Legal

Privacy Policy

Last updated 18 October 2026

Beyondwork - Privacy Policy

Last updated: 15 October 2026 · Version 1.0

This Privacy Policy explains how Beyondwork Ventures Private Limited ("BeyondWork", "we", "us", "our") collects, uses, shares, stores and protects personal data when you use BeyondWork ERP: our business software available at www.beyondwork.co.in, on workspace sub-domains of beyondwork.co.in, on custom domains our customers connect, and through our mobile applications (together, the "Platform").

Company details: Beyondwork Ventures Private Limited, CIN U82300KA2025PTC206302, GSTIN 29AANCB8115F1ZI, registered office at Room No. 2, Sai Ranjitha Building, Opp. FCI Main Gate, Kadugodi Main Road, Channasandra, Bengaluru, Karnataka 560067, India.

This Policy is written to meet the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 (together, the "DPDP Act"), the Information Technology Act, 2000 and the rules made under it, the Google API Services User Data Policy, and the Meta Platform Terms. It applies only to BeyondWork ERP. Other brands of Beyondwork Ventures Private Limited are covered by their own policies.

1. Who is responsible for your data

BeyondWork ERP is used by businesses ("Customers") to run their operations. Our role depends on whose data it is:

  • We are the Data Fiduciary for data we collect to run our own business: account and sign-in details of people who use the Platform, billing contacts, website visitors, people who book a demo or contact support, and Platform usage and security logs.

  • We are a Data Processor for data that Customers and their users enter into or connect to the Platform ("Customer Data"), for example their clients, leads, vendors, employees, invoices, expense claims, messages and documents. For Customer Data, the Customer is the Data Fiduciary and decides why and how it is processed. We process it only on the Customer's instructions, under our Terms of Service and Data Processing Addendum.

If your personal data is held in a Customer's workspace (for example, you are a client, vendor or employee of a business that uses BeyondWork ERP) and you want to access, correct or erase it, please contact that business first. We will help them respond and, where you contact us directly, we will pass your request to them.

2. Personal data we collect

2.1 Data you give us

  • Account data: name, work email address, mobile number, password (stored only as a one-way hash), profile photo, job title, department and role.

  • Organisation data: company name, address, state, GSTIN, PAN, bank details for invoices, logo, and the name and contact details of the account owner and billing contact.

  • Communications: messages you send to us, support tickets, demo requests, feedback and survey answers.

  • Verification data: one-time passwords (OTPs) sent to your mobile number for sign-in.

2.2 Data collected automatically

  • Usage and log data: IP address, device and browser type, operating system, pages and features used, date and time of access, error reports and audit logs of actions taken in a workspace.

  • Cookies and similar technologies: see section 10.

  • Mobile app data: device model, operating system version, app version and push-notification token. We access your camera, photos or files only when you choose to attach a receipt, document or image.

2.3 Data from third parties you connect

When you or your organisation connect a third-party account, we receive the data described in sections 5 (Google), 6 (Meta and LinkedIn) and 7 (other services). We also receive limited data from public registries when you ask us to verify a GSTIN or PAN.

2.4 Customer Data

Customers decide what they store on the Platform. This can include personal data of their clients, leads, vendors, employees and other contacts, such as names, contact details, addresses, tax identifiers, bank details, invoices, payments, expense claims and receipts, tasks, chat messages, emails, calendar events and documents. We process Customer Data only to provide the Platform to that Customer.

We do not intentionally collect sensitive categories of data such as health, biometric, religious or sexual-orientation data. Customers must not upload such data unless they have a lawful basis and a genuine business need.

3. Why we use personal data, and our legal basis

  • Create and manage your account, sign you in (password, OTP or Google), and keep your session secure. Data used: Account, verification, log data; Legal basis: Your consent, and the legitimate use of providing a service you requested.

  • Provide the Platform's features to your organisation. Data used: Account, organisation and Customer Data; Legal basis: Consent obtained by the Customer as Data Fiduciary; we act as its Data Processor.

  • Bill for subscriptions and keep tax records. Data used: Organisation and billing data; Legal basis: Compliance with law (GST, Companies Act, Income-tax Act).

  • Send service messages (security alerts, invitations, password resets, invoices, product changes). Data used: Account and contact data; Legal basis: Legitimate use necessary for the service.

  • Provide support and respond to grievances. Data used: Communications, account, log data; Legal basis: Your consent, and compliance with law.

  • Keep the Platform secure, prevent fraud and abuse, and investigate incidents. Data used: Log and usage data; Legal basis: Compliance with law (including CERT-In directions) and legitimate uses permitted by the DPDP Act.

  • Improve the Platform using aggregated or de-identified usage statistics. Data used: Usage data; Legal basis: Your consent; you may withdraw it at any time.

  • Send product news or marketing (only if you opt in). Data used: Name and email; Legal basis: Your consent; unsubscribe at any time.

We do not sell personal data. We do not use personal data for third-party advertising. We do not use Customer Data to train artificial-intelligence models.

4. Consent and withdrawing it

Where we rely on consent, we ask for it in clear, plain language, for a specific purpose. You can withdraw consent at any time, as easily as you gave it: through Settings in the Platform, by disconnecting an integration, by using the unsubscribe link in an email, or by writing to us (section 14). Withdrawing consent does not affect processing that took place before it, and some features may stop working. You may also give, manage or withdraw consent through a Consent Manager registered with the Data Protection Board of India once such services are available.

5. Google user data

BeyondWork ERP lets you connect your Google account. We access Google user data only when you choose to connect, only for the features described below, and only with the permissions you approve on Google's consent screen.

  • Sign in with Google (openid, email, profile): Verify your identity and sign you in to an existing BeyondWork ERP account with the same email address.

  • Gmail: send (gmail.send): Send emails you write or approve in the Platform, such as invoices, quotations and replies, from your own Gmail address.

  • Gmail: read and modify (gmail.readonly, gmail.modify): Show your email conversations with your organisation's clients, leads and vendors inside the Platform's Communication inbox, link them to the right records, download attachments you open, and keep read status in sync. We fetch only messages needed for these features.

  • Google Drive (drive.file): Create and update files you export from the Platform, such as Google Sheets of item lists and checklists. We can only access files the Platform created or that you open with it, not the rest of your Drive.

  • Google Calendar (calendar.events, calendar.app.created, calendar.calendarlist.readonly): Show your calendars so you can pick one, and create, update and remove events for tasks and meetings you schedule in the Platform, including sending invitations to the guests you add.

  • YouTube (youtube.readonly), Search Console (webmasters.readonly), Business Profile (business.manage): Only if your organisation uses the Marketing module: read channel and website performance reports, and publish posts or replies to your Business Profile that you create in the Platform.

Limited Use. BeyondWork ERP's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

  • We use Google user data only to provide and improve the user-facing features described above, which are visible in the Platform.

  • We do not transfer Google user data to others except as needed to provide those features, to comply with law, for security purposes, or as part of a merger or acquisition with notice to you.

  • We do not use or transfer Google user data for serving advertisements, including retargeting, personalised or interest-based advertising.

  • We do not sell Google user data, and we do not use it to determine credit-worthiness or for lending.

  • We do not use Google user data, including Google Workspace API data, to develop, improve or train generalised or non-personalised artificial-intelligence or machine-learning models.

  • No person at BeyondWork reads your Google user data unless you give us specific permission (for example, in a support request), it is needed for security purposes such as investigating abuse, it is required by law, or the data has been aggregated and anonymised for internal operations.

AI features and Google data. If you ask an AI feature in the Platform to work with Google data (for example, to draft a reply to an email), the relevant content is sent to our AI provider only to produce that result for you. Our AI provider is contractually prohibited from using it to train its models.

Storage and security. Google access tokens are stored encrypted and are used only by our servers. Synced email content and attachments are stored in your organisation's workspace with the same protections as other Customer Data.

Disconnecting and deletion. You can disconnect Google at any time in Settings → Integrations in the Platform or at myaccount.google.com/permissions. When you disconnect, we stop accessing your Google account immediately. To have Google user data that we previously synced deleted, write to legal@beyondwork.co.in; we will delete it within 30 days, except where your organisation must keep it as a business record under law, in which case we will tell you.

6. Meta (Facebook, Instagram, WhatsApp) and LinkedIn data

If your organisation connects these services, we access only what is needed for the features you use:

  • Facebook Pages (pages_show_list, pages_read_engagement, pages_manage_posts): list the Pages you manage so you can choose one, publish posts you create or schedule in the Platform, and show engagement for those posts.

  • Instagram professional accounts (instagram_basic, instagram_content_publish and the Page permissions above): identify the linked account, publish the posts you create or schedule in the Platform, and show their performance.

  • WhatsApp Business Platform: send messages and approved templates that you or your organisation trigger (for example, sharing an invoice or a vendor request), receive replies and delivery status, and show them in the Platform. This involves the phone numbers and message content of the people you message.

  • LinkedIn (openid, profile, w_member_social and organisation-page permissions): identify the connected profile or page and publish the posts you create in the Platform.

We use data from Meta and LinkedIn only to provide these features to you. We do not sell it, use it for advertising or profiling, or share it with data brokers, and we comply with the Meta Platform Terms, Meta Developer Policies, WhatsApp Business Messaging Policy and LinkedIn API Terms. Access tokens are stored encrypted.

6.1 Data deletion instructions

You can ask us to delete data we received from Facebook, Instagram, WhatsApp or LinkedIn at any time, in any of these ways:

  1. In the Platform, go to Settings → Integrations (or Marketing → Social) and choose Disconnect for the account. We stop accessing it immediately.

  2. Remove BeyondWork ERP from your Facebook account under Settings & privacy → Settings → Apps and websites, or from your LinkedIn account under Settings → Data privacy → Permitted services.

  3. Email legal@beyondwork.co.in with the subject "Data deletion request", the name of the account and the email address you use with BeyondWork ERP.

We will delete the access tokens straight away and the remaining data we received from that service within 30 days, and confirm by email with a reference number. Posts already published to your Page or profile stay there until you remove them on that service. Records your organisation must keep by law, such as invoices, are not deleted, but their link to the social account is removed.

7. Who we share data with

We share personal data only as described here, and only as much as each recipient needs.

7.1 Service providers (sub-processors)

  • Amazon Web Services (AWS). What they do for us: Database hosting, file storage and transactional email (Amazon SES); Main location: India (Mumbai).

  • Supabase. What they do for us: Database hosting, file storage and real-time updates; Main location: India (Mumbai, on AWS).

  • Vercel. What they do for us: Application hosting, content delivery and performance monitoring; Main location: India (Mumbai) and global edge network.

  • Cloudflare. What they do for us: Domain name service and network security; Main location: Global.

  • Google (Google Workspace). What they do for us: Sending system emails from noreply@beyondwork.co.in, and the Google features you connect; Main location: Global.

  • Anthropic. What they do for us: AI features (drafting, summarising, extracting data from documents); Main location: United States.

  • Vercel AI Gateway, routing to OpenAI and Google. What they do for us: AI image generation in the Marketing module, only when you use it; Main location: United States.

  • MSG91. What they do for us: Sending sign-in OTPs by SMS; Main location: India.

  • Razorpay. What they do for us: Payment links and payment collection; Main location: India.

  • Sandbox (api.sandbox.co.in) and GSTINCheck. What they do for us: Verifying GSTIN and PAN details you ask us to check; Main location: India.

  • Meta, LinkedIn. What they do for us: The social and WhatsApp features you connect; Main location: Global.

Each provider is bound by a contract that requires it to process personal data only on our instructions, keep it confidential and protect it with appropriate security. We will update this list when we add or replace a provider that processes personal data.

7.2 Other recipients

  • Your organisation: administrators of your workspace can see the data in it, including your activity, according to the roles they assign.

  • People you choose to contact: for example, when you email an invoice to a client or invite a guest to a meeting.

  • Authorities: when required by law, court order or a lawful request from a government agency, or to protect the rights, property or safety of BeyondWork, our users or the public.

  • Business transfers: if we are involved in a merger, acquisition or sale of assets, personal data may transfer to the new owner, who will be bound by this Policy. We will notify you before that happens.

8. Where your data is stored, and transfers outside India

Customer Data is stored primarily in data centres in India (Mumbai). Some providers listed in section 7.1 process limited data outside India, for example when you use AI features or connect Google, Meta or LinkedIn. We transfer personal data outside India only in line with the DPDP Act, and never to a country or territory that the Government of India has restricted. Each such provider is bound to protect the data to a standard no lower than this Policy.

9. How long we keep data

  • Account data: for as long as your account is active. If your organisation removes you, or the subscription ends, we delete or anonymise it as set out below.

  • Customer Data: for the duration of the Customer's subscription. After the subscription ends, the Customer has 30 days to export its data; we then delete it from live systems within a further 60 days and from backups within 90 days, unless the law requires us to keep it longer.

  • Billing and tax records: for 8 years, as required by the Companies Act, 2013 and GST law.

  • Security, access and traffic logs: for at least 1 year, and at least 180 days within India, as required by the DPDP Rules, 2025 and CERT-In directions, then deleted.

  • OTPs: valid for a few minutes and deleted after use or expiry.

When the purpose for which we hold personal data is no longer being served and no law requires us to keep it, we erase it.

10. Cookies

The Platform uses only cookies that are strictly necessary to sign you in, keep your session secure and remember your preferences (such as the selected workspace and theme). These cannot be switched off without breaking the Platform. We use Vercel Speed Insights to measure page performance; it does not use cookies or identify you. We do not use advertising or cross-site tracking cookies on the Platform. If we add analytics cookies in future, we will ask for your consent first.

11. How we protect data

We use reasonable security practices and procedures consistent with IS/ISO/IEC 27001 and the DPDP Rules, 2025, including encryption in transit (TLS) and at rest, encryption of integration tokens, hashed passwords, role-based access control, separation of each Customer's data, regular backups, access logging, vulnerability reviews, and access for our staff only on a need-to-know basis under confidentiality obligations.

Personal data breaches. If a personal data breach affects you, we will inform you without delay, describing what happened, the likely consequences, what we are doing about it and what you can do. We will also inform the Data Protection Board of India as required by the DPDP Act, and report cyber-security incidents to CERT-In within 6 hours. Where Customer Data is affected, we will notify the Customer without undue delay so that it can meet its own obligations.

12. Your rights

Under the DPDP Act you have the right to:

  • Access a summary of the personal data we process about you, the processing activities, and the other Data Fiduciaries and Processors we have shared it with;

  • Correct, complete or update your personal data;

  • Erase your personal data, where it is no longer needed and no law requires us to keep it;

  • Withdraw consent at any time (section 4);

  • Nominate another person to exercise your rights if you die or become unable to do so;

  • Grievance redressal by us (section 13) and, if you are not satisfied, to complain to the Data Protection Board of India.

You can update most account details yourself in the Platform. For anything else, write to legal@beyondwork.co.in. We may ask you to verify your identity. We respond within 30 days, or sooner where the law requires. For Customer Data, see section 1.

13. Grievance Officer and contact

In line with the DPDP Act and the Information Technology Act, 2000 and its rules, our Grievance Officer, who also answers questions about this Policy on behalf of BeyondWork, is:

  • Name: Dharshan S

  • Designation: Director, Beyondwork Ventures Private Limited

  • Email: legal@beyondwork.co.in

  • Address: Room No. 2, Sai Ranjitha Building, Opp. FCI Main Gate, Kadugodi Main Road, Channasandra, Bengaluru, Karnataka 560067, India

  • Phone: +91 72042 08229 (Monday to Saturday, 10:00 AM to 7:00 PM IST)

We acknowledge grievances within 24 hours and resolve them within 15 days of receipt, or within any shorter period the law requires.

14. Children

The Platform is for businesses and is meant for people aged 18 or over. We do not knowingly collect personal data of children (persons under 18). If we learn that we have collected a child's personal data without verifiable consent of a parent or lawful guardian, we will delete it. Customers must not store children's personal data on the Platform without verifiable parental consent as required by the DPDP Act.

15. Changes to this Policy

We may update this Policy to reflect changes in the Platform or the law. We will post the new version here with a new "Last updated" date. If a change materially affects how we use your personal data, we will notify account owners by email or in the Platform at least 15 days before it takes effect and, where required, ask for fresh consent.

16. Language

You may request this Policy in English or in any language listed in the Eighth Schedule to the Constitution of India by writing to legal@beyondwork.co.in.

End of document.

Book a demo

30 minutes, on your business — not a canned deck.