Privacy Policy

This policy explains what personal data Tathven collects, why we collect it, how we use and protect it, and the rights you have over it.

Last updated: 14 September 2026  ·  Version 1.0

1. Who we are

Tathven AI Private Limited (“Tathven”, “we”, “us” or “our”) is a company incorporated in India, with its registered office at 236, Ramakrishna Mutt Road, Raja Annamalaipuram, Chennai 600028, Tamil Nadu, India, CIN U62011TN2026PTC195806.

We build and operate enterprise software, including Tathven Agentic ERP, Tathven HRMS, Tathven Payroll and related services (together, the “Services”).

For the purposes of the Digital Personal Data Protection Act, 2023 (“DPDP Act”), Tathven acts as a Data Fiduciary in respect of personal data we collect directly from visitors, prospective customers and the administrators of our customer accounts.

Where our customer organisations upload or enter personal data about their own employees, contractors, vendors or clients into the Services, that customer is the Data Fiduciary and Tathven acts as a Data Processor, processing such data only on the customer's documented instructions under our customer agreement. If you are an employee of an organisation that uses Tathven and you have a question about your data, please contact your employer in the first instance.

2. Scope of this policy

This policy applies to personal data processed through:

• our websites at tathven.com and its subdomains;
• the Tathven identity service at identity.tathven.com, including sign-in with Google;
• the Tathven Agentic ERP, HRMS, DMS and control plane applications; and
• our sales, support and marketing communications.

It does not apply to third-party websites or services that we link to. Those have their own privacy policies.

3. Personal data we collect

We do not sell personal data. We do not use customer content to train machine learning models for use outside your own organisation's account.

4. Google Sign-In and Google user data

Tathven offers sign-in with Google as an authentication option. This section explains exactly what we receive from Google and what we do with it.

What we request

When you choose to sign in with Google, we request only the following OAuth scopes:

How we use it

• To authenticate you and create or link your Tathven user account.
• To display your name and profile picture within the Tathven applications.
• To send you service-related notifications at your email address.

How we store and share it

We store your Google account identifier, email address, name and profile picture URL in our user directory, encrypted at rest. We retain OAuth tokens only for as long as needed to maintain your session, and we store refresh tokens encrypted.

We do not transfer Google user data to any third party except to the infrastructure providers listed in section 7 who host our systems on our behalf, and except where required by law. We never sell Google user data, never use it for advertising, and never use it to build profiles for purposes unrelated to providing the Services.

Revoking access

You can disconnect Tathven from your Google Account at any time at myaccount.google.com/permissions. Doing so stops future Google sign-ins. It does not by itself delete your Tathven account; to delete that, see section 10.

5. Why we process your data

To provide the Services

Authenticating users, delivering application functionality, storing and retrieving your records, and maintaining audit trails.

To support and communicate with you

Responding to tickets and enquiries, sending service notices, maintenance windows and security advisories.

To secure the Services

Detecting and investigating unauthorised access, fraud, abuse and technical faults, and keeping records required for security review.

To bill and administer accounts

Raising invoices, collecting payment, and maintaining records required under tax and company law.

To improve the Services

Understanding aggregate usage patterns, diagnosing errors and prioritising development. We use aggregated or de-identified data for this wherever possible.

To comply with law

Meeting obligations under Indian tax, labour, company and data protection law, and responding to lawful requests from authorities.

6. Consent and legal basis

Under the DPDP Act we process personal data on the basis of your consent, or for certain legitimate uses permitted by the Act.

Where we rely on consent, we ask for it clearly, for a specified purpose, before or at the point of collection. Your consent is limited to the personal data necessary for that purpose.

You may withdraw your consent at any time, with the same ease with which you gave it, by writing to us at the address in section 16 or by using the controls in your account settings. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. If you withdraw consent, we will cease processing and erase the relevant personal data within a reasonable time unless retention is required by law, and we may be unable to continue providing some or all of the Services to you.

Where we act as a Data Processor for a customer organisation, that organisation is responsible for obtaining any consent required from its own personnel.

7. Who we share data with

We share personal data only in the following circumstances:

• Service providers. Cloud hosting, email delivery, error monitoring, payment processing and customer support tooling. Each is bound by contract to process data only on our instructions and to protect it. Our current infrastructure and service providers are: Google Cloud Platform (hosting and infrastructure).
• Your organisation. If you use Tathven through an employer or client organisation, administrators of that account can access your account and activity data within the Services.
• Professional advisers. Auditors, lawyers and accountants, under duties of confidentiality.
• Legal and regulatory. Where disclosure is required by law, court order or a lawful request from a government authority, or to establish, exercise or defend legal claims.
• Business transfers. In connection with a merger, acquisition or sale of assets, subject to this policy continuing to apply.

We do not disclose personal data to advertisers or data brokers.

8. How long we keep data

When a retention period ends, or when you withdraw consent and no other purpose or legal obligation applies, we erase the personal data or irreversibly de-identify it.

9. How we protect data

We maintain reasonable security safeguards to prevent personal data breaches, including:

• encryption of data in transit using TLS, and encryption of sensitive fields at rest;
• role-based access control, with access granted on a least-privilege basis;
• multi-factor authentication for administrative access;
• audit logging of access to personal data;
• regular backups, patching and vulnerability management; and
• contractual security obligations on our service providers.

No system is completely secure. In the event of a personal data breach we will notify the Data Protection Board of India and affected individuals as required under the DPDP Act.

10. Your rights

Subject to the DPDP Act, you have the right to:

• Access a summary of the personal data we process about you, the processing activities undertaken, and the identities of other Data Fiduciaries and Processors with whom it has been shared.
• Correction, completion and updating of inaccurate or incomplete personal data.
• Erasure of personal data that is no longer necessary for the purpose for which it was collected, unless retention is required by law.
• Withdraw consent at any time, as described in section 6.
• Nominate another individual to exercise these rights on your behalf in the event of your death or incapacity.
• Grievance redressal, as described in section 11.

To exercise any of these rights, write to care@tathven.com from the email address associated with your account. We will respond within 30 days. We may ask you for information to verify your identity before acting on a request.

You are responsible for the accuracy of the information you give us, and for not impersonating another person or filing false or frivolous requests, which the DPDP Act treats as duties of a Data Principal.

11. Grievance redressal

If you are not satisfied with our response, or if we do not respond within the period stated above, you may make a complaint to the Data Protection Board of India in the manner prescribed under the DPDP Act.

12. Children's data

The Services are intended for use by businesses and their personnel. We do not knowingly collect personal data directly from children under the age of eighteen, and we do not undertake tracking, behavioural monitoring or targeted advertising directed at children. Where a customer organisation processes data relating to a child through the Services, that organisation is responsible for obtaining verifiable consent from a parent or lawful guardian as required by the DPDP Act.

If you believe we have inadvertently collected such data, contact us and we will erase it.

13. International transfers

Our primary infrastructure is located in India. Some of our service providers may process personal data outside India. Where that happens, we transfer data only to countries not restricted by the Central Government under the DPDP Act, and we put appropriate contractual protections in place.

14. Cookies and similar technologies

We use cookies and similar technologies for the following purposes:

• Strictly necessary. Session cookies that keep you signed in, remember your security context and protect against cross-site request forgery. These cannot be disabled without breaking the Services.
• Preference. Remembering your language, theme and layout choices.
• Analytics. Understanding aggregate usage of our website and applications so we can improve them.

You can control cookies through your browser settings. Blocking strictly necessary cookies will prevent you from signing in.

15. Changes to this policy

We may update this policy from time to time. When we make a material change we will update the “last updated” date above and, where the change affects how we use your personal data, notify you by email or through the Services before it takes effect. We encourage you to review this page periodically.

16. Contact us