Privacy Policy
Effective June 13, 2026 · Celestinfo Software Solutions Pvt. Ltd. ("Celestinfo", "we")
Who does what
Nebula HRMS is used by organisations to manage their own employees. For employee personal data, the customer organisation is the data fiduciary — it decides what is collected and why — and Celestinfo is a data processor acting on its instructions. For workspace administrator accounts, public job applications submitted on our careers pages, and our own website, Celestinfo is the data fiduciary.
What we process
Depending on the modules an organisation enables: identification and contact details; employment details (role, department, compensation where the organisation uses payroll); statutory identifiers the organisation records (such as PAN or Aadhaar) for payroll and compliance; attendance events, which may include the device location and an optional photo at the moment of punch-in/out where the organisation enables geofencing or selfie capture; leave, performance, helpdesk and similar HR records; resumes and details submitted by job applicants; and technical logs needed to run and secure the Service.
How we protect it
Data is encrypted in transit (TLS) and sensitive identifiers (such as PAN and Aadhaar) are encrypted at rest. Access is role-based and tenant-isolated — one organisation can never read another's data. Administrative actions are recorded in a tamper-evident audit log. Resume parsing runs on our own infrastructure; applicant documents are not sent to third-party AI services.
Where it lives and who else touches it
The Service runs on infrastructure operated by Celestinfo, with file storage on Microsoft Azure and transactional email/calendar delivery via Microsoft 365. These sub-processors process data only to provide their function. We do not sell personal data and we do not use customer data for advertising.
Retention
Workspace data is retained while the workspace is active. After termination, data is deleted or returned within 30 days of a written request (statutory payroll records may be retained longer where law requires). Nightly encrypted backups are retained for 30 days. Job applicants may ask the hiring organisation to remove their application.
Your rights
Employees should direct access, correction and erasure requests to their employer (the data fiduciary); we provide the tooling to honour them, including data export and a consent ledger. Workspace administrators and job applicants can contact us directly. We respond to verified requests within 30 days.
Cookies
We use session cookies strictly for sign-in. No advertising or cross-site tracking cookies.
Grievance officer
Grievance Officer, Celestinfo Software Solutions Pvt. Ltd. — digitalservices@celestinfo.com. We acknowledge complaints within 48 hours and aim to resolve them within 15 days.
Changes
Material changes to this policy are announced in-product or by email at least 14 days before they take effect.