Privacy Policy

Vysync Technologies Pvt. Ltd. ("Vysync", "we", "us", or "our") is a remote-first Indian software engineering and digital technology company based in Madurai, Tamil Nadu, India. We are committed to safeguarding personal information entrusted to us by visitors, business clients, and platform users.

This Privacy Policy describes our data governance practices across the public website (vysync.com), our client-facing software applications (including Vysync HRMS at hrms.vysync.com and Vysync CRM at crm.vysync.com), customer portals, application programming interfaces (APIs), Remote Model Context Protocol (MCP) server endpoints, and custom engineering engagements.

In fulfilling our operational and contractual activities, Vysync operates in two distinct legal capacities:

• Vysync as a Data Controller: We act as a Data Controller for personal data directly collected from visitors to vysync.com, prospective client contact submissions, commercial contract administration, and sales communications.
• Vysync as a Data Processor: When enterprise clients deploy or subscribe to Vysync HRMS or Vysync CRM to manage their own workforce, candidates, or customers, the Client acts as the Data Controller, and Vysync processes that data on the Client's instructions.

We process personal data strictly in proportion to the operational requirements of our engineering services, cloud software platforms, and commercial communications:

• Direct Inquiries & Project Consultation: Full name, business email address (e.g. sales@vysync.com communications), contact phone number, company name, service requirements, and project specifications submitted via our contact and consultation forms.
• Enterprise HRMS & Employee Portal Data: When clients utilize Vysync HRMS, tenant accounts process employee master records (names, corporate email addresses, designations, departments, employee IDs), attendance logs, leave balances, reimbursement receipts, and compensation structure configurations.
• Recruitment & Candidate Resumes: In candidate screening modules, job applicant resumes (in PDF or DOCX format), candidate contact information, job role descriptions, evaluation notes, and interview feedback are processed at the direction of the employing client.
• Developer & API Telemetry: For authorized developer clients, API keys, OAuth 2.0 client credentials, session tokens, and request parameters accessing scoped REST endpoints or Remote MCP Server tools are logged to enforce access controls and monitor rate limits.
• Technical & System Telemetry: Server access logs capturing IP addresses, browser user-agent strings, referring URLs, operating system metadata, and request timestamps to maintain system availability, prevent distributed denial-of-service (DDoS) events, and resolve software exceptions.

Certain features within Vysync HRMS provide artificial intelligence-assisted resume screening and candidate evaluation to accelerate recruitment workflows. We uphold strict transparency regarding this pipeline:

• Text Extraction & Parsing: Uploaded resume documents (PDF, DOCX) are parsed locally within our backend application layer using document text extractors (such as pdfplumber and python-docx) to extract unstructured text content.
• External AI Inference API: Extracted resume text (truncated to operational limits) and job descriptions are transmitted over encrypted HTTPS channels to external AI language model completion APIs (such as Claude or Gemini inference endpoints) to identify skill matches, evaluate experience relevance, and generate structured fit scores (0–100).
• Decision-Support Safeguard: AI-generated screening scores, skill summaries, and qualification assessments serve strictly as advisory decision-support insights for human recruiters and hiring managers. Vysync software platforms do not make sole, automated legal or hiring decisions without human review.
• Foundation Model Training Protection: Candidate resumes and enterprise telemetry processed through our screening APIs are used solely to generate the requested evaluation output and are not utilized by Vysync to train or improve publicly available foundation models.

We process collected information under valid lawful grounds recognized by applicable data protection frameworks, including the Digital Personal Data Protection Act, 2023 (India) and the General Data Protection Regulation (Regulation (EU) 2016/679):

• Contractual Performance: Delivering agreed software engineering milestones, provisioning cloud SaaS workspaces, facilitating employee self-service workflows, and providing technical support.
• Legitimate Business Interests: Safeguarding our network perimeter, monitoring application health, detecting unauthorized access attempts, and preventing fraudulent or malicious activities.
• Consent: Communicating with prospective clients who submit voluntary inquiries via our contact forms, with the ability to withdraw consent at any time.
• Statutory Obligations: Complying with applicable Indian commercial, tax, and accounting reporting requirements.

We do not sell, rent, or trade your personal information. Workloads and data processing depend on vetted enterprise cloud infrastructure providers:

• Cloud Hosting & Storage: Amazon Web Services (AWS) S3 is used for secure, access-controlled object storage of candidate resumes and employee documents, protected via time-limited presigned URLs.
• Managed Database Services: Structured platform records, tenant accounts, and configuration schemas are persisted in managed cloud MySQL database clusters.
• Transactional Communications: Outbound SMTP email gateways handle automated system notifications, employee onboarding invites, and one-time password (OTP) verification messages.
• AI Inference Providers: Enterprise language model API gateways process stateless resume evaluation prompts under contractual confidentiality commitments.

Vysync implements multi-layered administrative, technical, and physical safeguards engineered to protect personal records against unauthorized access, loss, or alteration:

• Encryption in Transit: All public web endpoints, application dashboards, and API services enforce HTTPS with TLS 1.3 cryptographic suites.
• Encryption at Rest: Persistent database storage volumes and AWS S3 object storage buckets utilize managed AES-256 cloud encryption.
• Credential Protection: All user passwords are encrypted using one-way bcrypt cryptographic hashing. Application sessions are authenticated using signed JSON Web Tokens (JWT) with defined expiration lifecycles.
• Role-Based Access Control (RBAC): Platform data access is segregated across strict permission boundaries (Super Admin, Company Admin, HR, Recruiter, Manager, Employee), preventing unauthorized cross-tenant or cross-department data exposure.
• Remote MCP Tool Sandboxing: External AI connections via the Remote MCP Server require authenticated OAuth tokens and explicit permission scopes (e.g. employees.read) before returning workforce data.

We retain personal data only for as long as necessary to fulfill the purposes for which it was gathered, or as required by applicable statutory regulations:

• Website Inquiries: Contact form records are retained for the duration of the prospective business relationship or until a deletion request is received.
• Enterprise SaaS Workspaces: Client workforce and applicant data are retained during the active subscription agreement. Upon contract termination, tenant records are exported or securely deleted in accordance with the governing agreement.
• Server Telemetry: Access and error logs are retained on standard rotating intervals for diagnostic and security audit purposes before automatic overwriting.

Subject to applicable jurisdictional legislation (including the Indian DPDP Act 2023 and GDPR for European residents), you possess established rights regarding your personal information:

• Right to Access: Request confirmation of whether your personal data is being processed and obtain a summary of records held.
• Right to Correction & Rectification: Request correction of inaccurate, incomplete, or out-of-date personal details.
• Right to Erasure: Request deletion of your personal records, subject to legal, regulatory, or contractual retention necessities.
• Right to Withdraw Consent: Withdraw consent previously granted for optional communications or data processing activities.
• Grievance Redressal: Lodge queries, concerns, or grievances directly with our designated data protection contact.

For privacy inquiries, rights requests, or questions regarding our data handling practices, please contact our team: