At Graciax (operated by Keyakash Technologies Private Limited) we believe deletion should be as simple as sign-up. This page explains exactly who can request deletion, how to do it, what we delete, what we must retain by law, and how long it takes. Your rights under India's Digital Personal Data Protection Act, 2023 (DPDPA) and, where applicable, the EU GDPR are honoured here.

Who Can Request Deletion

• Account Owner / Org Admin can delete the entire workspace, including all employees, candidates, and uploaded documents.
• Individual Employee or User can request deletion of their personal profile data. If your employer is the data fiduciary, we will route the request to your org admin and notify you of the outcome.
• Job Candidate can request removal of their candidate record at any time, including resume, contact details, and interview notes.
• End User of an Integration (e.g., signed in via a third-party login) can request deletion even without logging in by emailing us from the address linked to the account.

How to Request Deletion

You have three options. Pick whichever is most convenient.

Option 1 — Self-serve in-app (fastest)

• CRM: sign in at app.graciax.com → Profile → Settings → Account → Delete Account.
• HRMS: sign in at people.graciax.com → Profile → Privacy → Request Data Deletion. Org admins will see an additional Delete Workspace option.
• You will be asked to confirm via email and (for org admins) re-enter your password.

Option 2 — Email request

• Send an email to support@graciax.com from the address registered on your account, with the subject line: "Data Deletion Request".
• In the body include: your full name, organisation name (if applicable), registered email, and what you want deleted (account, specific records, candidate profile, etc.).
• For security we may ask one verification question before processing.

Option 3 — Written request (Grievance Officer)

• Address: Keyakash Technologies Private Limited, Attn: Grievance Officer, India.
• Email: grievance@graciax.com.
• Phone: +91 85480 50741.

What Gets Deleted

Once we confirm your request, the following will be permanently removed from our production systems:

• Account credentials, profile, and contact information.
• Uploaded files: profile photos, ID proofs, resumes, signed letters, receipts, and policy documents.
• Employee records, leave history, payslips, attendance logs, and reimbursement claims for the deleted employees (HRMS).
• Leads, contacts, deals, tasks, notes, and call logs (CRM).
• Activity log entries that contain personal identifiers.
• Third-party integration tokens (Google, biometric devices, SMTP credentials, etc.).

What We Are Required to Retain

Some records cannot be deleted on request because Indian law requires us (or your employer) to keep them. DPDPA 2023 §17(1)(c) recognises this carve-out. These records are retained in a restricted, audit-only archive for the legally required period, then deleted automatically.

• Payroll, TDS, Form 16, Form 24Q retained for 8 years (Income-tax Act, 1961).
• EPF / PF records retained for 5 years (EPF & MP Act, 1952).
• ESI records retained for 5 years (ESI Act, 1948).
• POSH / ICC complaint records and annual reports retained per Sexual Harassment of Women at Workplace Act, 2013.
• Invoices and accounting records retained for 8 years (Companies Act, 2013 §128).
• Anti-fraud and security logs IP, login, and audit trails kept for up to 12 months for abuse-prevention.

Encrypted Backups

Deleted data may persist in encrypted backups for up to 90 days after the deletion is confirmed. Backups are not used for any operational purpose; they exist solely for disaster recovery and are access-restricted. After 90 days, the data is overwritten and unrecoverable.

Timelines

• Acknowledgement: within 2 business days.
• Verification: 1–3 business days (we may ask one security question).
• Production deletion: within 30 days of confirmed request, in line with DPDPA 2023.
• Backup purge: within 90 days of production deletion.
• Confirmation email: sent once production deletion is complete.

Children's Data

Graciax services are not directed to anyone under 18. If we learn that we have collected personal data of a minor without verifiable parental consent, we will delete it without requiring a formal request. Parents and guardians can write to grievance@graciax.com.

Sub-processors and Cross-Border Data

When you delete data from Graciax, we also instruct our sub-processors (e.g., cloud storage, email delivery, analytics) to delete the corresponding records. Most sub-processor deletions complete within the same 30-day window. A current list of sub-processors is published on our Security page.

Effect of Deletion

• You will be signed out of all sessions immediately.
• Active subscriptions are cancelled at the end of the current billing period (see Cancellation & Refund Policy).
• You can reuse the same email to register a new Graciax account at any time, but the previous workspace cannot be restored.
• Co-tenants and shared records (e.g., a CRM contact also held by another Graciax customer) will not be affected.

If You're Not Satisfied

If your request is denied or you believe we've handled it incorrectly, you can escalate to our Grievance Officer at grievance@graciax.com or, after exhausting our process, to the Data Protection Board of India under the DPDPA, 2023.

For the broader policy on what we collect and how we protect it, please see our Privacy Policy.