Act, 2023)

Where the Digital Personal Data Protection Act, 2023 and its rules apply, personal data processed through the Service is generally processed on the basis of the Company's legitimate business purposes in operating the Service for its own personnel, and/or consent obtained by the Company from its users, as applicable. Where a Company is the entity determining the purpose and means of processing its own personnel's data, HOTTRIX generally acts as a service provider processing that data on the Company's behalf and instructions, as further described in the Data Processing Addendum.

6. Data Sharing

Personal data is not sold. Data is shared only: within the Company itself (e.g. a chat message is visible to its intended recipients; HR/Admin roles can see workforce data as configured by the Company); with HOTTRIX personnel and infrastructure providers strictly as needed to operate the Service; and where required by applicable law or a valid legal process.

7. Data Retention

Personal data is generally retained for as long as the Company's account remains active, plus any additional period required for legitimate business, legal, or audit purposes. Historical records that exist for accountability purposes — such as legal-document acceptance records and administrative audit logs — are retained and are not deleted even if related settings change, consistent with their purpose as an audit trail.

8. Data Security

Technical and organisational measures used to protect personal data are described in the Security & Data Protection Policy, including tenant isolation between Companies, role-based access control, encrypted password storage, and authenticated file access.

9. Your Rights

Subject to applicable law, individuals may have rights to access, correct, or request deletion of their personal data, and to raise concerns about how their data is processed. Requests relating to a specific Company's data should generally be directed first to that Company's Admin/HR team, who administer the relevant accounts; requests may also be sent to HOTTRIX at the Privacy contact below, or submitted through the Grievance page.

10. Grievance / Privacy Contact

Hottrix IT Services Private Limited
Privacy Email: info@hottrix.in
Grievance Email: info@hottrix.in

11. Changes to This Policy

This Policy may be updated from time to time. Material changes will be published as a new version, and affected users may be required to review and re-accept it before continuing to use the Service.