Legal

Privacy Policy

Last updated: 13 August 2026

This Privacy Policy explains how Leafwage ("we", "us", or "our") collects, uses, and protects information when organisations and their users use our multi-tenant leave and payroll platform.

1. Who this applies to

This policy covers visitors to our public site, people who submit access requests, and authorised users invited into an organisation workspace (admins, managers, and employees).

2. Information we collect

Access request details — company name, contact name, work email, phone (optional), company size, and message content.
Account and profile data — name, email, role, department, and related organisation membership details.
Leave and workplace data — leave types, balances, requests, approvals, holidays, optional organisation address, calendar-related activity, and today’s working or on-leave status needed to operate the service.
Salary and payroll data — when the payroll module is enabled: salary structure (such as Basic, HRA, and allowances), optional payroll identity fields (employee code, PAN, UAN, ESI number, bank account, and IFSC) entered by the organisation, payroll run entries and line items, loss-of-pay calculations, payslip snapshots, and organisation branding used on payslip PDFs. We store these fields to generate payslips; we do not use them to file returns with government portals.
Technical data — authentication session information and basic logs used for security, reliability, and troubleshooting.

3. How we use information

To review access requests and create organisation workspaces
To provide leave balances, requests, approvals, calendars, today’s availability within the organisation, and notifications
To calculate and deliver payroll runs and payslips when the module is enabled
To administer accounts, roles, and organisation settings
To maintain security, prevent abuse, and improve service reliability
To communicate about onboarding, support, and important service updates

4. Multi-tenant separation

Leafwage is organised by tenant. Organisation data is intended to remain isolated from other organisations. Access within a tenant is controlled by assigned roles and membership.

5. Sharing of information

We do not sell personal information. We may share information only:

With service providers that help us host, authenticate, email, or operate the platform
With members of your organisation according to their role-based access
When required by law, regulation, or valid legal process
In connection with a business transfer, where permitted and with appropriate safeguards

6. Data retention

We retain information for as long as needed to provide the service, meet legal obligations, resolve disputes, and enforce agreements. Access request records may be kept to manage onboarding and prevent duplicate or abusive submissions.

7. Security

We use reasonable technical and organisational measures to protect information, including authenticated access and role-based controls. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Your choices and rights

Depending on your location and role, you may be able to access, update, or request deletion of certain personal information. Employees should typically contact their organisation admin first. Organisation admins and access-request contacts may reach us through the Request access form or their onboarding contact.

9. Children

The service is intended for workplace use by organisations and is not directed to children.

10. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page will change when we do. Continued use of the service after an update means the revised policy applies.

11. Contact

For privacy questions, use the Request access form on our website or contact the person who onboarded your organisation.

This page is provided for product transparency and is not a substitute for legal advice. Have counsel review it before relying on it in production.