Privacy Policy

1. Introduction

This Privacy Policy explains how EKIKA CORPORATION PRIVATE LIMITED ("Karmika", "we", "us", or "our"), the operator of the Karmika HR monitoring platform (the "Service"), collects, uses, stores, and shares information when an organization ("Employer") and its authorized users ("Employees") sign up for and use the Service, including the web portal and the Karmika desktop agent. By creating an account, accepting an invitation, or installing the desktop agent, you agree to the collection and use of information as described here.

2. Who This Applies To

This Policy applies to Employer administrators and staff who sign up for and administer a Karmika workspace, and to Employees who are invited into a workspace by their Employer and who install and use the Karmika desktop agent on a work device. Employers are responsible for lawfully notifying their Employees about workplace monitoring before enrolling them; the Service requires each Employee to acknowledge an in-app monitoring consent notice before any monitoring data is collected from their device.

3. Information We Collect

3.1 Account & Company Information

When an Employer signs up, we collect company name, company size, country, the signer's name, work email, and mobile number but not limited to that we may collect and process more relevent information. When an Employer adds an Employee, we collect that Employee's name and work email to create their account and send an invitation.

3.2 Monitoring Data (collected via the desktop agent)

Once an Employee installs the desktop agent and acknowledges monitoring consent, and only according to the policy configured by their Employer, we may collect:

• Active application and window titles
• An activity level derived from keyboard and mouse input (not keystroke content)
• Worked-time sessions, idle time, and clock in/out or attendance records
• Periodic screenshots, at the frequency configured by the Employer
• Optional webcam snapshots, only if the Employer has enabled this feature
• Device information such as operating system, hostname, and installation date
• Above are important list but not limited to these items.

Monitoring automatically pauses outside the Employer's configured tracking hours and during any configured quiet hours. We do not capture keystroke content, microphone audio, personal files, or browsing on personal, non-work devices.

3.3 Billing & Usage Data

For Employer accounts, we maintain plan and subscription details, a prepaid wallet balance, an immutable ledger of balance movements, and invoices/billing history associated with the workspace.

3.4 Technical Data

We automatically collect standard technical data such as IP address, browser type, device identifiers, and access logs when you use the web portal, for security, fraud-prevention, and diagnostic purposes.

3.5 Cookies & Analytics

Our web application uses cookies and similar technologies, including Google Analytics and comparable analytics tools, to understand usage patterns, measure performance, and improve the Service. These tools may set cookies and collect information such as pages visited, time spent, and general device/browser information. You can control cookies through your browser settings; the desktop agent itself does not use browser cookies or third-party web analytics and much more.

4. How We Use Information

• To provide, operate, and maintain the Service, including the employer and employee portals and the desktop agent;
• To create and manage accounts, process sign-ups, and send transactional emails (invitations, password resets, low-balance and billing notices);
• To process payments, maintain the prepaid balance ledger, and issue invoices;
• To enforce configured monitoring policies and deliver monitoring data (activity, screenshots, attendance) to the Employer that configured them;
• To secure the Service, prevent abuse, and comply with legal obligations;
• To analyze usage and improve the Service's features, reliability, and performance, including through the analytics tools described above.

Free Plan. If a workspace is on our Free Plan (or any no-cost plan or trial we offer or trial balance period), you agree that we may additionally use account, usage, and aggregated/derived data from that workspace for our internal processing purposes — including product improvement, analytics, troubleshooting, and service operation — as part of the value exchange for access to the Free Plan.

5. Monitoring Consent

Before any monitoring data is collected from an Employee's device, the desktop agent displays the current monitoring policy (tracked hours, screenshot frequency, idle threshold, and whether webcam snapshots are enabled) and requires the Employee to acknowledge it. Employees can view their effective policy at any time from the desktop agent or the web portal. Employers are solely responsible for ensuring their use of monitoring complies with applicable labor, privacy, and data-protection laws in their jurisdiction, including any required notice or consultation with Employees or worker representatives.

6. How We Store & Secure Information

Passwords are never stored in plain text; they are stored using industry-standard, salted password hashing. Screenshots and other files are stored using cloud object storage that is compatible with the Amazon S3 protocol. By default this is our platform-managed storage; an Employer may alternatively configure their own storage bucket ("bring your own cloud"), in which case those files are stored in the bucket the Employer configured and controlled the Employer's own retention/access rules for that bucket. Access to monitoring data within the Service is restricted by role: Employees can generally only see their own data, and Employer staff can only see data belonging to their own workspace.

7. Third-Party Service Providers

We share limited information with the following categories of service providers, solely to operate the Service:

• Cloud & object storage providers — to host the application and store files such as screenshots;
• Email delivery providers — to send invitations, password resets, and billing/low-balance notifications;
• Payment processors — to securely process balance top-ups and payments; we do not store full card or bank account details on our own servers;
• Analytics providers (e.g. Google Analytics or equivalent) — to understand usage of our web application.

These providers are only permitted to use the information we share with them to perform services on our behalf, and are bound by confidentiality obligations. We do not sell personal information.

8. Data Sharing & Disclosure

Monitoring data collected from an Employee is visible to that Employee's Employer (and its authorized staff, per their configured roles) — this is the core purpose of the Service. We may also disclose information where required by law, to enforce our Terms & Conditions, or to protect the rights, property, or safety of Karmika, our customers, or others.

9. Data Retention

We retain account, billing, and monitoring data for as long as the workspace is active, plus a reasonable period afterward for legal, accounting, and dispute-resolution purposes. An Employer may configure retention limits for monitoring data within their plan's available settings. An employee may request deletion of their monitoring data as described below, subject to the Employer's legitimate business, legal, and billing-record requirements.

10. Your Rights & Choices

From the web portal, you can at any time:

• Export a copy of your personal and monitoring data (Using export feature);
• Submit a request for deletion of your data (send email at: support@ekika.co with subject 'Request to delete MY karmika.co track information');
• Review your current effective monitoring policy;
• Contact us using the details below with any other privacy request.

Depending on your location, you may have additional rights under applicable data-protection law (such as access, correction, restriction, or portability). We will respond to verified requests in accordance with applicable law.

11. Children's Privacy

The Service is intended for use by working adults in an employment context and is not directed at children. We do not knowingly collect information from individuals under the age of 18.

12. International Data Transfers

We and our service providers may process and store information in countries other than your own. Where required, we take reasonable steps to ensure such transfers are subject to appropriate safeguards.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Effective date" above. Continued use of the Service after a change becomes effective immediately.

14. Contact Us

If you have questions about this Privacy Policy or wish to exercise a privacy right, contact us at support@ekika.co.