Half Eaten DonutGirgit

Privacy Policy

Girgit by Half Eaten Donut Private Limited
Last updated: 24 October 2026

This Privacy Policy explains how Half Eaten Donut Private Limited ("Half Eaten Donut", "HED", "we", "us") collects, uses, shares and protects personal information through Girgit, our agency management platform. Girgit is available on the web at girgit.app and as mobile apps for Android and iOS (together, the "Service").

Girgit is a business tool. It is used by HED's own team (administrators, accountants, HR and employees), by HED's clients, and by job candidates who apply through our careers page. It is not intended for children under 18.

1. Who is responsible for your data

Half Eaten Donut Private Limited
565/I, 7th A Main Road, HAL 2nd Stage, Indiranagar, Bengaluru, Karnataka 560008, India
GSTIN 29AAFCH4136C1ZT
Privacy contact: media@halfeatendonut.in

2. Information we collect

Account information (all users). Name, email address, phone or WhatsApp number, password (stored only in encrypted, hashed form), role and designation.

Employee information (HED team members). Employee ID, department, designation, date of joining and leaving, date of birth, gender, emergency contact details, bank account details for salary payments, salary and CTC details, attendance, leave requests and balances, tasks, timesheets, performance and recognition records, and help desk tickets.

Client information (HED's business clients). Company and brand name, contact persons, business email and phone numbers, billing address, GSTIN, invoices, payments, purchase orders, proposals, contracts, files shared with us, and electronic signatures. When a client signs a contract or accepts a proposal online, we record the signer's typed name or drawn signature, designation, email, the date and time, IP address and browser or device details. This is evidence of the signature.

Job candidate information. Name, email, phone number, resume or CV, portfolio links, and any other details you submit with an application, plus the status of your application.

Files and content you upload. Documents, images, payment proofs and other files uploaded to the Service.

Device and usage information. Log data such as IP address, browser or device type, operating system, app version, pages or screens used, and error reports. On mobile, we also collect a push notification token so we can send you in-app alerts. We do not collect precise location. We do not access your contacts, microphone or camera unless you choose to upload a photo or file.

3. How we use information

  • To provide the Service: sign-in, role-based access, tasks, leaves, attendance, payroll, recognition, client management, invoicing, proposals, contracts and hiring.
  • To send service messages by email, WhatsApp and push notification, such as approvals, reminders, digests, invoice and payment alerts, and contract renewal reminders.
  • To process payments and keep accounting and tax records as required by Indian law (including GST and TDS).
  • To evaluate job applications.
  • To keep the Service secure: preventing fraud and abuse, and keeping audit logs of important actions.
  • To fix problems and improve the Service.

We do not sell personal information. We do not use it for third-party advertising.

4. Legal basis

We process personal information to perform our contracts with employees and clients, to comply with legal obligations (for example tax, labour and accounting laws), for our legitimate business interests in running and securing the Service, and with your consent where required. We follow the Digital Personal Data Protection Act, 2023 and other applicable Indian law.

5. Who we share information with

We share information only with service providers that help us run the Service. They may use it only on our instructions:

  • Hosting and database: Emergent (application hosting) and MongoDB Atlas (database).
  • File storage: Amazon Web Services (S3).
  • Email: Google (Gmail API) for sending emails from HED mailboxes.
  • WhatsApp messages: AiSensy (a WhatsApp Business API provider) and Meta.
  • Payments: Razorpay.
  • Push notifications: Google Firebase Cloud Messaging and Apple Push Notification service.
  • AI features: AI model providers (such as OpenAI, Anthropic or Google), when an authorised user uses Girgit's AI assistant. Only the information needed to answer the request is sent.

We may also disclose information if the law requires it, to protect our rights or the safety of others, or as part of a merger or sale of our business. Clients' information is visible only to HED staff whose role requires it. Salary and bank details are restricted to the Super Admin and authorised HR and accounts staff.

6. Data storage, transfer and security

Information is stored on secure cloud servers, which may be located in or outside India. We protect it with encrypted connections (HTTPS), hashed passwords, role-based access controls, audit logs and restricted access to sensitive data. No method of storage or transmission is completely secure, but we work to protect your information and will notify you and the authorities of a data breach where the law requires.

7. How long we keep information

  • Employee records: for the period of employment and afterwards as long as labour, tax and accounting laws require (generally up to 8 years).
  • Client, invoice, contract and signature records: for the duration of the relationship and up to 8 years afterwards, for legal and tax purposes.
  • Job applications: up to 2 years after the application, unless you ask us to delete it sooner.
  • Device tokens and logs: for as long as needed to run and secure the Service, typically no more than 12 months.

8. Your rights

You may ask to access, correct or update your personal information, to have it deleted, to withdraw consent, or to nominate someone to exercise these rights on your behalf. You may also raise a grievance with us. Some records must be kept by law even after a deletion request (for example invoices and tax records); in that case we keep only what is required.

To delete your account or data, use the form at girgit.app/delete-account, or email media@halfeatendonut.in from the email address linked to your account, with the subject "Data deletion request". Tell us which account or data you want deleted. We will confirm your identity and respond within 30 days. HED employees can also ask HR.

If you are not satisfied with our response, you may complain to the Data Protection Board of India.

9. Mobile app permissions

The Girgit mobile app may ask for:

  • Notifications: to send you alerts. You can turn these off in your device settings.
  • Photos, camera or files: only when you choose to upload a document or image.
  • Internet access: to connect to the Service.

10. Children

The Service is not directed to anyone under 18, and we do not knowingly collect their personal information.

11. Changes to this policy

We may update this policy from time to time. We will post the new version at girgit.app/privacy with a new "Last updated" date and, for significant changes, notify users in the app or by email.

12. Contact us

Privacy questions, requests and grievances:
media@halfeatendonut.in
Half Eaten Donut Private Limited, 565/I, 7th A Main Road, HAL 2nd Stage, Indiranagar, Bengaluru, Karnataka 560008, India