Privacy Policy

Version 1 — October 2026 · Last updated: 13 October 2026

In short: worker data in ContractPay belongs to the contractor who uses it. We keep it on servers in India (Mumbai), take a backup every day, let only the contractor's own logins see it, never sell it, and give it back on request. Questions: dinesh@dinmind.in.

1. Who we are

ContractPay (contractpay.dinmind.com) is payroll software run by Dinmind Infotech Private Limited (OPC), Chennai, Tamil Nadu, India ("Dinmind", "we", "us"). This policy explains what personal data we handle, why, where it is kept, and your rights under India's Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025.

2. Two kinds of data, two roles

If you are a worker and have a question about your data, please first contact the contractor (your employer). They decide what is kept and can correct it. If you cannot reach them, write to us and we will pass your request to them and help.

3. Data about customers and website visitors (part A)

What we collect

• Details you give at sign-up or in the contact form: name, business name, email, mobile, city, number of workers.
• Login details: user name and password (we store only a scrambled "hash" of the password, never the password itself).
• Billing details: business name, GSTIN, billing contact.
• Technical details: IP address, browser type, time of login, and actions taken in the app (kept as security logs).
• On our public website only: simple visit statistics through Google Analytics (pages seen, rough location, device type). No worker data is ever sent to Google Analytics.

Why we use it

• To create and run your account, and log you in safely (including one-time codes by email).
• To reply to your enquiries, give a demo, and support you (including by WhatsApp, if you choose it).
• To send invoices and service messages (for example, trial ending, planned maintenance, security alerts).
• To keep the service secure and find misuse.
• To meet legal duties, such as GST and tax records.

We use this data with your consent (given when you sign up or contact us) and for legitimate uses allowed by law. You can withdraw consent for marketing messages at any time by replying "STOP" or writing to us. Withdrawing consent for service data means we cannot keep your account open.

4. Worker data inside ContractPay (part B)

• We use worker data only to provide ContractPay to the contractor: to calculate salary, PF and ESI, and make payslips, bank files, statutory files, registers and client bills.
• We do not sell it, use it for advertising, build profiles, or contact workers.
• The contractor is responsible for having a lawful reason to hold this data (for example, employment and wage laws), and for telling workers about it. We give contractors a simple sample notice for workers.
• Dinmind staff do not look at worker data, except when the contractor asks for help, or to fix a fault or a security problem. Such access is recorded in a log.

Aadhaar numbers

• Contractors may record a worker's Aadhaar number because statutory forms and registers ask for it. Contractors should enter it only when needed.
• We do not do Aadhaar authentication or e-KYC, and we never collect biometrics.
• We are working to show only the last 4 digits of Aadhaar on screens and printed documents by default, and to store the full number in encrypted form.
• Aadhaar numbers are never shared with anyone except the contractor's own logins.

5. Where data is kept

• The ContractPay application runs on Google Cloud, Mumbai region (asia-south1), India.
• The database and daily backups are kept with Supabase in its Mumbai (India) region.
• Data is sent over secure, encrypted connections (HTTPS). Data stored by our providers is encrypted on disk.
• Some service messages (such as login codes and notices) are sent through an email delivery provider whose servers may be outside India. We do not put worker data in these emails.

6. Who we share data with

We share data only with service providers who help us run ContractPay, and only as much as they need. They must keep it safe.

We will update this list when it changes. We may also share data when an Indian law, court or government authority lawfully requires it. We will tell the contractor first when the law allows.

Please do not send photos of Aadhaar cards, bank passbooks or full salary sheets on WhatsApp. Upload them inside ContractPay instead.

7. How long we keep data

• Worker data: kept while the contractor's subscription is active, because the contractor needs wage records. The contractor can delete workers or data at any time (subject to labour-law record-keeping duties, which are the contractor's).
• When a contractor leaves: the account stays read-only for 60 days for download. Then we delete the data from the live system. Backup copies expire within about 30 more days.
• Trial accounts not continued: deleted about 30 days after the trial ends, after a reminder.
• Contact-form enquiries: up to 2 years after the last contact, unless you become a customer or ask us to delete earlier.
• Invoices and billing records: as long as tax law requires (GST law requires about 6 years).
• Security logs: as long as the law requires (currently we aim for at least 180 days, and one year where the DPDP Rules require).

8. How we protect data

• Data of each customer is kept separate. One customer's logins cannot see another customer's data.
• Passwords are stored only as secure hashes. A login is locked for 15 minutes after 5 wrong passwords.
• Dinmind's own administrator login needs an extra one-time code sent by email.
• Secure HTTPS connections; encryption on disk at our cloud providers; daily backups.
• Access by Dinmind staff to a customer's screens is recorded.
• No security system is perfect. If something goes wrong, we follow the steps in section 10.

9. Your rights

Under the DPDP Act you have the right to:

• ask what personal data we hold about you and how we use it;
• ask us to correct, complete or update it;
• ask us to erase it, when it is no longer needed and no law requires us to keep it;
• withdraw consent you have given (this will not affect what was done before);
• name another person to use these rights for you if you die or cannot act;
• complain to our Grievance Officer, and then, if not satisfied, to the Data Protection Board of India.

Workers: please send these requests to your employer (the contractor) first. We will help the contractor answer.

We will reply to every request as soon as we can, and in any case within the time the DPDP Rules allow (not more than 90 days). We may ask you to prove who you are.

10. If there is a data breach

• We will act at once to stop it and limit the harm.
• We will tell affected customers without delay, and within 24 hours of our becoming aware, with what happened and what we are doing.
• We will report to CERT-In and help customers report to the Data Protection Board and inform affected people, as the law requires.

11. Children

ContractPay is for businesses. The person who signs up must be 18 or older. If a contractor records a worker who is under 18, the contractor must follow the extra rules of the DPDP Act and labour laws for that worker.

12. Cookies

The ContractPay app uses your browser's storage to keep you logged in and remember your language. Our public website uses Google Analytics cookies to count visits. You can block cookies in your browser; the app will still work, but you may need to log in again more often.

13. Changes to this policy

We may update this policy. We will change the "Last updated" date above and, for important changes, tell customers by email or in the app.

14. Grievance Officer and contact

We will acknowledge your message within 2 working days.