Privacy Policy
Opsx Apex Private Limited (“OpsX”, “we”, “us”) makes and runs OpsX (opsx.in), attendance, payroll and operations software for businesses. This policy explains, in plain language, what personal data OpsX handles, why, who helps us, how long we keep it, and the rights you have. It is our notice under the Digital Personal Data Protection Act 2023 (DPDP Act). Opsx Apex Private Limited, 2nd Floor, Gudar Niwas, Bhadeji, Gaya, Bihar 823003, India. Contact: opsx.official@gmail.com · +91 79039 27019.
Last updated · Effective from the same date
Notice in brief
- Who decides. For people who visit opsx.in, sign up for a trial, contact us or are billed by us, Opsx Apex Private Limited is the Data Fiduciary. For staff data inside a customer’s account, the employer is the Data Fiduciary and OpsX processes it on the employer’s behalf (section 1).
- What and why. Name, work email, mobile and company to create and verify your account, support you and bill you; the details you type in an enquiry so we can call you back. Section 2 lists every kind of data and its purpose.
- Never. We do not sell personal data and do not use it for advertising.
- Your rights. Ask for a summary of your data, have it corrected, completed or erased, nominate someone to act for you, and complain (section 8).
- Withdraw consent as easily as you gave it: write to opsx.official@gmail.com or WhatsApp/call +91 79039 27019. A trial account can be closed from the account itself. An employee can withdraw face-verification consent in the OpsX Partner app or through their employer.
- Grievances. Grievance Officer, Opsx Apex Private Limited, 2nd Floor, Gudar Niwas, Bhadeji, Gaya, Bihar 823003, India · opsx.official@gmail.com · +91 79039 27019. If you are not satisfied with our answer, you may complain to the Data Protection Board of India.
1. Two roles — whose data, whose decision
- Data in a customer’s account (we act for the employer). A business that subscribes to OpsX (the “Customer”) adds its staff and records their attendance, leave, pay and work. The Customer is the Data Fiduciary for that data: it decides what is collected and why. OpsX is its Data Processor and handles the data only to run the Service for the Customer. If you are an employee of a Customer, your employer’s own notice to you governs that data; please contact your employer first. We will help them answer you.
- Our own data (we decide). For people who visit opsx.in, sign up for a trial, contact us or are billed by us, OpsX is the Data Fiduciary, and this policy is our notice to you.
2. What we collect and why
| Who | Data | Why we use it |
|---|---|---|
| Website visitors | A random visit id kept in your browser’s session storage (not a cookie) and the pages visited in that session | Count which pages lead to sign-ups |
| Enquiries | The name, company, city, phone, headcount and message you type in an enquiry form. The form on opsx.in sends nothing to our servers: it prepares a WhatsApp message that you send yourself | Answer the enquiry and call you back |
| Anyone who signs up | Name, work email, mobile number, company name, a one-time email code, the password you choose (stored only as a one-way hash), and which edition of these policies you accepted; a Cloudflare Turnstile bot check | Create the account, verify it is you, stop abuse |
| Customer’s users and staff | Name, employee code, contact details, department, designation, manager, role, sign-in identifiers | Run the Customer’s account |
| Attendance | Punch times, device, office or geofence; GPS location while on duty in the OpsX Partner app, only when the Customer turns it on | Attendance, field visits, proof of work |
| Face verification | Only when the Customer turns it on and the person consents. A face template — 128 numbers computed from the face, not a picture — is stored in the Customer’s account on our servers and, encrypted, on the Customer’s kiosk tablets, which match on the tablet; a kiosk punch sends a signed claim, never an image. In the OpsX Partner app the 128 numbers are computed on the phone and compared on our server. When a person registers their own face in the app, one reference photo they consent to send is stored with their record so HR can check it is the right person. Every consent, withdrawal and deletion is logged | Confirm the right person is punching in |
| Payroll | Salary structure, attendance-based pay, PF/ESI/UAN numbers, PAN, bank account for salary, payslips. Salary history is stored encrypted | Calculate and record pay for the Customer |
| ID documents | Aadhaar, PAN, passport or other documents the Customer or employee uploads | The Customer’s employment records |
| Support | Messages and attachments you send us, from inside the app or by WhatsApp, phone or email | Answer and fix your query |
| Billing | Company name, billing address, GSTIN, contact person, invoices and payments. Card details are handled by our payment partner; we never see or store card numbers | Bill the Customer and meet tax law |
| Security | Sign-in history, IP address, device and browser, and an audit trail of changes | Protect accounts, investigate misuse, meet the law’s log-keeping duty |
We collect only what these purposes need. Optional features (GPS, face verification, the AI assistant, WhatsApp messages, offers in the employee app) are off until the Customer turns them on.
3. Lawful basis
- For our own data: your consent, given when you sign up or contact us, and the legitimate uses the DPDP Act allows (for example keeping records the law requires, and security).
- For data in a Customer’s account: the Customer’s lawful basis — typically the employment purposes the DPDP Act allows, and the employee’s consent where the Customer asks for it (for example face verification).
You can withdraw a consent at any time, as easily as you gave it (section 8). Withdrawal does not undo processing already done.
4. Who helps us (sub-processors)
We share personal data only with service providers who need it to run OpsX, under contracts that require them to protect it, and only for the purpose stated:
| Provider | What it does | Data it sees |
|---|---|---|
| Amazon Web Services (Mumbai region, India) | Application servers | All data in transit through the app |
| MongoDB Atlas | Database | All stored data |
| Cloudflare | Bot check on sign-up (Turnstile); encrypted backups and archived audit logs (R2 storage) | IP address and browser signals; encrypted backup files |
| Brevo | Sign-up codes and notice emails | Name and email address |
| App notifications (Firebase Cloud Messaging), once switched on | A device token | |
| A third-party AI model provider | The optional AI assistant | Questions and the figures needed to answer them, with names replaced and identifiers masked |
| Meta WhatsApp, MSG91 | Messages a Customer chooses to send (for example a purchase order to a supplier, or an OTP by SMS) — only when the Customer connects them | Recipient’s number and the message |
| Our payment partner | Collecting payments | Payer details and payment status |
AI assistant. Before anything is sent to the AI model provider for an answer, people’s names are replaced with placeholders and email addresses, phone numbers, PAN and Aadhaar numbers are masked. The assistant only reads data.
We do not sell personal data, and we do not use Customer data for advertising. We may disclose data when the law requires it (for example a valid order from a court or authority), and we will tell the Customer where the law allows.
5. Where data is stored
Our application servers are in India (AWS, Mumbai region). Our database provider and some other providers above (for example Cloudflare, Brevo, Google and the AI model provider) may store or process data in other countries. The DPDP Act allows this unless the Government restricts a country; we will follow any such restriction.
6. How long we keep it
| Data | How long |
|---|---|
| Customer account data | While the subscription runs. The Customer’s Master Admin can download all of it at any time (Settings → Company data). After the account closes it stays available for export for 30 days, then is deleted from live systems |
| Backups | Encrypted; overwritten on their normal rotation within 12 months; restored only for disaster recovery |
| Face template | Deleted 30 days after the person’s last working day, or at once when they withdraw consent or HR rejects the registration |
| Face reference photo | Deleted 30 days after HR verifies the registration, or at once if HR rejects it |
| Sign-in and audit logs | 365 days (the DPDP Rules ask for at least one year), then archived encrypted and deleted |
| Trial sign-ups that never verify | 30 days |
| Enquiries | As long as we need to answer and follow up the enquiry; ask us and we delete it |
| Our invoices and billing records | As long as tax and company law require (generally 8 years) |
Customers may have to keep payroll records longer under labour and tax law; that is their decision as Data Fiduciary, and they can export the data to do so.
7. Security
Each Customer’s data is kept separate and every change is tied to that Customer. Traffic is HTTPS only; salary history is encrypted; sign-ins are rate-limited and sessions expire after 24 hours; access by our staff is limited to what support needs and is logged; backups are encrypted and kept off the main server.
No system is perfectly secure. If a personal data breach happens, we will inform affected people (or, for Customer data, the Customer) without delay, and report it to the Data Protection Board of India within 72 hours as the DPDP Rules require, saying what happened, what data was involved, the likely effect and what we are doing about it.
8. Your rights, and how to use them
Under the DPDP Act you may:
- ask for a summary of your personal data we process and who we shared it with;
- ask us to correct, complete, update or erase it;
- withdraw a consent you gave;
- nominate someone to exercise these rights for you if you die or become unable to;
- complain to us (section 10), and then to the Data Protection Board of India.
How: write to opsx.official@gmail.com or WhatsApp/call +91 79039 27019, saying what you want. Withdrawing a consent is as easy as giving it: one message is enough, and a trial account can also be closed from the account itself. Employees of a Customer: write to your employer first — they control that data; face-verification consent can also be withdrawn in the OpsX Partner app. We may need to confirm your identity before acting, and we may keep data the law requires us to keep.
9. Cookies and similar technology
opsx.in does not set advertising or tracking cookies. It keeps a random visit id in your browser’s session storage (cleared when you close the tab) to count sign-up steps. The OpsX app uses only what it needs to keep you signed in and remember your settings. Videos on opsx.in load from youtube-nocookie.com only when you press play.
10. Grievance Officer
Grievance Officer, Opsx Apex Private Limited, 2nd Floor, Gudar Niwas, Bhadeji, Gaya, Bihar 823003, India · opsx.official@gmail.com · +91 79039 27019. We acknowledge a grievance within 48 hours and reply within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India.
11. Children
OpsX is for businesses and their adult staff. We do not knowingly collect children’s data. If a Customer records a person under 18 (for example an apprentice), the Customer must obtain the verifiable parental consent the law requires.
12. Changes
We will post changes here with a new date, and email Customers’ Master Admins about material changes before they apply. See also our Terms of Service and Refund & Cancellation Policy.