At egrey, your privacy is a core principle — not an afterthought. This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you visit egrey.in or use any product or service built and operated by egrey.
By accessing our website or any egrey product, you agree to the terms of this Privacy Policy. If you do not agree, please discontinue use.
egrey is an Indian technology company headquartered in Chennai, Tamil Nadu, India. We are in the business of building intelligent, well-crafted Software-as-a-Service (SaaS) products for modern businesses — starting in India and building for the world.
Our mission is to create simple, powerful, and trustworthy software tools that solve real problems for businesses of all sizes. As we grow, egrey will develop and launch multiple products across categories including workforce management, productivity, HR, and beyond.
Data Controller: egrey is the data controller responsible for personal data collected through egrey.in and any egrey-operated product. For products where we process data on behalf of business customers, egrey also acts as a data processor under applicable agreements.
| Detail | Information |
|---|---|
| Company Name | egrey |
| Website | egrey.in |
| Location | Chennai, Tamil Nadu, India |
| Contact Email | hello@egrey.in |
| Applicable Laws | IT Act 2000 · SPDI Rules 2011 · DPDPA 2023 |
This Privacy Policy applies to:
Each egrey product may have its own supplementary privacy notice that provides product-specific details. Where such a notice exists, it applies in addition to this policy. In case of conflict, the product-specific notice prevails for that product's data practices.
This policy does not apply to third-party websites, platforms, or services that may be linked from our website or products. We encourage you to review their privacy policies independently.
When a business subscribes to an egrey product, the business ("customer") may provide data about their employees or end users to use that product. In such cases, egrey processes this data as a data processor on behalf of the business. The business is responsible for ensuring lawful collection of such data and informing their employees about its use.
Under India's SPDI Rules 2011, certain categories of data (such as financial records, health data, or biometric data) are classified as sensitive. egrey collects sensitive personal data only where strictly necessary for product functionality, with explicit consent, and in compliance with applicable law.
| Collection Method | Data Collected |
|---|---|
| Website contact & enquiry forms | Name, email, company, message content |
| Product account registration | Profile details, login credentials, organisation info |
| Direct email or chat communications | Content of messages sent to egrey |
| Product usage (logged automatically) | Features used, actions taken, timestamps |
| Cookies & browser storage | Session data, user preferences |
| Analytics tools | Anonymised traffic and behaviour data |
| Payment processors | Transaction confirmation (not card credentials) |
| Business customer administration | End-user data entered by the customer's admins |
We do not sell your personal data. We do not share your data with third parties for their own marketing or advertising purposes. egrey products are ad-free and we do not use your data for targeted advertising.
Under India's Digital Personal Data Protection Act 2023 (DPDPA) and applicable regulations, all data processing at egrey is grounded in one or more of the following lawful bases:
| Legal Basis | When We Rely On It |
|---|---|
| Consent | Marketing emails, optional analytics cookies, non-essential data collection |
| Contractual Necessity | Delivering product features and services that you or your organisation have contracted |
| Legitimate Interests | Website analytics, product improvement, fraud prevention, security monitoring |
| Legal Obligation | Compliance with Indian tax, labour, corporate, and regulatory law |
| Vital Interests | Emergency situations involving the safety of individuals |
Where we rely on your consent, you may withdraw it at any time without affecting the lawfulness of any processing carried out before withdrawal.
egrey does not sell, rent, or trade your personal data. We share data only in the following limited and controlled circumstances:
We work with carefully selected third-party providers to operate our infrastructure and services. These providers are contractually bound to process data only as instructed by egrey and to maintain appropriate security standards:
This list may be updated as egrey's product portfolio grows. We will update this policy to reflect any significant changes to our sub-processors.
Where egrey acts as a data processor for a business customer, authorised administrators of that business may access data of their own users within the scope of the product. egrey does not grant business customers access to data of other companies or individuals outside their own account.
egrey may disclose personal data if required to do so by applicable law, court order, or lawful government or regulatory request under the Information Technology Act 2000, DPDPA 2023, or any other applicable legislation.
In the event of a merger, acquisition, restructuring, or sale of egrey's assets, personal data may be transferred to the successor entity. We will provide notice to affected users before data is transferred and becomes subject to a different privacy policy.
egrey retains personal data only for as long as necessary to fulfil the purposes described in this policy, unless a longer retention period is required or permitted by law.
| Data Type | Retention Period |
|---|---|
| Account and profile data | Duration of active account + 90 days after deletion request |
| Product usage and activity records | Up to 3 years, or as required by applicable law |
| Business operational records | Up to 7 years (Indian labour and commercial law requirements) |
| Contact form and enquiry data | 2 years from the date of submission |
| Email and support communications | 3 years |
| Payment and billing records | 8 years (Indian tax and accounting law requirements) |
| Server and access logs | 90 days |
| Marketing consent records | Until consent is withdrawn, plus 1 year thereafter |
Upon expiry of the applicable retention period, data is securely and permanently deleted or irreversibly anonymised so that it can no longer be associated with any individual.
egrey implements robust technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure, loss, or destruction.
Data Breach Response: Despite best efforts, no system is completely immune to breach. In the unlikely event of a data breach that poses a risk to your rights, egrey will notify the relevant authorities and affected individuals in accordance with the timeframes mandated under the DPDPA 2023 and the IT Act 2000.
egrey uses cookies — small data files stored on your device — and similar technologies to operate our website and products effectively.
| Type | Purpose | Consent Required? |
|---|---|---|
| Essential | Login sessions, security tokens, basic functionality | No — required for service |
| Analytics | Understanding how users interact with our site (data anonymised) | Yes |
| Preference | Remembering your language, settings, and UI choices | Yes |
egrey does not use advertising cookies, cross-site tracking cookies, or any cookies that serve third-party marketing purposes. You may manage cookie settings through your browser at any time. Disabling essential cookies may affect the functionality of our products.
Under the Digital Personal Data Protection Act 2023 (DPDPA) and other applicable Indian laws, you have the following rights as a data principal:
| Right | What You Can Do |
|---|---|
| Right to Access | Request a summary of the personal data egrey holds about you |
| Right to Correction | Request that inaccurate or incomplete personal data be corrected |
| Right to Erasure | Request deletion of your personal data, subject to legal retention obligations |
| Right to Withdraw Consent | Withdraw any previously given consent for optional data processing at any time |
| Right to Grievance Redressal | Lodge a complaint with egrey's Grievance Officer (see Section 15) |
| Right to Nominate | Nominate another individual to exercise your rights in the event of your death or incapacity |
To exercise any of these rights, please send an email to hello@egrey.in with the subject line "Privacy Rights Request". We will acknowledge your request within 7 days and respond fully within 30 days. Identity verification may be required. No fee is charged for legitimate requests.
egrey's website and products are designed for use by adults and business entities only. We do not knowingly collect, process, or store personal data from any individual under the age of 18 years.
If you believe egrey has inadvertently collected personal data from a minor, please contact us immediately at hello@egrey.in. We will promptly investigate and delete any such information without delay.
Under the DPDPA 2023, processing the personal data of a child requires verifiable parental or guardian consent. egrey takes this obligation seriously and has no intention of targeting minors through any of its products or marketing activities.
egrey is incorporated and operates in India. Our primary data processing and storage infrastructure is located in India or in jurisdictions used by our trusted cloud service providers.
Where data is processed or stored outside India by any of our service providers, egrey ensures that:
egrey regularly reviews its data processing landscape to align with evolving Indian data localisation and transfer regulations. As the DPDPA 2023 framework is further notified by the Government of India, egrey will update its practices accordingly and reflect those changes in this policy.
Our website and products may contain links to third-party websites, platforms, or services — such as social media channels, partner websites, or external references. These links are provided solely for convenience or informational purposes.
egrey has no control over, and accepts no responsibility for, the content, privacy practices, or data handling of any third-party website or service. We strongly encourage you to review the privacy policies of any third-party services you access via links on our platforms before providing any personal information.
In accordance with the Information Technology Act 2000, the SPDI Rules 2011, and the DPDPA 2023, egrey has designated a Grievance Officer to receive, investigate, and resolve complaints or concerns related to the processing of personal data.
Grievance Officer — egrey
📧 Email: hello@egrey.in
🌐 Website: egrey.in
📍 egrey, Chennai, Tamil Nadu, India
⏱ Response time: Within 30 days of receiving your complaint
If you are dissatisfied with egrey's response to your grievance, you may escalate your complaint to the Data Protection Board of India, once it is formally constituted and operational under the DPDPA 2023.
egrey reserves the right to update or modify this Privacy Policy at any time. We are committed to being transparent about any changes that affect how we handle your data. When material changes are made, we will:
We encourage you to review this policy periodically. Your continued use of egrey's website or products after the effective date of any updated policy constitutes your acceptance of the changes. If you do not agree with the updated terms, you may discontinue use and contact us to exercise your data rights.
For any questions, requests, or concerns about this Privacy Policy or how egrey handles your personal data, please reach out to us. We take all privacy-related enquiries seriously and respond with care.
egrey — Privacy
📧 General enquiries: hello@egrey.in
🌐 Website: egrey.in
📍 Chennai, Tamil Nadu, India
⏱ We aim to respond to all privacy enquiries within 7 working days
This Privacy Policy has been prepared in accordance with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023.
© 2025 egrey. All rights reserved. · Chennai, Tamil Nadu, India