Privacy Policy

Stafrix is software for recording attendance, managing leave and calculating payroll. It is sold to businesses (“Customers”) and used by their administrators and managers (“Admins”) and their employees (“Employees”) through our website, web app and installable app.

This policy covers personal data of:

• Visitors to our website.
• Admins, the people who sign up for and manage a Customer’s Stafrix account.
• Employees whose records a Customer keeps in Stafrix, including those who use the employee portal.

It does not cover how a Customer uses the reports, payslips or exports it downloads from Stafrix. That is governed by the Customer’s own policies.

Who is responsible for your data depends on why it is processed:

These features are built to collect as little as possible:

• Location is read only when you swipe to check in or out, to confirm you are within the radius your employer has set around the workplace. Stafrix does not track your location at any other time and does not run in the background.
• Your browser asks your permission before sharing location. If you refuse, check-in from your phone will not work, and your employer can record your attendance another way.
• Selfies are taken only if your employer turns them on, and only at the moment of checking in or out. They are stored privately and can be opened only from inside your organization’s dashboard, through links that expire. They are never public.
• We do not use facial recognition or create biometric templates from selfies. A photo is kept as a photo, for a person at your organization to look at.

We use personal data only for these purposes:

• Providing Stafrix

  What it involves

  Recording attendance, applying shifts and rules, managing leave, calculating payroll, producing payslips and exports, and showing all of it to the right people.

• Accounts and sign-in

  What it involves

  Creating accounts, verifying sign-ins (password, SMS code or Google) and keeping you signed in.

• Support

  What it involves

  Answering questions and fixing problems you report.

• Billing

  What it involves

  Invoicing, collecting payment and keeping accounting records.

• Security and integrity

  What it involves

  Preventing fraud and misuse, keeping audit logs, investigating incidents and keeping records required by law.

• Improving the service

  What it involves

  Understanding how features are used, from technical logs and aggregated, de-identified statistics. We never use Customer Data to build products for other companies.

• Legal obligations

  What it involves

  Meeting tax, accounting and other legal requirements, and responding to lawful requests from authorities.

We do not use personal data for advertising, we do not sell or rent it, and we do not make automated decisions about anyone that have legal effects. Payroll and attendance results are calculated from rules the Customer sets, and the Customer reviews them.

• Employee records: Customers process employee data for employment purposes, a legitimate use permitted without consent under section 7(i) of the DPDP Act, or on the basis of consent they obtain where needed. The Customer is responsible for giving Employees the notice the law requires and for any consent, including for selfies.
• Admin accounts and billing: your consent when you sign up and use Stafrix, and the processing needed to provide the service you asked for.
• Security and legal records: compliance with the Information Technology Act, 2000, the CERT-In Directions of 28 April 2022, tax laws and other applicable law.

Where we rely on your consent, you can withdraw it at any time by writing to us or by closing your account. Withdrawing does not affect processing that already took place, and some features may stop working.

Our database and application servers are located as shown in the provider table above. Some providers, such as our website host and Google, process data in other countries. Section 16 of the DPDP Act permits such transfers except to countries the Government of India restricts by notification. We will not transfer personal data to a restricted country, and we require every provider to protect data to the standard of this policy wherever it is processed.

We keep personal data only for as long as the purpose needs it, or as long as the law requires:

• Customer Data (employee records, attendance, leave, payroll)

  How long

  For as long as the Customer keeps it in Stafrix. After an account closes: available for export for 30 days, then deleted within 90 days.

• Check-in selfies

  How long

  As long as the attendance record they belong to, or until the Customer deletes them.

• Admin account details

  How long

  While the account is open, then deleted within 90 days of closure.

• Audit log

  How long

  12 months, then deleted automatically.

• Server and security logs

  How long

  At least 180 days, as the CERT-In Directions require, and as the DPDP rules require; generally not more than one year.

• Sign-in sessions and SMS codes

  How long

  Sessions expire after 7 days. SMS codes expire within minutes and work only once.

• Billing and tax records

  How long

  As long as tax laws require, typically 8 years.

• Backups

  How long

  Overwritten in their normal cycle, typically within 30 days of deletion from the live system.

We use reasonable security safeguards, as section 8(5) of the DPDP Act requires, including:

• Encryption of every connection to Stafrix (HTTPS/TLS).
• Strict separation of each Customer’s data, enforced on every database request.
• Passwords stored only as strong one-way hashes, never as readable text.
• Role-based access within each organization, with salaries and bank details limited to admins.
• An audit log of who changed attendance, pay and rules, and when.
• Private storage for photos and selfies, opened only through short-lived signed links.
• Limited access to production systems for our own staff, on a need-to-know basis.
• Regular backups, monitoring and prompt security updates.

No system is perfectly secure. Please use a strong, unique password, keep your devices locked, and tell us at once if you suspect misuse of your account.

If a personal data breach occurs, we will act to contain it and will inform affected Customers without undue delay, so that they can meet their own obligations. Where we are the Data Fiduciary, we will inform the Data Protection Board of India and each affected person as the DPDP Act and its rules require. We report cyber security incidents to CERT-In within the time its Directions set, currently six hours.

Under the DPDP Act you have the right to:

• Know what personal data is processed, a summary of the processing, and with whom it has been shared (section 11).
• Correct, complete, update and erase your personal data, unless the law requires it to be kept (section 12).
• Have your grievance heard and answered promptly (section 13).
• Nominate someone to exercise your rights if you die or become unable to (section 14).
• Withdraw consent where processing is based on it (section 6).

Employees can see much of their own data in the employee portal and can ask their employer to fix attendance through a missed-punch request. For anything else, ask your employer, who controls your records; we will help them. Admins can correct or delete most data themselves, or write to us.

We will verify your identity before acting on a request, and we will respond within the period the law allows. If you are not satisfied with our answer, you may complain to the Data Protection Board of India, after first using our grievance process (section 13(3)). The DPDP Act also asks you not to file false or frivolous complaints (section 15).

Stafrix is meant for businesses and adults. We do not knowingly collect data from anyone under 18 for our own purposes. A Customer that employs an adolescent, where the Child and Adolescent Labour (Prohibition and Regulation) Act, 1986 permits it, must obtain verifiable consent from a parent or lawful guardian as section 9 of the DPDP Act requires before adding their records, and must not enable selfies for them. If you believe a child’s data has been added without that consent, please contact us.

Stafrix uses only what it needs to work:

• Your browser’s local storage keeps your sign-in session, your light or dark theme, and small preferences such as tips you dismissed.
• When you install the app, a service worker keeps a copy of the app’s screens so it can open without a connection. It does not store attendance or pay data.
• We count page views with Vercel Web Analytics, which uses no cookies and keeps no personal identifiers. Record ids are removed from page addresses in your browser before anything is sent.
• On our public website and the sign-up page only (not sign-in, the dashboard, the employee portal or the app), we use Google Analytics to see which pages people visit and how they found us. It sets cookies named _ga that recognise a returning browser for up to two years. Google signals and ad personalisation are switched off, so this data is not used for advertising. You can block these cookies in your browser settings or with Google’s opt-out browser add-on.
• When you create a workspace, our server tells Google Analytics, against that same random identifier (or, if you signed up in the Android app, the app’s own analytics identifier described below), when the workspace reaches steps such as signing up, adding its first employee, its first check-in and paying for a plan, with the plan and amount. These events carry no names, email addresses or anything you type into Stafrix. They show us which pages and campaigns lead to customers.
• The Stafrix Android app uses Google Analytics for Firebase to see how the app is used: when it is opened, which screens are viewed, and steps such as starting a sign-up or choosing a plan. It uses a random identifier for the app on your phone and your phone’s advertising ID, which show us which app-store listings and ad campaigns lead to installs and new customers. Ad personalisation is switched off, and these events carry no names, email addresses, phone numbers or anything you type into Stafrix. You can reset or delete your advertising ID in your phone’s settings (on most Android phones: Settings → Google → Ads).
• We also keep our own record of the same steps on our servers, including visits to our public website and the sign-up page: a random identifier kept in your browser’s local storage, the page, the site or campaign you came from, your country and the kind of device. It isn’t a cookie, and it doesn’t include your IP address, name or email address. We delete it after about 13 months.
• We do not use advertising cookies or advertising pixels, and the app, the dashboard and the employee portal set no tracking cookies at all.
• If you choose “Sign in with Google”, Google may set its own cookies on its own website, under Google’s privacy policy.

Clearing your browser data signs you out and resets these preferences.

If you are in the European Economic Area, the United Kingdom or Switzerland, the GDPR or its UK and Swiss equivalents may apply. There, we process Admin and billing data to perform our contract with you, for our legitimate interests in running a secure service, and to meet legal obligations. Customers remain the controller of Employee data and we act as their processor. You have the rights those laws give, including access, rectification, erasure, restriction, portability and objection, and you may complain to your local supervisory authority. Where personal data leaves those regions, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

Where other privacy laws apply to you, we will honour the rights they give.

We may update this policy as Stafrix or the law changes. The date at the top shows when it last changed. If a change materially affects how we handle your data, we will tell Admins by email or in the app at least 15 days before it takes effect.

For questions about privacy or to exercise your rights, write to support@stafrix.com.

See also our Terms of Service and how we keep data safe on our Security page.