Privacy policy
Last updated
Version 2026-11-03. Agency Cloud is operated by NILEDE TECHNOLOGIES PRIVATE LIMITED ("we", "us"). This policy explains what personal data we handle when you visit our website or use Agency Cloud, why we handle it, how long we keep it, and the choices you have. It is written to meet India's Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 and the rules made under them. Section 12 explains how it applies if you are in the European Economic Area, the United Kingdom, California, Brazil or another country with its own privacy law.
1. Two kinds of data
Account data. Details about you as a user of Agency Cloud, such as your name, email address and sign-in details. We decide how this data is used, so for it we are the data fiduciary (the "controller").
Company data. Everything a company puts into its workspace: customers, invoices, estimates, bills, leads, proposals, projects, employee records, attendance, leave and payroll. The company that owns the workspace decides how this data is used, and we process it only to provide the service to that company, under the Data Processing Agreement. If you are an employee or a customer of one of our customers, please contact that company first about your data. We will help it answer you.
2. What we collect
Account details: name, email address, a hashed password (we never store it in readable form), two-factor authentication and passkey settings, the companies you belong to and your role in each.
Your agreement: when you created your account we recorded that you confirmed you are 18 or older and accepted the Terms and this Privacy Policy, the time, and the version you saw.
Company details: company name, address, tax number, currency, financial year and logo.
Business records that your company enters, as described above.
Employee details entered by an employee or by HR, including personal, emergency contact and bank details, ID documents, leave and work-from-home requests and the reasons given for them. Bank account numbers, routing codes, national ID and tax ID numbers are stored encrypted and are shown only in masked form.
Location at check-in: only when a company restricts check-in to an office, your device's location is used at the moment you check in to confirm you are within the office radius. We keep that position, and the position at check-out, for 90 days, then delete it. The times, the source of the check-in and your distance from the office stay as part of the attendance record. If your company does not restrict check-in, no position is stored.
Proposal signatures: when someone signs a proposal, we record the name, the typed or drawn signature, the time, the IP address and the browser details, so the signature can be verified later. The address a proposal was opened from is deleted after 90 days.
Billing details: your plan and payment history. Card payments are handled by Razorpay, whose checkout window opens on our billing page when you pay; we never see or store full card numbers.
Devices: if you sign in on the mobile app, a device token and the device name you gave it, so notifications can reach your phone. If you turn on browser notifications in Settings, an address and keys your browser gave us for that purpose, and a short name for it such as "Chrome on Windows", so notifications can reach that browser. Where you are signed in (the browser name, IP address and time of last activity of each active session) is listed in Settings, Sessions, so you can disconnect any of them; it is removed when the session ends.
Technical and security data: IP address, browser and device information, and log records needed to keep the service secure and working. We also keep an audit trail of sensitive actions: who opened or downloaded an ID document, who changed a role, who exported data, failed sign-in attempts and changes made by our administrators.
3. Why we use it
To create and run your account and your company's workspace.
To send emails you or your company ask for, such as invoices, payment reminders, proposals, leave decisions and payslips.
To take payment for paid plans and manage subscriptions.
To keep the service secure, prevent misuse and fix problems.
To answer your questions and support requests.
To meet legal, tax and accounting obligations.
We use account data on the basis of your consent when you create your account, and for the legitimate uses the law allows, such as providing the service you asked for and meeting legal obligations. We do not sell personal data, we do not use it for advertising, and we do not use company data for anything except providing the service to that company.
4. Cookies
We use only the cookies that are needed for the service to work: keeping you signed in, protecting forms and remembering your theme. We do not use advertising or analytics cookies, so there is no cookie banner to accept.
5. Who we share data with
We share data only with service providers that help us run Agency Cloud, and only as much as they need. The full list, with what each one does and where it processes data, is on our sub-processors page. In short:
Amazon Web Services stores uploaded files and delivers our email, in India (Mumbai).
Cloudflare draws PDF documents such as invoices, estimates, payslips, reports and signed proposals. It receives the content of the document being made.
Razorpay takes subscription payments.
Google (Firebase Cloud Messaging) delivers push notifications to the mobile app, if you use it. Notification text contains dates and names of requests, never the reason given for leave or work from home.
The push service of your browser (Google for Chrome, Edge and Opera, Mozilla for Firefox, Apple for Safari) carries browser notifications, only if you turn them on. The message is encrypted so that only your browser can read it; the service sees that a message was sent, not what it says.
OpenStreetMap provides the map tiles on the office location screen. Your browser requests them directly, so OpenStreetMap sees your IP address and the map area you view.
Our support staff can open a customer's workspace only by signing in as a user from our admin panel. Every such session is recorded (who, as whom, when and from where), lasts at most one hour, shows a banner to the person using it, is announced to that person by email and in the app, and cannot change passwords, two-factor settings or billing. Our platform administrators must use two-factor authentication.
We may also disclose data when the law requires it.
6. Transfers outside India
Uploaded files and outgoing email are processed in Mumbai. Some providers process data in other countries when you use a feature that involves them: PDF drawing (Cloudflare), card payments (Razorpay) and mobile push notifications (Google) and browser notifications (the push service of your browser). India's law allows these transfers except to countries the government restricts. Where the law of your country requires safeguards for such transfers, see section 12.
7. How we protect it
Every record belongs to one company, and every request is limited to that company, so one company cannot see another's data.
Access inside a company is controlled by roles and permissions.
Sensitive employee numbers are encrypted in our database, uploaded files are encrypted at rest, and private files can only be downloaded by people allowed to see them, with each access recorded.
Two-factor authentication and passkeys are available for every account.
Connections are encrypted in transit.
Documents uploaded to a workspace can be scanned for viruses before they are stored.
No system is perfectly secure. If a breach affects your personal data, we will tell the Data Protection Board of India and the people affected as the law requires, and we will tell company owners promptly when a breach affects their workspace.
8. How long we keep it
Your account: until you delete it in Settings. Deleting it signs you out everywhere, cancels any paid subscription and removes your sign-in tokens and devices at once. Companies you own that have no other members are closed.
A closed workspace: its owner can ask us to restore it for 30 days. After 30 days all of its data and files are permanently erased.
An employee removed from a company's directory: 30 days later their name, contact details, birth date, address, emergency contact, bank and ID details and ID documents are wiped, and the free text of their leave and work-from-home requests is cleared. Attendance counts, leave balances and finalised payslips stay as the company's payroll record until the workspace is erased.
Customers, vendors and leads a company deletes: 30 days later their contact details, notes, documents and timeline are wiped, and a record with no accounting history is wiped completely. The name, address and tax number on invoices, bills and other accounting records stay as the company's accounting record until the workspace is erased.
Company data exports an owner asks for: the download link and the file expire after 3 days.
Attendance positions: 90 days. Proposal view addresses: 90 days.
Notifications in the app: 180 days. Copies of Razorpay events: their detail is removed after 90 days.
Phones and browsers you have not used for 180 days are removed from your device list.
Audit trail and support sign-in records: 2 years.
Server logs: 14 days.
Copies in our backups are removed as the backups expire, and are not restored into the service once data has been deleted. We keep records longer only where the law requires it. Moving to a smaller plan never deletes data.
9. Your rights
You can ask us to give you a summary of the personal data we hold about you, correct or complete it, delete it, or withdraw consent. You can also nominate another person to exercise these rights for you if you die or cannot act. You can do most of this yourself:
Access and a copy: Settings, Profile, "Download my data" gives you a file with your account, devices and browsers, and your own employee record, attendance, leave and payslip totals.
A company's data: the owner can download everything the company holds in Settings, Company, "Export company data".
Correction: change your name and email in Settings, and your personal, emergency and bank details in My profile.
Erasure and withdrawing consent: Settings, Profile, "Delete account".
For anything else, or for company data, write to [email protected] (for company data, we will pass your request to the company that owns the workspace). We aim to answer within 30 days and always within the time the law sets.
10. Children
Agency Cloud is a business service and is not meant for anyone under 18. We ask you to confirm you are 18 or older when you create an account, and we do not knowingly collect data from children. If an employer records an employee under 18 in HR, the employer is responsible for meeting the extra rules the law sets for children's data.
11. Changes to this policy
We may update this policy as the service changes. The version at the top changes when we do, and we tell account owners about important changes by email or in the app.
12. If you are in the EEA, the UK, California, Brazil or elsewhere
European Economic Area and United Kingdom: for account data we are the controller; for company data we are a processor for the company. Our bases are performing our contract with you, our legitimate interests in running and securing the service, legal obligations, and your consent where we ask for it. Besides the rights in section 9 you may object to or restrict processing, ask for your data in a portable format and complain to your data protection authority. Where data goes to a country without an adequacy decision we rely on the European Commission's standard contractual clauses (and the UK addendum).
California: in the past year we collected identifiers (name, email, IP address), commercial information (plan and payment history), professional or employment information that employers enter, and, only where an employer requires it, geolocation at check-in. We do not sell or share personal information for cross-context advertising. You may ask to know, delete or correct your personal information and we will not treat you differently for doing so.
Brazil, Singapore, Australia, Canada, South Africa, the UAE and elsewhere: you have the access, correction and deletion rights described above, and you may complain to your local authority. Write to us and we will tell you how the local law applies.
13. Contact and grievances
For questions, requests or complaints about your personal data, write to [email protected]. Our Grievance Officer is Swapnil Sargar, NILEDE TECHNOLOGIES PRIVATE LIMITED, 403/B, Annapurna Ashish, Opp. Manjunath College, Vishnunagar, Kalyan 421304, Maharashtra, India. If you are not satisfied with our response, you may complain to the Data Protection Board of India.