Privacy Policy

Last updated: May 11, 2026 (v1)

Last Updated: May 11, 2026

1. Introduction

Ek Ra Sunya Inc ("Company", "we", "us", or "our") operates EK ERP, a multi-tenant SaaS HR, Payroll, and Accounting platform. This Privacy Policy explains how we collect, use, disclose, and protect your information when you use our Service.

By using the Service, you consent to the data practices described in this policy. If you do not agree with this policy, please do not use the Service.

2. Information We Collect

2.1 Personal Information

We collect personal information that you provide directly to us, including:

  • Name and contact details (email address, phone number)
  • Account credentials (email and hashed password)
  • Profile information (job title, department)

2.2 Employment and HR Data

For organizations using EK ERP, we process employment-related data, including:

  • Employee personal information (name, date of birth, address, identification numbers)
  • Employment details (job title, department, designation, start and end dates)
  • Contract terms and salary information
  • Attendance, leave, and holiday records
  • PAN numbers and tax identification information

2.3 Financial and Payroll Data

We process financial and payroll data as part of the Service, including:

  • Salary and compensation details
  • Bank account information (account numbers, bank names)
  • Payslips, payroll runs, and payment records
  • Tax deduction at source (TDS) records
  • Insurance premium and benefit information

2.4 Technical and Usage Data

We automatically collect certain technical information when you use the Service:

  • IP address and device information
  • Browser type and version
  • Log data including access times and pages viewed
  • Authentication tokens and session information

3. How We Use Your Information

We use the information we collect to:

  • Provide the Service: Process payroll, manage HR records, generate reports, and perform all core platform functions
  • Account management: Create and manage user accounts, authenticate users, and provide customer support
  • Communication: Send transactional emails (password resets, account verification, payslip notifications), service updates, and support responses
  • Security: Detect and prevent fraud, unauthorized access, and other harmful activities
  • Analytics and improvement: Understand how the Service is used to improve functionality and user experience (using aggregated and anonymized data where possible)
  • Legal compliance: Meet our legal obligations and enforce our Terms of Service

4. Multi-Tenant Data Isolation

EK ERP operates on a schema-per-tenant architecture. This means:

  • Each organization's data is stored in a dedicated, logically isolated database schema
  • No organization can access the data of another organization through the Service
  • Our engineering practices enforce strict access controls at the database level to prevent cross-tenant data access
  • Administrative access to tenant data by our staff is strictly limited, logged, and only performed for service provision, maintenance, or support purposes with appropriate authorization

We are committed to maintaining this isolation as a core security guarantee of the platform.

5. Data Retention and Deletion

We retain your data for as long as your account is active or as needed to provide the Service. Specifically:

  • Active account data is retained for the duration of your subscription
  • Upon account termination, we retain your data for a period of 90 days to allow for data export and dispute resolution
  • After the retention period, data is securely deleted from our systems
  • Certain data may be retained longer if required by applicable law (such as financial records required for tax compliance)

You may request deletion of your data at any time by contacting us at [email protected].

6. Cookies and Tracking Technologies

We use cookies strictly for functional purposes required to operate the Service:

  • Authentication cookies: Secure, httpOnly cookies to maintain your authenticated session. These cannot be accessed by JavaScript on the page, providing protection against cross-site scripting (XSS) attacks.
  • Session cookies: Temporary cookies that expire when you close your browser, used to maintain your session state

We do not use:

  • Third-party advertising or tracking cookies
  • Analytics cookies that track you across other websites
  • Persistent fingerprinting or other covert tracking technologies

7. Third-Party Services

We use a limited number of third-party services to operate the platform:

  • Google OAuth: For optional sign-in with Google accounts. When you use Google Sign-In, Google's privacy policy governs the data shared between you and Google. We receive only the information necessary to create or authenticate your account (name, email, profile picture).
  • Microsoft OAuth: For optional sign-in with Microsoft accounts. Microsoft's privacy policy governs data shared between you and Microsoft. We receive only the minimum necessary account information.
  • SMTP Email Providers: We use email delivery services to send transactional emails. Your email address is shared with our email provider solely for the purpose of delivering Service-related messages.

We do not sell your personal information to any third party. We do not share your data with third parties for advertising or marketing purposes.

8. Your Rights

We respect your rights over your personal data. Depending on your location and applicable law, you may have the following rights:

  • Right of Access: Request a copy of the personal data we hold about you
  • Right to Correction: Request that we correct inaccurate or incomplete personal data
  • Right to Deletion: Request deletion of your personal data, subject to our legal obligations
  • Right to Data Portability: Request your data in a structured, machine-readable format
  • Right to Object: Object to certain types of processing, including direct marketing
  • Right to Restriction: Request that we restrict processing of your data in certain circumstances

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within 30 days. We may require you to verify your identity before fulfilling your request.

These rights are provided in alignment with GDPR principles and applicable Nepali data protection laws.

9. International Data Transfers

EK ERP is operated from Nepal. If you are accessing the Service from outside Nepal, please be aware that your information may be transferred to, stored, and processed in Nepal or in countries where our service providers operate.

We ensure that any international data transfers are protected by appropriate safeguards, such as data processing agreements with our service providers and compliance with applicable data protection regulations.

10. Children's Privacy

The Service is not intended for use by individuals under the age of 16. We do not knowingly collect personal information from children under 16. If you believe that a child under 16 has provided us with personal information, please contact us immediately at [email protected], and we will take steps to delete such information.

11. Security Measures

We implement industry-standard technical and organizational security measures to protect your data, including:

  • Encryption of data in transit using TLS/HTTPS
  • Secure, httpOnly, and SameSite cookies for authentication
  • Password hashing using bcrypt with appropriate work factors
  • Schema-level database isolation between tenants
  • Access controls and least-privilege principles for our engineering team
  • Regular security reviews and vulnerability assessments

While we take security seriously, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security of your data.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

  • Post the updated Privacy Policy with a new "Last Updated" date
  • Send an email notification to the address associated with your account
  • Display a prominent notice within the Service

Your continued use of the Service after the effective date of any changes constitutes your acceptance of the revised Privacy Policy.

13. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, please contact us:

We are committed to working with you to resolve any concerns about your privacy.