Legal

Cookie Policy

Think and Scale (YTS Labs)Applies to HRxBoard and its website
On this page
  1. 1DEFINITIONS AND INTERPRETATION
  2. 2PURPOSE AND SCOPE
  3. 3WHAT COOKIES ARE
  4. 4LEGAL FRAMEWORK
  5. 5COOKIES IN THE APPLICATION
  6. 6WEBSITE
  7. 7CATEGORIES OF COOKIES
  8. 8FIRST-PARTY AND THIRD-PARTY COOKIES
  9. 9HOW OUR SESSION COOKIES ARE PROTECTED
  10. 10CONSENT AND YOUR CHOICES
  11. 11PERSONAL DATA AND YOUR RIGHTS
  12. 12COOKIES AND SERVER LOGS ARE DIFFERENT
  13. 13CHILDREN
  14. 14CHANGES TO THIS POLICY
  15. 15GRIEVANCES AND CONTACT
  16. 16GOVERNING LAW

1. DEFINITIONS AND INTERPRETATION

1.1.
In this Policy, unless the context requires otherwise:
1.1.1.
“we”, “us”, “our” and “YTS Labs” mean Think and Scale, a partnership firm registered under the Indian Partnership Act, 1932 [registration number], having its registered office at [address], which trades through its YTS Labs brand and operates HRxBoard. “you” means a user of the Platform or a visitor to the Website.
1.1.2.
“Applicable Data Protection Law” means, until the DPDP Commencement Date, section 43A of the IT Act, the SPDI Rules and the other provisions of the IT Act that apply to the processing of personal data; and from that date, the DPDP Act and the DPDP Rules together with the provisions of the IT Act that continue to apply.
1.1.3.
“CERT-In Directions” means the directions that the Indian Computer Emergency Response Team issued under section 70B(6) of the IT Act on 28 April 2022, as amended or replaced.
1.1.4.
“Client” means the business that subscribes to the Platform under an Order. “Client Team” means the users whom the Client adds. “Client Data” means data that a Client or its Client Team uploads or records in the Platform.
1.1.5.
“Cookie” means a small text file that a website or application stores on your device. It includes similar technologies that store or read information on your device, such as local storage and tokens, where this Policy says so.
1.1.6.
“CSRF” means cross-site request forgery, an attack that tricks a signed-in user’s browser into sending an unwanted request.
1.1.7.
“Data Fiduciary”, “Data Principal” and “Personal Data” have the meanings in the DPDP Act and, before the DPDP Commencement Date, are used in the same sense. “DPDP Act” means the Digital Personal Data Protection Act, 2023. “DPDP Rules” means the Digital Personal Data Protection Rules, 2025. “DPDP Commencement Date” means the date on which the substantive duties of Data Fiduciaries under the DPDP Act take effect, expected to be [13 May 2027]. “IT Act” means the Information Technology Act, 2000 and the rules under it. “SPDI Rules” means the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.
1.1.8.
“First-party Cookie” means a Cookie set by the domain that you are visiting. “Third-party Cookie” means a Cookie set by a different domain.
1.1.9.
“Grievance Officer” means the officer named in our Grievance Redressal Policy.
1.1.10.
“Non-essential Cookie” means a Cookie that is not strictly necessary, such as a functional preference, analytics, advertising or tracking Cookie.
1.1.11.
“Platform” means the HRxBoard application at app.ytslabs.com. “Website” means the marketing website at hrxboard.com.
1.1.12.
“Privacy Policy” means our Privacy Policy. “Strictly Necessary Cookie” means a Cookie that is needed to provide a service that you have asked for, to keep it secure, or to carry out the transmission of a communication, and that cannot be switched off without the service failing.
1.1.13.
“Security Logs” means the records that our servers keep of sign-ins, actions, IP addresses, and device and browser details, as clause 12 describes.
1.2.
Interpretation. Headings are for convenience only. “Including” means including without limitation. A reference to a statute, rule or direction includes it as amended, re-enacted or replaced. A reference to a clause is to a clause of this Policy.

2. PURPOSE AND SCOPE

2.1.
This Policy explains what Cookies the Platform and the Website use, why we use them, whether they are first-party or third-party, how long they last, what choices you have, and how Cookies differ from the server logs that we keep.
2.2.
It forms part of the Terms of Use and works with the Privacy Policy. If a Cookie gives us Personal Data that we hold as Data Fiduciary, the Privacy Policy also applies to that data.

3. WHAT COOKIES ARE

3.1.
Cookies are small text files that a website or application stores on your device. They help a service remember you, keep you signed in and keep your session secure. Some are deleted when you close your browser (session Cookies). Others stay for a set time (persistent Cookies). Similar technologies, such as local storage and tokens, do the same work, and this Policy treats them in the same way as Cookies.

4. LEGAL FRAMEWORK

4.1.
There is no separate Indian statute that deals only with Cookies. Cookies that identify a person are Personal Data, and the IT Act, the SPDI Rules and, from the DPDP Commencement Date, the DPDP Act and the DPDP Rules apply to our handling of them. Those laws require a clear notice, a lawful ground for each purpose and, where we rely on consent, consent that is free, specific, informed and unambiguous.
4.2.
We follow that standard for our own Cookies on the footing that: Strictly Necessary Cookies need no separate consent because they are needed to provide the service that you asked for; and we ask for your consent before we set any Non-essential Cookie.
4.3.
If you are located outside India, the Platform and the Website are not directed at you, as the Privacy Policy says, and we make no commitment to follow a foreign Cookie law except where it applies to us by compulsion of law.

5. COOKIES IN THE APPLICATION

5.1.
Principle. The Platform (app.ytslabs.com) uses only the Cookies it needs to work and to keep your account safe. We do not use advertising or tracking Cookies in the Platform, and we do not use Cookie data for marketing, profiling or benchmarking.
5.2.
The Cookies we set.
5.2.1.
Session Cookie [name]. Keeps you signed in. It is marked Secure, HttpOnly and SameSite. The session ends after 30 minutes of inactivity or 12 hours in total, and a password change signs you out on every device. Duration: session. Type: Strictly Necessary.
5.2.2.
CSRF Cookie [name]. Protects against cross-site request forgery on actions that change data. Duration: session. Type: Strictly Necessary.
5.2.3.
Load-balancer Cookie [name, if sticky sessions are enabled]. Directs your requests to the same server during a session so that the service stays stable. Duration: session. Type: Strictly Necessary.
5.3.
What we do not set. The Platform sets no preference, language, analytics, advertising, social-media or tracking Cookie.

6. WEBSITE

6.1.
The Website holds no Client Data. It carries public content and a form for demo requests. It does not use analytics, embedded media or advertising Cookies.
6.2.
If we start to use any Non-essential Cookie on the Website, we will first update this Policy and list each Cookie, its purpose, its duration and who sets it. We will also show a banner that lets visitors accept or decline Non-essential Cookies before any is set, as clause 10 describes.

7. CATEGORIES OF COOKIES

7.1.
Strictly Necessary. Used for sign-in, session security, CSRF protection and load balancing. Always on. No consent is needed because they are needed to provide the service you asked for. If you block them, the Platform will not work.
7.2.
Functional. Used to remember choices such as language or display settings. We do not use them.
7.3.
Analytics. Used to count visits and understand how pages are used. We do not use them on the Platform or, at present, on the Website.
7.4.
Advertising or tracking. Used to follow you across sites to show ads. We do not use them anywhere and we do not allow third parties to place them.

8. FIRST-PARTY AND THIRD-PARTY COOKIES

8.1.
The Platform sets only First-party Cookies, which belong to our own domain.
8.2.
We do not allow third-party advertising or tracking scripts in the Platform. The Content Security Policy that we set limits where scripts can load from, so that the Platform cannot load code from an unapproved source.
8.3.
If a Sub-processor or a payment page, such as the page of our payment gateway, sets its own Cookie when you use it, that Cookie is governed by that provider’s policy, and we will say so at the point where you leave our domain.

9. HOW OUR SESSION COOKIES ARE PROTECTED

9.1.
Secure. The Cookie is sent only over an encrypted HTTPS connection.
9.2.
HttpOnly. The Cookie cannot be read by scripts in your browser, which limits theft through malicious code.
9.3.
SameSite. The Cookie is not sent with requests that come from other websites, which helps prevent forged requests.
9.4.
Limited lifetime. A session ends after 30 minutes of inactivity or 12 hours in total.
9.5.
Sign-out. A password change signs you out on every device, and the Cookie is invalidated on the server when you sign out.

10. CONSENT AND YOUR CHOICES

10.1.
When we ask. We ask for your consent before we set any Non-essential Cookie. We will not set one before you agree.
10.2.
How we ask. Our banner, if we use one, will: describe each purpose in plain language; give “accept” and “decline” buttons of equal prominence; not use pre-ticked boxes; not make access to the Website depend on accepting Non-essential Cookies; be available in English [and in the Eighth Schedule languages we make available]; and link to this Policy and the Privacy Policy.
10.3.
Withdrawing consent. You may change or withdraw your choice at any time through the cookie settings link in the footer of the Website. Withdrawal is as easy as giving consent. It does not affect what we did before you withdrew.
10.4.
Records. We keep a record of your consent choice, with its time and the version of the banner shown, as long as we need it to show that we respected your choice.
10.5.
Browser controls. Most browsers let you view, block and delete Cookies, and clear them when you close the browser. The steps differ by browser, so please check your browser’s help pages. Blocking Strictly Necessary Cookies will stop sign-in from working, and deleting them signs you out.
10.6.
Browser signals. We do not track you across sites, so a “do not track” or similar signal does not change what we do.

11. PERSONAL DATA AND YOUR RIGHTS

Strictly Necessary Cookies hold a session identifier and security tokens. They do not hold your name or contact details. If Cookies or related data give us Personal Data that we hold as Data Fiduciary, the rights described in the Privacy Policy apply, including review, correction, erasure and withdrawal of consent, and you may use the Grievance Redressal Policy to exercise them.

12. COOKIES AND SERVER LOGS ARE DIFFERENT

12.1.
Cookies live on your device. Server logs live on our systems.
12.2.
Our servers keep Security Logs that record sign-ins, failed sign-ins, uploads, downloads, filings, assignments and account changes, with the user, timestamp, IP address, and device and browser details. They are not Cookies, and you cannot switch them off by changing your browser settings.
12.3.
We keep Security Logs for one year in India to secure the Platform, to keep the audit trail, to investigate misuse, and to meet the log retention that the CERT-In Directions and Applicable Data Protection Law require. We do not use them for marketing or profiling.

13. CHILDREN

The Platform and the Website are business tools and are not directed at children. We do not knowingly set Cookies to track or profile anyone under 18, and we do not direct advertising at children.

14. CHANGES TO THIS POLICY

We update this Policy if our Cookies change or if the law changes. We publish the new version with its effective date. If a change adds a Non-essential Cookie, we ask for your consent as clause 10 describes before we set it. Material changes are notified to Clients through the Platform or by email.

15. GRIEVANCES AND CONTACT

Questions or complaints about Cookies go to the Grievance Officer, Think and Scale (YTS Labs): [name], [grievance@ytslabs.com], [phone], [address]. Our Grievance Redressal Policy explains how we handle them and what to do if you are not satisfied, including your right to approach the Data Protection Board of India from the DPDP Commencement Date.

16. GOVERNING LAW

This Policy is governed by the laws of India. Disputes are resolved as the Terms of Use provide, and nothing here limits your rights under Applicable Data Protection Law.

Questions or concerns about this policy? Our Grievance Officer is here to help, as set out in the Grievance Redressal Policy.

Back to HRxBoard
Cookie settings

We use only strictly necessary cookies, which keep the HRxBoard platform secure and signed in. This website does not set analytics, advertising or other non-essential cookies, so there is nothing to switch on or off here. If that changes, we will ask for your consent first.

Strictly necessaryAlways on
Analytics, advertising and other non-essential cookiesNot used
Read the Cookie Policy