Privacy Policy

Birch handles personal data in two roles:

• For your employer. When an organization uses Birch to manage its people, that organization decides what employee data goes in and why. It is the data fiduciary (India) or business/controller (US), and Birch processes the data on its behalf under our Data Processing Agreement. Questions about your employee record should go to your employer first.
• For ourselves. For account holders, website visitors and people who contact us, Birch decides how the data is used. This policy mainly covers that data, and explains how we handle employee data for our customers.

Birch means H3 Capital, which provides Birch in India, the US and elsewhere.

• Account data: name, work email, phone number (if given), role and organization.
• Employee data entered by your employer: for example job details, leave, timesheets, rosters, documents, and for Indian payroll, salary, bank and statutory identifiers such as PAN, PF and ESIC numbers.
• Usage and device data: sign-in times, IP address, browser, and an audit log of changes made in Birch.
• Billing data: billing contact, invoices and GSTIN. Card details are handled by Stripe and never stored by Birch.
• Messages: what you send us through the contact form or by email.

• To provide Birch: sign-in, HR workflows, notifications and support.
• To keep it secure: rate limiting, audit logs and investigating misuse.
• To bill customers and keep records the law requires.
• To tell account holders about changes to the service.
• We do not sell personal data and do not use employee data for advertising.

Only with the service providers listed on our subprocessors page, who process it for us under contract; with your employer, for employee data; and where the law requires it.

Our Railway app, API and PostgreSQL services are hosted in the US West region (us-west2). Uploaded documents use Google Cloud Storage; the document-storage region has not yet been confirmed. Contact team@birchspace.co before uploading documents with specific data-location requirements.

We keep customer data while the customer's account is active and for 30 days after it ends, so the customer can ask for an export, then delete it unless the law requires us to keep it longer (for example invoices and tax records).

If you are in India, you have the right to:

• get a summary of your personal data we process and who we have shared it with;
• have inaccurate or incomplete data corrected and updated;
• have data erased when it is no longer needed for the purpose it was given for, unless the law requires us to keep it;
• withdraw consent where we rely on consent, as easily as you gave it;
• nominate someone to exercise these rights if you die or become unable to;
• have a grievance about our handling of your data resolved.

For employee data, your employer is the data fiduciary, so send the request to them; we will help them answer it.

Grievance Officer: Harman Pannu, team@birchspace.co. We will acknowledge your grievance and respond within the time the DPDP Rules set. If you are not satisfied, you may complain to the Data Protection Board of India.

If a personal data breach affects you, we (or your employer, for employee data) will tell you and the Data Protection Board as the DPDP Act requires.

Residents of California and other states with comprehensive privacy laws (such as Colorado, Connecticut, Virginia, Texas and Oregon) may have the right to:

• know what personal information we collect, use and disclose;
• access, correct and delete it;
• get a portable copy;
• opt out of sale, sharing for cross-context advertising, and profiling. We do none of these;
• limit use of sensitive personal information. We use it only to provide the service;
• not be treated differently for using these rights.

You can use an authorized agent. We will verify requests before acting on them, and you can appeal a decision by replying to our answer. For employee data, we pass requests to your employer, who decides them.

Birch is a workplace product and is not meant for anyone under 18. We do not knowingly collect children's data, except where an employer enters it (for example dependants for benefits or nominations), in which case the employer is responsible for any required parental consent.

Our security page describes the measures we use today. No system is perfectly secure, and we tell customers about breaches as our DPA describes.

We will post changes here and email account holders about material ones. Questions: team@birchspace.co.