Privacy Policy

1. Introduction

Elixir Attendance is an employee attendance and workforce management application for Android, with this website. It is provided by Elixir Infotech (“we”, “us”). This Privacy Policy explains what information the app and website collect, how it is used, where it is stored, how it is protected and how it is deleted.

Elixir Attendance is used by organizations (for example, employers) to record their employees' attendance. The organization decides whom to register, which features to turn on and how long to keep records, and it is responsible for informing its employees and obtaining any consent the law requires. We process the data to provide the service to that organization.

2. Information we collect

A. Organization information

• Organization name, contact number and employee-size range, entered at registration
• The organization's configuration: shifts, work calendars and holidays, departments, punch style, location settings and cloud-sync setting

The registration screen can also ask for an organization logo (optional). A chosen logo is kept on the phone. The app is designed to copy it to Firebase Cloud Storage, but cloud storage is not enabled for the service, so no logo is currently stored in the cloud. This policy will be updated before that changes.

B. Administrator account

• Administrator name and email address
• Sign-in credentials, handled by Firebase Authentication. We never see or store the administrator's password in our database.
• Whether the email address has been verified
• Account status, including any pending deletion request and its dates

So that an administrator can take a kiosk back from attendance-only mode while offline, the phone keeps a salted, one-way hash of the administrator's password. It never leaves the phone.

C. Employee information

Entered by the organization's administrator:

• Employee code, name and mobile number
• Optional: email address, department, designation and joining date
• Shift and work-calendar assignment, and whether the employee is active
• An optional employee password, stored on the phone only as a salted one-way hash
• Face template and enrolment photo (see section 3)

D. Attendance information

• Each punch: type (in, out, break start, break end), date and time
• How it was verified (for example, face and liveness) and where it came from (the kiosk, or an administrator's correction)
• The shift in force at the time
• When location is enabled: the location of the punch (see section 5)
• The phone's manufacturer and model
• Corrections, voided punches, locked periods and the audit trail of who changed what, when and why

From these, the app calculates attendance status, working hours, late coming, early going, overtime, half days and missing punches.

E. Attendance-only user

If an administrator creates an attendance-only user, the phone stores that user's name, login ID, optional mobile number and a salted one-way hash of their password. This stays on the phone.

F. Device and diagnostic information

Crash reports and usage statistics, described in section 7.

3. Face recognition and biometric information

The app uses face recognition to verify employees when they record attendance. Face data is biometric information, and we treat it with particular care.

• At registration, the phone's camera captures the employee's face. The app creates a face template, a set of numbers describing the face, and keeps an enrolment photo so the administrator can see who is registered.
• Kept on the phone. The face template and enrolment photo are stored only in the app's private storage on the phone where the employee was registered. They are never uploaded to our cloud. An administrator on a paid plan can export them, encrypted, in a backup file the organization keeps itself (Settings, Backup & restore). We never receive that file, and the organization decides where it is stored. The cloud copy of an employee records only whether a face is registered and when. Our cloud access rules reject any record that tries to include face data.
• At a punch, camera frames are analysed on the phone in real time to find a face, run a liveness check against photos and screens, and compare the face with the templates on that phone. The frames are not saved and not uploaded.
• Purpose. Face data is used only to verify identity for attendance. It is not used for advertising, profiling or any unrelated purpose, and it is not sold or shared.
• Access. Face templates are not viewable in the app. The enrolment photo is visible to the organization's administrator on that phone.
• Deletion. Deleting an employee, or registering their face again, removes or replaces their face data on that phone. When an organization's account is permanently deleted, each phone removes its copy, face data included, the next time it opens the app online.

Because face data is not backed up to the cloud, employees must register again on a new or replacement phone.

4. Camera

The app asks for camera access to register employees' faces and to recognise them when they punch, including the liveness check. Camera images are processed on the phone. Apart from the enrolment photo described above, they are not stored, and they are never uploaded.

5. Location

Location is optional and off by default. The app asks for location permission only when an administrator turns on location for punches.

• When on, the app reads the phone's location only while a punch is being recorded. It does not use background location and does not track anyone between punches.
• The punch stores the coordinates, their accuracy and, where available, a street address and the workplace name. The address is looked up with the phone's geocoding service (provided by Google), which receives the coordinates for that purpose.
• An administrator can define a workplace area. Punches can then be checked against it.
• Instead of GPS, an organization can use a named location, such as “Head office”. It is recorded on each punch without reading the phone's location at all.
• With cloud sync on, the location stored with a punch is included in the cloud copy of that punch.

6. Where information is stored, and cloud sync

On the phone

All of the information above is stored in the app's private storage on the phone. Each organization that signs in on a phone has its own separate database and settings. The app disables Android cloud backup, so this data is not copied into personal device backups.

In the cloud

So that records survive a lost or replaced phone, the following are stored in Google Firebase under the organization's own account:

• The organization and administrator details in section 2A and 2B. Until the administrator's email address is verified, these registration details are held in a pending record; it is deleted when the organization is created, and a registration left unverified for 7 days is deleted together with its sign-in account.
• Employee details in section 2C, without face data or passwords
• Shifts
• Attendance punches in section 2D, including location when enabled

Cloud sync of employees, shifts and punches is on by default and can be turned off by the administrator in Settings. Work calendars, holidays, departments, locks, the audit trail, the attendance-only user and face data are stored only on the phone.

Offline operation

Attendance is recorded on the phone first and does not need a connection. When the phone is back online, pending records are uploaded. Nothing is uploaded while offline.

A phone keeps about two months of punch history. Older punches that the cloud already holds are removed from the phone automatically; with cloud sync off, older punches are removed from the phone after that period. Locked attendance periods are never removed automatically.

7. Diagnostics and usage statistics

To find and fix problems, the app uses:

• Firebase Crashlytics: crash and error reports, with the app version, device model, operating-system version, the screen in use and a general error category.
• Google Analytics for Firebase: counts of app events such as sign-ins, registrations, punches, reports and setting changes, with general categories such as punch mode or failure type.

These are collected without employee names, faces, attendance records or locations. We do not set a user identifier in them. The advertising ID is not collected, the app shows no ads, and it contains no advertising SDKs.

8. How we use information

• Create and manage organization accounts, and verify administrator email addresses
• Sign administrators in and keep accounts secure
• Manage employees and register their faces
• Verify identity and record attendance
• Calculate working hours and attendance status using shifts and work calendars
• Produce reports and exports for the organization
• Back up and restore the organization's data when cloud sync is on
• Help prevent attendance fraud, for example with the liveness check
• Diagnose crashes and improve reliability
• Process account deletion requests and answer support requests

We do not use this information for advertising or marketing, and we do not sell it.

9. Legal basis and consent

Depending on where the organization operates, information may be processed to provide the service the organization requested; with consent where the law requires it, notably for biometric data; to comply with legal obligations; and for legitimate operational and security purposes, such as preventing attendance fraud and diagnosing faults.

The organization is responsible for informing its employees about face recognition and location, and for obtaining their consent where required, before registering them.

10. Sharing of information

• Within the organization: the organization's administrator can see its employees and attendance. An attendance-only user can use only the punch screen.
• Service providers: Google provides the infrastructure listed in section 11, and processes data on our behalf to run the service.
• Legal requirements: we may disclose information if required by law or a valid legal request.

We do not sell personal information and do not share it with third parties for their own marketing.

11. Third-party services

Face detection, face recognition and the liveness check run entirely on the phone, without any online service. Google's privacy information: policies.google.com/privacy and firebase.google.com/support/privacy.

12. Separation between organizations

Each organization's information is kept separate. An organization cannot see another organization's employees, attendance, face data, shifts, calendars, reports or settings, on the phone or in the cloud. When several organizations use the same phone, each has its own separate storage, and only the organization that is signed in can open its own.

13. Security

We use reasonable technical and organizational safeguards, including:

• Sign-in through Firebase Authentication, with email verification
• Cloud access rules that limit each organization to its own records
• Encrypted connections between the app and the cloud
• Face data kept out of our cloud, with cloud rules that reject face data, and backup files encrypted
• Passwords stored only as salted one-way hashes where the app keeps them
• Role-based restrictions for the attendance-only user
• An audit trail and locking for attendance corrections

No method of storage or transmission is completely secure. Organizations should protect the administrator password and the kiosk phone.

14. Data retention

• Account and cloud data are kept while the organization's account exists, and permanently deleted after an account deletion request takes effect (section 15).
• On the phone, punch history is kept for about two months, as described in section 6. Other data stays on the phone until it is deleted in the app or the organization's account is deleted.
• Face data is kept on the phone until the employee is deleted, their face is registered again, or the organization's account is deleted.
• Diagnostics are kept according to Firebase Crashlytics' and Google Analytics' own retention settings.

15. Account deletion

An organization's administrator can request deletion of the organization's account and data:

• in the app, under Settings › Delete account, or
• on this website at Account Deletion, by signing in with the organization's email and password.

Deletion is not immediate. The account is scheduled for permanent deletion 30 days after the request, and the app stops working for the organization in the meantime. Until that date the administrator can reactivate the account, in the app or on the website, and everything is kept as it was.

On the scheduled date, the organization's cloud data is permanently deleted: the organization profile, employees, attendance, shifts, the deletion history and the administrator's sign-in account. A record of the organization's identifier and the deletion date is kept so that phones still holding its data know to erase it. Each phone removes its local copy, face data included, the next time it opens the app online.

16. Employee data and requests

• Deactivating an employee keeps their details and attendance history.
• Deleting an employee in the app removes them, their face data and their attendance from that phone. It is refused while any of their attendance falls in a locked payroll period. The cloud copy of their details and past punches is kept until the organization's account is deleted, because attendance history can be needed for payroll and records. It can be removed earlier on request (section 18).
• Employees who want to access, correct or delete their information should contact their organization's administrator, who controls it. We will help the organization respond.

17. Children

Elixir Attendance is intended for organizations and their workforce. It is not directed at children, and we do not knowingly collect information from children through the website. Organizations are responsible for complying with the law when registering any young workers.

18. Your rights

Depending on where you live, you may have rights to access, correct or delete your personal information, to receive a copy of it, to object to or restrict certain processing, and to withdraw consent. Where an organization controls the information, we will pass your request to it or help it respond.

To make a request, email elixirinfotechindia@gmail.com. We may need to verify your identity before acting on it.

19. International processing

Our service providers may store and process information in countries other than your own, including where Google operates its data centres. We rely on those providers' safeguards for international transfers.

20. Changes to this policy

We may update this Privacy Policy as the app changes. The “Last updated” date at the top shows the latest version. We will take reasonable steps to highlight material changes, for example in the app or on this website.

21. Contact us

Elixir Infotech
Email: elixirinfotechindia@gmail.com

Request account deletion