Privacy Policy

Who is the data controller?

Your Organisation controls the employment data collected through the App — they decide who is enrolled, and can approve, edit, or remove accounts. We (the App developer) process this data on the Organisation's behalf.

Information we collect

• Account details: name, mobile number, and/or email, employee code, designation, department, and assigned work location/shift.
• Location at check-in and check-out:your device's precise location is read when you check in or check out, to confirm you are at your assigned work location. The location of each check-in and check-out is sent to our servers and stored with that attendance record. With it we store how accurate that reading was (the GPS accuracy, in metres) when the device reports it — the web page does, and the App does from version 2.23.1 — and, from app version 2.23.1, whether the phone's developer options were turned on. Both help your Organisation check that a location reading is genuine.
• Location while you are checked in (Out Time): between check-in and check-out, the App uses your location in the background — including when the App is closed or not in use — to record when you leave your work location and when you return. On Android this uses the Android Geofencing API (Google Play services): your device watches a boundary around your work location and tells the App only when you cross it. The App does not record your route or track where you go. Background location starts only when you check in and stops when you check out; on Android it is required to check in. While it is active, and if you allow notifications, a notification shows that you are checked in, and you are notified each time you leave or return.
• Out Time records:the times you left and returned while checked in are used to calculate your Out Time and in-office time. Up to app version 2.23.0 they are kept only on your device. From app version 2.23.1, those times are also sent to our servers and stored with that day's attendance record, so that your Organisation sees the same Out Time you do; only the times are sent, never your route or where you went. A log of these site exit and return events is kept on the device for up to 7 days.
• Camera / photos: a selfie photo is captured at each check-in/ check-out for verification, and you may optionally set a profile picture.
• Attendance & leave records: check-in/out timestamps, working hours, leave applications and approvals.
• Technical data: like any online service, our servers receive standard request data such as your IP address when the App connects. The App does not collect advertising IDs or other device identifiers, its notifications are created on your device (no push-notification token is collected), and it contains no third-party advertising or analytics SDKs.
• Maps: map screens load map images from Esri (ArcGIS) and OpenTopoMap. As with any online map, these services receive the area of the map being shown and your IP address; they do not receive your account or attendance details.

How we use this information

Solely to operate the attendance system: verifying and recording check-in/out, recording Out Time while you are checked in, computing working hours and leave balances, and letting your Organisation's managers/admins review and approve records. Location is not used for advertising, profiling, or any purpose other than attendance.

Where data is stored

Account, attendance, check-in/check-out location, and photo data is stored on servers operated for your Organisation. Out Time records are kept on your device and, from app version 2.23.1, also on these servers, as described above. We do not sell your data, and we do not share it with third-party advertising or data-broker services. Photos are stored on our own servers (not a third-party media host).

Security

• In transit: all communication between the App and our servers uses HTTPS (TLS).
• At rest on the device:your session token and profile are stored using the operating system's secure storage (Android Keystore / iOS Keychain) where the device supports it. Passwords are never stored on the device.
• On our servers:passwords are stored as one-way hashes. If your Organisation's administrator sets a password for you (for example when they create your account or reset your password), an encrypted copy of it is also kept so that they can tell it to you; if you later change that password, the copy is updated, and it is deleted when your account is closed. Photos are stored under random, unguessable file names, and the App and dashboard show attendance records and photos only to users permitted to see them.

Data retention

Attendance and employment records may be retained for the duration of your employment/engagement and for a period afterward as required by applicable labour, tax, or record-keeping regulations. Location and photo data tied to a specific attendance record is retained for as long as that record is kept, for the same reason. Out Time records and the log of site exit and return events are kept on your device for up to 7 days, and are removed if you uninstall the App. From app version 2.23.1, the Out Time sent to our servers is kept with the attendance record it belongs to, for as long as that record is kept.

Your rights & deleting your data

You can request deletion of your account and personal data at any time, either:

• In the App: Settings → Danger zone → "Request account deletion", or
• On the web, without needing the App or to sign in: Submit a deletion request.

Requests are reviewed by your Organisation's administrator and actioned promptly, subject to the retention obligations described above — where full deletion isn't immediately possible for that reason, we will let you know what is retained and for how long.

When your account is closed, for example after a deletion request, it can no longer be used to sign in, and its email address, mobile number, profile picture and any password copy are removed. Your name, employee code, attendance records (with their photos and locations), leave requests and form submissions are kept, as described under Data retention.

Permissions the App requests

• Location (precise, and "Allow all the time" on Android): verifying check-in/check-out and recording Out Time while you are checked in, as above. Required for checking in. The App explains this before your device asks for the permission.
• Camera: attendance selfie and profile picture capture.
• Notifications: your checked-in status, Out Time alerts, and, for managers, new approval requests. Optional.

Each is requested when the related feature is first used, and you can review or revoke them at any time in your device's Settings for this App. If you remove background location while checked in, the App stops recording Out Time and shows how to turn it back on. The App does not access your microphone, contacts, or files.

Children's privacy

The App is a workplace tool for employed staff and is not directed at, or knowingly used by, children.

Changes to this policy

We may update this policy as the App changes. Material changes will be reflected by updating the "Last updated" date above.

Terms of Use

Use of the App is also governed by our Terms of Use.

Contact us

Questions about this policy or your data: d.ghosh@fitechitsol.in