Privacy Policy

Attenzo is used by organizations to manage their employees' attendance and leave. For employee data, the organization that created the account decides what is collected and why, and we process that data on its behalf to run the service. If you are an employee and have a question about your attendance data, your employer is your first point of contact. We are directly responsible for the data we hold about organization administrators, billing and the website itself.

• Account details: name, email address, role, shift and organization name, and an optional profile photo or organization logo.
• Attendance data: sign-in and sign-out times, work hours, leave requests and balances, regularization and comp-off requests.
• Location: your device's coordinates and the address derived from them, captured at the moment you punch in or out to check you are inside an allowed area. We do not track your location continuously or in the background.
• Selfie images: a photo taken at the moment of punching to confirm identity, when your organization has this feature turned on.
• Billing records (administrators): plan, number of seats, amounts, dates, and the Razorpay order and payment reference numbers. We never see or store your card, UPI or bank details; they are handled entirely by Razorpay.
• Technical data: IP address, browser type, device and operating system, used for security and to keep the service working.
• Messages you send us: details submitted through the contact form or email.

• To provide attendance, leave and reporting features and to verify punches by location and selfie.
• To create and secure accounts, including login, password reset and bot protection.
• To process payments, activate plans and send billing receipts and renewal reminders.
• To send service emails such as account creation, one-time passwords and plan expiry notices.
• To fix problems, prevent misuse and improve the service.
• To meet legal, tax and accounting obligations.

We do not sell personal information and we do not use attendance, location or selfie data for advertising.

Within an organization, data is visible according to role: administrators and managers can see their team's attendance, and employees see their own. Beyond that, we share data only with service providers that help us run Attenzo, under their own terms:

• Razorpay for payment processing.
• Cloudinary for storing selfie, profile and logo images.
• Google reCAPTCHA to block automated abuse on sign-up, login and contact forms.
• Our hosting and email providers to run the servers and deliver emails.

We may also disclose information when required by law or a valid legal request, or to protect the rights and safety of our users and service.

We use a secure session cookie to keep you signed in, which lasts up to 30 days or until you sign out, and basic browser storage for small preferences such as dismissing the install prompt. Google reCAPTCHA sets its own cookies when it runs. We do not use advertising cookies.

Traffic is encrypted in transit (HTTPS), passwords are stored hashed rather than in readable form, and access to each organization's data is limited by role. No online service can promise perfect security, so please use a strong password and sign out on shared devices. If we learn of a breach affecting your data we will notify the affected organizations and, where required, the authorities.

We keep data while the organization's account is active. When an organization asks us to delete its account, we delete or anonymize its attendance, location and selfie data within 30 days, except for billing records, which we keep for as long as tax and accounting law requires.

Under applicable Indian law, including the Digital Personal Data Protection Act, 2023, you may:

• ask what personal data we hold about you and how it is used;
• ask us to correct inaccurate data;
• ask us to delete your data, subject to legal retention duties and your employer's own records;
• withdraw consent where processing is based on consent, and raise a complaint about how your data is handled.

Email support@attenzo.net from the address on your account. We aim to respond within 30 days. This email is also our grievance contact.

Organizations that turn on location and selfie checks are responsible for telling their employees what is collected and why. If you are an employee and were not told, please ask your employer.

Attenzo is for workplaces and is not intended for anyone under 18. We do not knowingly collect data from children and will delete it if we find we have.

We may update this policy. The latest version is always at www.attenzo.net/privacy with the date above. For material changes we will notify administrators by email.

Questions about this policy: support@attenzo.net or our contact page.