LEGAL INFORMATION

Privacy Policy

Effective 14 September 2026 · Version 2026-09-14

How Avkash handles personal data, cookies, integrations and privacy requests.

Who we are

Avkash is operated by Gayatri Joshi, at 1923, Sadashiv Peth, Pune - 411030, Maharashtra, India. This policy covers avkash.co, app.avkash.co, enquiries and our leave and work-location service. Contact support@avkash.co for privacy questions.

For website enquiries, account administration and service analytics, we determine how data is used. For employee records supplied by a customer organisation, we generally process data on that organisation’s instructions. Your employer determines its leave policies, access permissions and lawful grounds for maintaining employment records. Our Data Processing Addendum explains this relationship.

Information we handle

Account information: Google account identifier, name, email address and information needed to authenticate and manage your session. We do not receive your Google password.

Organisation information: employee names and contact details, roles, managers, joining dates, work arrangements, leave requests and reasons, balances, grants, holidays, approvals and activity history. Administrators may supply this information directly or through an authorised migration.

Integration information: connection identifiers, authorisation tokens, Discord webhook details, sync preferences, delivery status and the records needed to provide integrations you enable.

Enquiries and support: your name, work email, phone number, company, team size and the information you send us. Technical information can include browser/device details, request metadata, security logs and usage events.

Please avoid entering unnecessary sensitive information, including medical diagnoses or documents, in leave reasons or support messages. Avkash is designed for workplace administration, not medical-record storage.

Why we use information

We use information to authenticate users, provide leave and work-location features, apply customer settings, produce reports, maintain service integrity, investigate errors and respond to enquiries. Enabled integrations deliver the updates selected by the organisation.

Where applicable, the grounds for our own processing include providing an agreed service, legitimate interests in operating and securing it, legal obligations, and consent where required. The customer organisation is responsible for the grounds and employee notices for its employment-related processing. This policy is information about our practices, not a request for blanket consent.

Who can access data

Access within an organisation depends on roles and settings. Administrators can manage employee records; configured managers can review requests. Availability views show the information permitted by the organisation’s settings.

Authorised Avkash operators may access information to provide support, perform requested migrations, administer the service or investigate security issues. In-app support sessions and associated actions are recorded. Infrastructure access is restricted to authorised operators.

We do not sell employee records or use them to target advertising. We may disclose information when legally required, to protect rights or security, or as part of a business transfer subject to appropriate confidentiality and notice.

Providers and integrations

Fly.io hosts our application and database. Our current primary deployment is in Singapore; provider support, infrastructure and other processing may occur elsewhere.

Google Sign-In provides authentication. Google Analytics provides website and app usage measurement. Google Workspace/email is used for business correspondence and enquiries.

Google Calendar, Google Sheets and Discord receive selected information only when the customer enables the relevant integration. Calendar updates include selected availability and holiday events; Sheets contains the selected employee, balance, request and report records; Discord receives selected notifications and summaries. These customer-controlled services have their own terms and privacy practices.

Infrastructure providers process data needed to supply their services. Customer-selected integrations are distinct from our infrastructure providers. We review changes to the provider list and update this policy when relevant.

Google API data

We use information received through Google APIs to provide the sign-in and connected features requested by users. We do not use Google API data for advertising, sell it, or use it to train general-purpose AI models. Transfers and human access are limited to providing the requested features, necessary security or legal purposes, or access authorised by the user, consistent with the Google API Services User Data Policy, including its Limited Use requirements.

You can disconnect integrations in Avkash and revoke Avkash’s access through your Google Account permissions. Disconnecting stops future sync; it does not necessarily delete the calendars, spreadsheets or messages already created in accounts controlled by your organisation.

Cookies and Google Analytics

Avkash uses cookies required for sign-in and session security. Blocking these cookies may prevent the app from working.

We also use Google Analytics on the production marketing site and app to measure visits and generic page navigation. Google can receive usage events, browser/device information and network information, and can set analytics cookies. Our custom page-view fields exclude organisation identifiers, employee names, leave reasons and arbitrary search text. We do not send employee records to Analytics. Advertising personalisation and Google signals are disabled in our integration.

Analytics is currently loaded on production visits; Avkash does not yet provide an on-site consent/preferences control. Turning off Google’s Enhanced Measurement does not disable Analytics itself. You can use browser privacy controls, tracking blockers or Google’s Analytics opt-out browser add-on. Cookie blocking alone may not prevent all analytics requests. A consent control must be introduced before processing that requires prior consent; we do not claim that this notice alone establishes compliance in every jurisdiction.

Retention, exports and offboarding

We retain workspace records while providing the service and following the customer’s instructions. An authorised administrator can contact support@avkash.co to arrange an Excel export by email and organisation closure. We verify the administrator and recipient before sending workspace data. Removing one employee is not the same as closing the organisation: the employer may need to retain employment records.

Our offboarding target is to remove the organisation’s data and integration credentials from systems under our control within 30 days of confirmed closure. Offboarding is currently handled with operator assistance. We confirm the export, deletion scope and completion with the administrator; do not rely on automatic deletion merely because you stop signing in.

Backups, manual database dumps and migration copies need separate cleanup. The 30-day target includes these copies, but automatic time-based expiry is not yet implemented for every backup. We therefore confirm backup deletion timing during offboarding rather than guarantee that every backup is automatically erased on day 30. Retained backup copies are restricted and must not be restored into active use without reapplying deletion instructions.

Copies in customer-controlled email, spreadsheets, calendars or Discord remain under the customer’s control. We may retain narrowly necessary records where required by law or to establish, exercise or defend legal claims, with restricted access.

Our retention target for support and enquiry correspondence is one year after the enquiry is closed, and for security logs one year after recording, unless narrowly necessary legal retention applies. Cleanup controls are still being put in place, so these periods are targets rather than a claim that automatic expiry is already enforced. Closing an organisation does not automatically remove all such records. Our intended Google Analytics user/event retention period is 14 months; the live configuration remains to be verified. Its retention settings do not apply to standard aggregate reports. Contact us for current retention information or a deletion request.

Your choices and rights

Depending on the laws that apply, you may have rights to request access, correction, export, deletion, restriction or objection, withdraw consent where used, or raise a complaint with an appropriate authority. Contact support@avkash.co. We may request proportionate identity verification and will respond within the applicable legal time limits.

For employee records controlled by your organisation, contact its administrator first. We will help the organisation respond to a request or direct your request to it where appropriate. Withdrawing integration permissions does not remove records the employer is otherwise entitled or required to keep.

International use, security and changes

Our service may involve processing outside your country, including Singapore and countries used by providers. Where law requires additional transfer arrangements, those must be put in place for the relevant customer. Hosting in one region does not mean all processing remains within that region.

We use HTTPS, role-based application access, tenant separation and encrypted integration credentials. No service can guarantee absolute security. Our service is intended for workplace use and is not directed at children.

We may update this policy to reflect changes in the service, providers or applicable requirements. The date and version on this page identify the current policy. We will provide additional notice of material changes where required.