Privacy policy

Who we are and what the app is for

The app records workers' clock in and clock out times. The employer opens the worker's account; the employer is the data controller, and we process data on the employer's behalf, only for time and attendance.

What data we process

The worker's name and the personal code assigned by the employer; clock in and out times and the clocking method; the phone's location once, only at the moment of clocking in or out, whether with the button, by scanning the QR code on the tablet or by tapping the NFC tag (a single point, never in the background and never movement); the NFC tag serial number or the tablet code when clocking that way; requests the worker sends to the employer. With the Premium plan the company tablet takes a photo at clocking, reviewed by a person; photos are deleted after 90 days.

What we do not do

We do not track movement, do not read location in the background, do not use fingerprints or face recognition, show no ads, and do not sell or share data with third parties for marketing. The app does not access messages, photos, contacts or other apps.

Phone permissions

Location: read once, only at the moment of clocking in or out (with the button, the tablet QR code or the NFC tag), so the employer can see the worker is at work; never in the background and never movement. Camera: scanning the QR code on the tablet or the invitation. NFC: reading the tag at the entrance. Any permission can be denied; the clocking is then recorded with a note or another method is used.

Phone check and fake location

To keep clockings reliable, the app runs two checks when you clock in or out:

• Phone check: the app asks Google Play (Play Integrity, Android) or Apple (App Attest, iPhone) to confirm that the app is genuine and the phone has not been modified. Google and Apple process app and device data for this under their own terms; with the clocking we keep only a note when the check fails.
• Fake location: the app detects when the phone reports a simulated location. Location is still read only once, at the moment of clocking; such a clocking gets the note "fake location" and does not count as proof that the worker was inside the area.
• Neither check prevents clocking: the clocking is always recorded, and the employer sees the note.

Assistant in the employer dashboard

The dashboard has an assistant based on artificial intelligence that answers the owner's and manager's questions about the company. The assistant is switched off until we switch it on. Workers and tablets have no access to the assistant.

• When it is on, the question the owner or manager writes and the company data the assistant reads to answer it (for example worker names, clock in and clock out times, schedules) are sent to the model provider, Anthropic, only to produce that answer.
• The assistant changes nothing on its own: it proposes a change, which is saved only when the user clicks Confirm, and this stays in the change log.
• A conversation is visible only to the account that had it. We do not read the content of conversations; we see only the number of messages and the cost.
• When the employer deletes a worker's personal data, the worker's name in conversations is replaced with "Obrisan radnik" (deleted worker).

Dashboard sign in

When a company registers, we send a code and a link to the email address to confirm that the address is yours. The owner and manager can turn on a second sign in step: a code sent by email when signing in from a new device, or a code from an authenticator app on the phone. For the authenticator app we keep the secret key the codes are calculated from and never give it to anyone.

Where data is stored and for how long

Data is stored on servers in the European Union or Serbia, encrypted in transit. Retention periods:

• Arrival and departure clockings and their corrections are kept while the company uses the service, because the employer is required by law to keep them as attendance records.
• The coordinates of the clocking place (latitude and longitude) are deleted after 13 months; the clocking itself remains, together with the mark of whether it was inside the location's area.
• Tablet photos (Premium plan) are deleted after 90 days.
• Password reset links are deleted as soon as they expire.
• Tablet pairing requests are deleted after 7 days.
• Temporary NFC tag learning is deleted as soon as it expires.
• Alerts in the notification center are deleted after 400 days.
• The change log (who changed what and when) is deleted after 3 years.
• An unconfirmed company registration (email address and the password in unreadable form) is deleted after 24 hours.
• Assistant conversations are deleted 90 days after the last message.
• The record of assistant calls, without conversation content (only the model, processing volume and cost), is deleted after 13 months.

Your rights and account deletion

Workers may see their data (in the app, My hours screen), request corrections (a request in the app) and request deletion. The employer opens and closes the worker's account, so deletion requests go to the employer; the employer contacts us through support in the dashboard and we carry out deletion within 30 days, except data the law requires to be kept.