Privacy Policy

1) Data Roles (Controller vs. Processor)

The company or legal entity that licenses and uses the Service is the **Data Controller** of its employees' data (e.g., your company). Attendify Vision acts as a **Service Provider/Processor**, providing the hosting and functionality on behalf of the Controller.

If you are an employee and need to exercise your data rights, you should contact your employer. We will support the Controller in fulfilling these requests.

2) Scope of Policy

This policy applies to the **Attendify Vision Flutter mobile app** (used by employees for attendance, including on-device liveness and face verification) and the **Admin Panel** (the web-based console for managing employees and attendance).

3) Information We Collect

Account & Profile Data

• Employee identifiers such as ID number, name, designation, date of birth, contact number, and email.
• The employer-provided profile photo, uploaded by an authorized admin.
• Company information, job assignment, roster, and role data.

Attendance & Operational Data

• Check-in/out metadata, including timestamp, geolocation, method used (e.g., FACE, QR), device information, and the pass/fail match result.
• Geofencing coordinates and radius defined by the employer to validate presence.
• Data related to Supervisor Assist, including the supervisor's ID and reason for assistance (no face images are stored).
• Attendance events queued locally in offline mode until an internet connection is restored.

Device & App Diagnostics

• Device model, OS version, app version, language, and network type.
• A hashed device identifier for device binding, which helps prevent unauthorized sign-ins.
• Optional crash logs/diagnostics and aggregate, de-identified operational metrics, if enabled by the employer.

Face Data & Liveness

• The employer-provided profile photo is stored in the cloud for identity verification.
• Live camera frames used for liveness and comparison are processed on-device and immediately discarded after the match decision.
• We **do not** collect or store facial templates, embeddings, or any other form of biometric data derived from the live camera feed.

4) How We Use Information

Core Operations

• To verify identity at check-in by comparing the live subject to the stored profile photo.
• To confirm liveness to prevent spoofing.
• To enforce geofenced attendance rules and company policies.
• To maintain attendance records (storing only the pass/fail result and operational metadata).
• To support features like Supervisor Assist and offline check-ins.

Administration & Security

• To authenticate users and manage roles and permissions.
• To create audit trails of admin actions for security and compliance.
• To prevent fraud and abuse through features like device binding.
• To provide support and improve the Service's quality.

We do not use your data for advertising, third-party marketing, or for training our models.

5) Legal Basis for Processing

Where laws like GDPR apply, our processing relies on:

• **Contractual necessity:** To provide the attendance Service.
• **Legitimate interests:** For security, fraud prevention, and service improvement.
• **Legal obligations:** To comply with employment and labor laws.
• **Consent:** Where required by local law (e.g., for mobile OS permissions).

6) Data Storage & Sharing

We use **Google Firebase / Google Cloud** for hosting, authentication, and data storage. They act as our sub-processor, storing profile photos and other data in a secure, encrypted environment. We do not share face images, biometric data, or personal information with third parties for their independent use.

A current list of any additional sub-processors is available to the employer (Controller) upon request.

7) Data Retention

8) Face Data Policy

This section outlines our explicit face data policy, as required by platforms like Apple:

• We do not retain live face data from the check-in process.
• The only stored "face data" is the employer-provided profile photo, which is used solely for identity verification and is retained only while the account is active.
• No face images or biometric templates are shared with third parties.

9) Cookies & Local Storage

• **Mobile App:** Uses secure local storage for session tokens, offline data, and preferences. It does not use third-party tracking SDKs for ads.
• **Admin Panel (Web):** Uses strictly necessary cookies and local storage for authentication and UI preferences. It does not use third-party advertising or cross-site tracking cookies.

10) Security Measures

We employ a range of security measures, including:

• Encryption for data both in transit (TLS) and at rest.
• Role-based access control (RBAC) to ensure a least-privilege approach.
• Regular patching, audit logging, and anomaly detection.
• Data is partitioned per company to prevent unauthorized access between tenants.

11) International Data Transfers

Data may be processed in the configured Firebase region (e.g., Europe, US, Middle East) and other Google Cloud locations. We rely on appropriate safeguards, such as Google's internal commitments and standard contractual clauses, to protect data as required by law.

12) Your Rights

You may have rights to access, correct, delete, or restrict the processing of your personal data, depending on your jurisdiction. Employees should contact their employer directly to exercise these rights. Admins or other visitors can contact us using the information in Section 15.

13) Children’s Privacy

The Service is intended for workplace use and is not for children under 16. We do not knowingly collect personal data from children.

14) Changes to this Policy

We may update this policy to reflect changes to our practices or for legal compliance. Material changes will be communicated to employers (Controllers) and posted on this page with a new effective date. Your continued use of the Service after the effective date constitutes your acceptance of the new terms.

15) Contact Us

Attendify Vision TECHNOLOGY SOLUTIONS L.L.C S.P.C
Email: contact@attendifyvision.com
Phone: +971 52 703 9720