Your data,
your rights

GigRoot is operated by Apie Technologies Private Limited. Most people reading this reach GigRoot in one of two ways, and our responsibilities differ between them.

1.1 If you signed up for GigRoot yourself

Your account, your profile and anything you do with the product are ours to answer for. We decide why and how that information is handled, which under the Digital Personal Data Protection Act, 2023 makes us the Data Fiduciary, and this policy is the notice that goes with it.

1.2 If your employer or a client put your details into GigRoot

Then they decide what goes in, who sees it and how long it stays, and we only process it on their instructions. They are the Data Fiduciary; we are their Data Processor. If you want your record corrected or removed, ask them first — we will help them do it, but we will not change their records on our own initiative. If you cannot reach them, write to us and we will try to put you in touch.

2.1 Your account

• Name, email address, phone number, password (stored only as a bcrypt hash), profile picture, bio and location.
• Professional details you choose to add: skills, experience, education, certifications, languages, links.
• Where you are paid through GigRoot: bank account details and tax identifiers.
• If your workspace asks for identity verification: a selfie and a photo of a government ID.

2.2 Records your workspace keeps about its people

An employer using GigRoot for HR and payroll can store a staff record that includes date of birth, gender, marital status, nationality, blood group, PAN, Aadhaar and passport numbers, bank account and IFSC, home addresses, an emergency contact, salary and employment history. Several of these are sensitive. Inside the product they are withheld from everyone except the owner, managers, HR and payroll — an ordinary colleague cannot see them.

2.3 Records about clients, leads and candidates

• Contact details, company information, billing addresses, GSTIN and PAN for invoicing.
• Candidate applications: CV, contact details, date of birth, expected salary, interview notes and offer documents.
• Email that arrives at a connected shared inbox is stored in full, including attachments.
• Where your workspace uses the calling features: call logs and, if it switches recording on, call recordings.

2.4 Online assessments

If a workspace sends you a proctored assessment, the assessment can be set to take webcam stills at intervals and to record webcam or screen video for the duration, along with your IP address and browser details. You are asked to consent before it starts and you can decline, which is recorded. Images are checked only for how many faces are visible — we do not match your face against any database.

2.5 Automatically

• IP address, browser and device details, pages visited and timestamps.
• Your IP address is stored on the attendance record when you clock in.
• Device tokens, so we can send push notifications you asked for.

What the desktop app does not do: it takes no screenshots, records no keystrokes, reads nothing on your screen, and does not log which applications or websites you use. Older versions could take screenshots; that was removed, the upload is refused by the server, and no new ones can be created. Screenshots captured before then still exist in workspaces that used the feature and remain visible to that workspace owner until deleted.

What it does: while you are clocked in, it asks your operating system a single question every few minutes — how long since this computer last saw a keypress or mouse movement. That figure decides whether to put you on a break or clock you out. Alongside it we store your platform and the app version.

3.1 Field visits

If your workspace uses field check-ins, tapping to start or end a visit records your GPS position at that moment, with accuracy, and a selfie where your workspace requires one. Location is never collected in the background or continuously. You are asked for consent separately and can withdraw it at any time; visits already recorded are kept for expenses and audit.

We keep a record of these consents — which one, which version, when you gave it and when you withdrew it — so that both you and your employer can see what was agreed.

• Running the product: signing you in, showing your records, sending the notifications you asked for.
• Invoicing, payroll, expenses and tax documents your workspace produces.
• Keeping the service secure, investigating abuse, and meeting our own legal and tax obligations.
• Support, when you write to us.

We do not sell personal data, and we do not use your workspace data to advertise to you or anyone else.

4.1 Automated assessment

The product scores activity into points and efficiency figures, and can generate a monthly summary naming who is above or below the team average. It can also produce a skill score and similar ratings on a profile. These are inputs for a human, not decisions made by a machine: nobody is paid, disciplined or dismissed by GigRoot. If a rating about you looks wrong, ask your workspace to correct it.

Some features send content to an AI provider — Anthropic, or Google Gemini where a workspace has chosen it. Only the item being worked on is sent: the email being triaged, the document being written, the CV being read, the question being asked. Your database is never handed over wholesale, and nothing sent is used to train anyone's model.

Most workspaces supply their own AI key, in which case the request runs on their account under their agreement with that provider. Two features can fall back to our own account when no key is configured: the assistant and the monthly performance summary. The exact list of what each feature sends is on our sub-processors page.

• Inside your workspace: whoever your workspace gives access to, under the roles it sets.
• Our sub-processors: the infrastructure, email, AI and payment services listed on our sub-processors page, which also says what each one receives.
• Services you connect: your own payment gateway, email sender, telephony or messaging accounts. Those run under your agreement with them.
• When the law requires it: a valid order from a court or authority, or where we must to protect someone's safety.
• If the business changes hands: a buyer would receive the data, bound by this policy until they publish their own.

Loading the app also discloses your IP address to Google (fonts), and a small number of pages to OpenStreetMap or an IP-location service. These are listed on the sub-processors page too.

Our public marketing pages (the home page, /agencies, pricing, features and sign-up) use the Meta Pixel and Meta's Conversions API to measure our own advertising: Meta receives the page you viewed, your IP address and browser, and, when you sign up, a hashed (not readable) copy of your email. It never runs inside the app, on your workspace's data.

• Everything travels over TLS. Passwords are stored as bcrypt hashes; password-reset and verification links are stored only as digests.
• Every request is scoped to what your role may see, and salary, bank and ID fields are withheld from anyone outside owner, manager, HR and payroll.
• Changes to records are written to an audit trail with who made them and what changed.
• API keys are stored hashed and shown once.

Being straight about the rest: some provider credentials that a workspace connects — email, payments, AI — are stored in our database without encryption at rest today, though they are never returned by the API. Encrypting them is work in progress. Two-factor authentication is not available yet. We hold no SOC 2, ISO 27001 or GDPR certification and do not claim one.

If a breach affects your data, we will tell you and the Data Protection Board as the law requires, with what happened and what to do.

Your workspace data is stored in India, in the Mumbai region (AWS ap-south-1). The application itself is served from a global edge network, so requests are handled close to you, but the database of record stays in India.

Some sub-processors operate outside India — our AI provider in the United States, our email provider in the European Union. That is a cross-border transfer, and the sub-processors page says which ones and for what.

While a workspace is active, its records are kept — that is the point of a system of record. Attendance, timesheets, invoices, payroll and the audit trail are kept for as long as the workspace exists, and afterwards for as long as tax and company law require, which in India is generally up to eight years for financial records.

• Deleted documents sit in the Bin for 30 days and are then removed, file and all.
• Candidates marked as spam are deleted after 7 days.
• Everything else stays until the workspace or the person asks for it to go.

We would rather say this plainly than imply an automatic clean-up that does not exist: outside the cases above, nothing is deleted on a timer. If you want something gone, ask.

Under the Digital Personal Data Protection Act, 2023 you may:

• Ask what personal data of yours we hold and who it has been shared with.
• Have it corrected, completed or updated.
• Have it erased, unless we are required to keep it.
• Withdraw a consent you gave — location tracking, for example — as easily as you gave it.
• Nominate someone to exercise these rights if you die or become incapable of exercising them.
• Complain to us, and then to the Data Protection Board of India if we do not resolve it.

Today these requests are handled by a person rather than a button: write to [email protected] and we will answer within 30 days. Self-service export and deletion are being built; until they ship we will not pretend otherwise.

If your details were put into GigRoot by an employer or a client, see section 1.2 — we will pass your request to them and help them act on it.

10.1 Grievance Officer

Grievance Officer, Apie Technologies Private Limited — [email protected]. We acknowledge within 48 hours and aim to resolve within 30 days.

GigRoot is for people aged 18 and over, and accounts are not intended for anyone younger. We do not currently verify age at sign-up, so we are telling you what that means rather than claiming a check we do not run.

It matters most for job applications: a workspace's careers page can collect a date of birth, a CV and — where proctoring is switched on — webcam images from whoever applies. If you are under 18, do not apply through GigRoot without a parent or guardian, and if you believe a child's data has been collected, write to [email protected] and we will remove it.

If we change this policy in a way that matters, we will say so in the product before it takes effect. The date at the top always reflects the current version.

Apie Technologies Private Limited · [email protected] · [email protected]