Privacy Policy

1. Who is responsible for the data

This matters more than it sounds, because it decides who a worker should ask about their own records.

If you are a worker and want to see or correct your records, ask your employer. If they cannot help, contact us and we will support them in answering you.

2. What the system records

About staff being checked in

• Name, staff number, phone number, grade and employment type
• The time of every sign-in and sign-out, as recorded by our servers
• The time the device claimed, kept separately — the two are compared
• GPS position, accuracy, and distance from the workplace
• Whether the device reported a faked location
• A photo taken at sign-in, where the employer requires one
• A face check result, where the employer has switched that on
• NFC tag identifiers and tap counters, where tags are used
• Bank name, account name and account number, where payments are made through the system

About people who sign in to the office screens

• Name, email address, phone number, role and whether the account is active
• Sign-in times and the actions taken — see “Records of who did what” below

Technical

• Device identifiers for the phones and tablets used to check people in
• IP address, browser/user-agent details and attempted login time for account security, rate limiting and investigations
• Session cookies needed to keep someone signed in — no advertising or tracking cookies are used

3. Face and photo data

A face check is biometric information. Under the Nigeria Data Protection Act it is treated as sensitive, which means it needs a higher standard of care than a name or a phone number.

• It is only collected where the employer has deliberately switched that method on
• The employer must obtain each worker's clear, written and freely given consent before enrolling their face, and must offer a workable alternative to anyone who refuses. Consent that is a condition of being paid is not freely given.
• Face and photo images are held on private storage and are never publicly reachable by a URL
• They are never sent to any outside service, and are never used to train any model
• They are used for one purpose only: confirming the right person signed in at the right place

4. Why the data is held

• To record attendance — the reason the software exists
• To work out pay — hours worked, and any deductions the employer has set out in writing
• To support an invoice — where the employer bills a client for hours worked at that client's premises
• To detect dishonesty — faked locations, reused tags, altered device clocks
• To settle a dispute — producing evidence when a client or a worker challenges what happened

5. Who else sees it

We do not sell data, and we do not share it for advertising. It is seen only by:

• The employer's own staff, limited by the role each of them has been given
• The employer's client, where the employer has switched on client access — and then only for that client's own sites
• Our hosting provider, which stores the database and files
• Message providers (SMS, WhatsApp, email), where the employer sends notifications. These receive a phone number or email address and the message text — never a photo, a location or an attendance record.
• Our platform staff, who can see account-level information — company name, plan, user list, usage counts — in order to run the service. They cannot sign in as a customer, and there is no impersonation feature in the product.

The assistant feature

Where an employer switches on the built-in assistant, a redacted version of the operator's question and a summary of that company's own figures are sent to DeepSeek to produce an answer. The application removes obvious email addresses, phone numbers and long account-like numbers before sending the question, but no automated redaction can guarantee that an operator has not described somebody in free text. Operators must not enter names, photographs, account details, addresses, health information or other personal details into the assistant. Workers' photographs, coordinates and individual attendance rows are not included in the generated briefing. DeepSeek receives the prompt over HTTPS under its own terms and privacy policy; if you do not want this transfer, leave the assistant switched off.

6. How long it is kept

The employer decides. As a guide, attendance records are usually kept for as long as a pay or billing dispute could still arise — commonly six years, matching how long employment and tax records are normally retained in Nigeria.

Photographs and face data should be kept for a much shorter period than attendance records, because they are far more sensitive and are only needed while a sign-in could still be questioned. Ask your employer what period they have set.

Login-attempt records are retained for the configured security window (90 days by default) and then pruned. Support-session and audit records may be retained longer where needed to investigate access to an account. The service does not currently promise a fixed automatic deletion period for every customer record: the employer remains responsible for setting a lawful retention schedule and requesting closure or erasure where appropriate.

7. Records of who did what

Attendance records are append-only. Once written they cannot be edited or deleted, and each is cryptographically linked to the one before it. That is the whole point of the product: a record nobody can quietly change afterwards, including us.

This has a consequence you should understand. Where a worker asks for their data to be erased, an attendance record that is evidence in a live pay or billing dispute may need to be kept until that dispute ends, and cannot be silently removed without breaking the chain that makes the rest of the records trustworthy. Where erasure is required and lawful, personal details are removed and the sealed record is marked as belonging to a removed person, so the chain still verifies. Photographs and face data can always be deleted outright.

8. Your rights

Under the Nigeria Data Protection Act you may ask to:

• See what is held about you
• Have anything wrong corrected
• Have data deleted, subject to section 7 above
• Withdraw consent for face checks, and be offered another way to sign in
• Receive a copy of your data in a form you can take elsewhere
• Object to a decision that affects your pay being made without a person reviewing it

On that last point: a flagged sign-in is always shown to a person to decide. The system never quietly docks pay on its own.

Ask your employer first. If they cannot resolve it, contact us, and you may also complain to the Nigeria Data Protection Commission.

9. How it is protected

• Passwords, worker PINs and device keys are stored only as one-way hashes and cannot be read back
• Bank account numbers are encrypted in the database
• Photographs are held on private storage and served only to a signed-in, authorised person
• Each company's data is separated, and the system refuses a query rather than guessing which company it belongs to
• Attendance records cannot be edited or deleted, and any tampering breaks a chain that can be replayed on demand

10. Account violations and automated action

The system may record suspected misuse such as repeated failed portal logins, replayed tags, fake-location signals, clock manipulation, or an unauthorised check-in method. These records are security and review records; a suspicion is not treated as proof. A configured attendance offence may create a pending payroll penalty, but it is not deducted until the employer reviews the payroll and the worker's applicable written policy. Terms-of-service violations can lead to access restrictions or account review, but the system does not automatically deduct wages for a terms violation.

11. Changes

If this policy changes in a way that matters, we will tell the companies using the software before it takes effect, so they can tell their staff.