Privacy Policy

This policy explains what Roznamcha: Attendance & Salary (formerly Attendance Manager) does with personal information. It is written in plain language on purpose. If anything here is unclear, write to roznamcha@asmlabs.in and we will explain it.

1. Who we are

Roznamcha is operated by ASM Labs, a sole proprietorship of Agam Singh Madaan, based in India. Throughout this policy, "we" and "us" mean ASM Labs.

Contact for anything in this policy, including privacy questions, requests and complaints: roznamcha@asmlabs.in. This is also the address for grievance redressal under India's Digital Personal Data Protection Act, 2023.

This policy covers the Roznamcha web application and the Roznamcha Android application, which are the same service.

2. Two different groups of people

This service holds information about two groups, and our responsibilities differ for each.

Account holders

People who sign in: business owners and the managers they add. Staff do not sign in. For their account information, we are the data fiduciary and this policy governs directly.

Employees recorded in the app

People whose attendance and salary a business records. That business decides what to record and why, so the business is the data fiduciary and we act as a data processor on its instructions. We do not decide what employee information is entered, and we do not use it for our own purposes.

3. What we collect

From account holders

Entered by a business about its employees

Technical information

• Google records sign-in activity, including approximate time and network address, as part of operating the sign-in system.
• To stop the sign-in email being misused, we count how many sign-in emails are asked for per email address and per network, for up to a day. These counts are stored only as a one-way code, never as the address itself.
• Our hosting provider records standard web-server information when pages load, including network address and browser type.

4. What we never collect

This list is deliberately specific, because "we respect your privacy" means nothing on its own. The app has no facility to collect any of the following:

• Phone numbers
• Aadhaar, PAN or any government identity number
• Bank account or card details
• Photographs of employees, fingerprints or any other biometric data
• Location or GPS data
• Your contacts, messages, call logs, files or camera
• Advertising identifiers

There is no analytics, no advertising and no advertising or analytics tracking in this application. We do not profile you, we do not build behavioural records, and we do not sell, rent or share personal information with anyone for marketing.

5. Why we process this information

• To run the service — signing you in, showing your organisations, saving attendance, calculating pay, producing reports and exports.
• To keep your data safe — backups you can restore yourself. New businesses start with weekly automatic backups, which you can change or switch off.
• To support you — answering questions you send to our support address.
• To meet legal obligations — where a law requires us to keep or produce records.

For account holders, the basis is your consent, given when you create an account, and the necessity of processing to provide a service you asked for. For employee records, the business that entered them is responsible for having a lawful basis.

6. Where your data is stored

Two qualifications, stated honestly. Google operates the sign-in system and may process sign-in and security information on its global infrastructure. Our website files are delivered through a content network with servers in many countries; that network serves the application's files and does not receive your attendance or salary data.

7. Who else is involved

When paid plans launch, a payment provider will handle the transaction on our website. Card details go to that provider and never reach us or this application. We will update this policy before that happens.

We do not sell personal information. We share it only with the providers above, or where the law compels us.

8. What is stored on your device

The app keeps some small items in your browser's storage on your phone or computer, only so that it works and remembers your choices. None of them is used for advertising, and the app uses none of them to track you. There are no advertising or analytics cookies. Your attendance and salary records are not kept here; they live in the database.

Sign-in

• Your signed-in session, kept by Google's sign-in system (Firebase), so you stay signed in until you sign out.
• The email address you asked a sign-in link to be sent to, until you use the link.
• A security check from Google (Firebase App Check, which uses reCAPTCHA) that confirms requests come from the real app. It keeps a short-lived pass and a small record of its own in your browser.
• A small record Google's Firebase components keep of the day they last told Google which of their versions the app uses. It holds nothing about you or your business.

Your choices and notices

• Which organisation you last had open.
• Whether you have answered today's working-day question.
• When your last change was saved, so the save status still shows after a reload.
• Whether you have seen a notice or the “What's new” message, so each is shown only once.
• When the backup reminder last appeared, so it does not repeat too often.
• That the one-time offer to mark everyone Present on a business's earlier days had nothing left to fill, so it is not offered again.
• In the Android app: which version of the app you have, and whether you closed the bar that asks you to update it. While you use the Android app, a flag for that visit only lets its pages hide the website's pricing links.

Daily reminders

If you turn on daily reminders, this device keeps a note that it is signed up and which time zone it is in. So that reminders can reach this device, our database also keeps its notification address (issued by your browser's notification service), the kind of browser, and when it was last used, together with the reminder times and businesses you chose. Turning reminders off, or signing out, removes this device. A device not used for 60 days is removed automatically, and deleting your account deletes your reminder settings.

A copy of the app for offline use

Your browser keeps a copy of the app's own files (the page, and help pages you have opened), so the app opens quickly and still opens with no signal. It holds no records.

Clearing your browser data, or the site's storage, removes all of these. Nothing is lost, because your records live in the database, not on your device.

9. How long we keep it

• Account and organisation data — for as long as the account exists.
• Manual backups — the five most recent per organisation. Older ones are deleted automatically. When an organisation is transferred to a new owner, the former owner's manual backups of it move with the organisation: the new owner can see them and the former owner cannot.
• Automatic backups — the ten most recent, plus the last backup of each of the last four weeks, of each of the last six months, and one backup per calendar year. The yearly copy is kept indefinitely so a business can recover an old year.
• Safety copies — before a restore, a copy of the business as it was is taken and kept under the owner's backups. The two most recent per organisation are kept; they do not count towards the five manual backups.
• Deleted backup files — when a backup is deleted (by you, by the limits above, or with an organisation or account), its file may persist for up to 7 days in Google's storage before it is finally erased. That short window exists only so a mistake in our own clean-up can be undone.
• Deleted organisations — hidden from everyone the moment they are deleted: managers lose access at once and automatic backups stop. The owner can restore the organisation from their own business list for 30 days. After 30 days a scheduled job deletes the organisation and its backups permanently. Deleting the owner's account deletes the organisations they own straight away, without waiting for the 30 days.
• Deleted accounts — removed immediately and unreachable from the app by anyone, including us. Copies persist for up to 8 weeks in the infrastructure backups that protect the whole service against data loss, and are then overwritten automatically. Those backups are never used for any purpose other than recovering the service.

10. Your rights

Under India's Digital Personal Data Protection Act, 2023, you may ask us to:

• Tell you what personal data we hold about you and who it has been shared with
• Correct or complete anything inaccurate
• Erase your data, where we are not required to keep it
• Withdraw your consent, which means closing your account
• Nominate someone to exercise these rights if you die or become incapacitated

You can delete your account and its data yourself at any time: see Delete your account. For anything else, write to roznamcha@asmlabs.in. We will reply within 30 days. If you are unhappy with our response, you may complain to the Data Protection Board of India.

Where the request concerns employee records, we will refer you to the business that entered them, since that business decides what happens to those records.

11. Security

• All traffic is encrypted in transit using HTTPS.
• Every read and write is checked against server-side rules, so one business cannot reach another business's data even if someone tampers with the app.
• Within a business, only the owner and the managers they add can sign in to it. Only the owner can change business-wide settings such as pay rules, add or remove managers, or change what a manager may do. A manager can change only what the owner has allowed: our servers check each manager's permissions before accepting a change to attendance, the working-day calendar, staff records, advances or salary payments, and check the team before accepting a change to a staff record. Reading is not limited by team. A manager who can sign in to a business can read that business's records, including pay, whether or not the app shows them on screen. Give managers only the permissions they need, and add only people you trust with the business's records. Staff do not sign in.
• The app carries a Content Security Policy, which limits what code a browser will run on the page.

No system is perfectly secure, and we will not claim otherwise. If we discover a breach affecting your data, we will inform you and the Data Protection Board as the law requires.

12. Children

This is business software and is not intended for anyone under 18. We do not knowingly create accounts for children. An employer is responsible for the lawfulness of any record it enters about a young worker.

13. Changes to this policy

If we change this policy we will update the date at the top, and for anything significant we will say so in the app or by email before it takes effect.