Privacy

This page is for the companies that use Hajiri and for anyone reading it on the web. The notice for employees whose attendance is recorded is here.

Who is who

The company that employs your staff is the data fiduciary for that workforce data. We are its data processor: we run the software, on infrastructure in India, and act on the company's instructions. We do not use customer data for our own purposes.

What we process

• Staff names, phone numbers, email addresses and job titles.
• Salaries, attendance, leave and payroll figures.
• Check-in selfies, GPS coordinates, accuracy and distance at the moment of check-in.
• Where a company switches on face matching: a set of measurements derived from an employee's reference photo, and the resulting match score for each check-in. This is biometric data. It is computed on our own servers, is never sent to a third party, is never included in an export, and is only ever compared against photos within the same company. Face matching is off by default and only runs where a company asks for it.
• Account data for owners, managers and platform staff (name, email, password hash, sign-in times).

Retention

• Daily check-in photos: deleted automatically about 12 hours after capture.
• Reference photos: kept while the employee is on the roster, and deleted when they leave it. For staff already on the roster when a company switches face matching on, the first check-in selfie afterwards is retained as that reference instead of being deleted on the 12-hour TTL.
• Face measurements: deleted at the same moment as the reference photo they came from — when the employee exits, when a join request is rejected, or when a manager resets the photo.
• Check-in photos held for a manager to review after a failed face match: about three days, then deleted like any other photo.
• Attendance, leave and payroll records: kept while the company is a customer, so payroll history and statutory records survive.
• Photos are deleted when an employee record is removed or the company asks us to delete the account.

Security

Photos are private: they are served only to signed-in members of the same company, never from a public URL. Uploads are re-encoded and stripped of EXIF metadata, so a phone's hidden location stamp is not stored with the image. The platform console requires two-factor authentication, and every console action is written to the affected company's audit log.

Sub-processors

We keep this list short: our own servers and database (India), our email provider for invitations, receipts and password resets, and — when a company switches it on — an SMS provider for staff sign-in codes and a payment gateway for subscription payments. We do not send customer data to advertising or analytics networks.

Your rights

A company owner can download a full export of the organisation's data from Account → Your data, and can request deletion of the whole account from the same page. Deletion is confirmed with a human before anything is removed. Employees should raise requests with their employer first; we help the employer answer them.

Grievance officer

For any privacy question or complaint write to aphdtechnologies@gmail.com. We acknowledge within 72 hours and aim to resolve within 30 days, and we will tell you what we did.

Changes

When this notice changes meaningfully we email the owner of every organisation.