Privacy Policy

1. Who we are

Zziffy is the brand name of an HR, attendance and payroll service operated by Zonafi Ventures (OPC) Private Limited ("we", "us", "Company"), a One Person Company registered in India with its registered office in Navi Mumbai, Maharashtra.

For privacy questions, data correction requests or grievances under the Digital Personal Data Protection Act, 2023 ("DPDPA"), contact:
Grievance Officer: Ms. Nafisa Mukadam, Director
Email: [email protected]
Address: Zonafi Ventures (OPC) Private Limited, F-1 Type, Shop No. 20, Sector 3/4, Vashi, Navi Mumbai, Maharashtra 400703, India.

2. The personal data we collect

We collect personal data from two kinds of users: business owners who sign up for Zziffy, and the employees those owners enrol on Zziffy.

From business owners

• Business name, your name, mobile number, email
• Password (we store only a one-way hash — we never see your password)
• Business address, GSTIN (if you choose to enter it)
• Subscription and payment records (handled through Razorpay; we don't store card numbers)
• Logo, brand assets and outlet photos you upload
• Messages you send to our AI assistant inside the dashboard

From employees enrolled by an owner

• Full name, mobile number, role / designation / department
• Date of joining, date of birth (optional)
• Profile photo (optional)
• Attendance selfies taken at clock-in / clock-out
• Geo-location at clock-in / clock-out (only at those moments, not continuous tracking)
• Clock-in / clock-out times, leave requests, attendance status
• Bank details, PAN, Aadhaar number — only if entered by the owner or the employee
• Salary, payroll and payslip records

Website analytics and cookies

On zziffy.com we use Google Analytics 4 and Microsoft Clarity to understand how visitors use the site (pages viewed, clicks, scrolling and anonymised session recordings). These tools set cookies and run only after you click Accept on our banner; if you decline, no analytics cookies are set and Clarity does not load. You can change your choice by clearing this site's data in your browser. We do not use advertising cookies. Clarity masks sensitive text and the dashboard app is not covered by these tools.

3. Why we collect it

We collect this data to provide the Zziffy service: attendance tracking, leave management, payroll, payslip generation and the related notifications. The legal basis under DPDPA is your consent (for owners) and consent given to the owner by the employee at the point of enrolment.

We will not use your data for any purpose beyond delivering the service and the related communications. We do not sell personal data. We do not share personal data with advertisers.

4. Who can see your data

• You. Owners see all data for their business; employees see their own profile, attendance, leave and payslip data via the crew app.
• Other employees in the same business. Employees can see basic identity info (name, role, photo) of their teammates, plus the team's daily attendance status. They cannot see each other's salary or bank details.
• Zziffy staff. A small number of authorised Zziffy staff may access your data when needed to provide support or operate the service.
• Service providers. Supabase (hosting), Railway (API), Netlify (web), Razorpay (payments), Anthropic (AI assistant), Google Fonts. Each is contractually required to process data only on our instructions.

5. International transfers

Some of our service providers (Supabase, Anthropic) are based outside India. By using Zziffy you consent to your personal data being transferred to and processed in those countries, with the safeguards described in the service providers' own privacy policies.

6. How long we keep it

• Active accounts: as long as your subscription is active.
• Cancelled / suspended accounts: kept for 90 days, then permanently deleted.
• Attendance selfies and event logs: 12 months from the date of the event.
• Invoices, payment records and tax-relevant data: 8 years (Indian statutory requirement).
• Backups: up to 30 days beyond the retention windows above.

7. Your rights

Under DPDPA you have the right to access, correct, erase your personal data, withdraw consent (which results in account closure), nominate another person to exercise these rights on your behalf, and raise a grievance. To exercise any of these rights, email [email protected]. We respond within 7 working days.

8. Children

Zziffy is not intended for use by anyone under 18.

9. Security

We use industry-standard security: encryption in transit (HTTPS), encryption at rest for sensitive fields, hashed passwords, access controls and audit logs. We will notify affected users and the Data Protection Board of any personal-data breach as required by DPDPA.

10. Changes to this policy

Material changes will be communicated by email and you will be asked to re-consent before continuing to use the service.