Privacy policy

This policy explains how personal data is handled in PunchMe, the attendance, leave and payroll software at punchme.online, company.punchme.online, api.punchme.online and the PunchMe mobile app.

PunchMe is a product of Hostspica, a sole proprietorship registered in India (GSTIN 09KGCPK3156D1ZE), U.G.F 02, Plot 11-12, FH Avantika 2, Ghaziabad, Uttar Pradesh 201002. In this policy, "we" and "us" mean Hostspica.

We follow the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology Act, 2000 with the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules).

Who is responsible for your data

PunchMe is used by companies (our "customers") to manage their employees. Who decides how your data is used depends on who you are.

If you are an employee, your employer decides what PunchMe features are switched on and what your data is used for. Please contact your employer's HR team first with any question or request about your data. We will help your employer respond, and we will pass on any request we receive directly.

Data we collect

Account holders and team members

• Name, work email, password (stored only as a salted PBKDF2 hash), optional phone number.
• Company name, address, state and GSTIN, and company settings.
• Roles, permissions and an audit log of actions taken in the dashboard.
• Login sessions, including IP address, browser or device details, and session tokens.

Employee data entered by employers

• Profile: name, work email, employee code, employment type, department, designation, shift, manager, offices, joining and leaving dates, work mode, and any other profile fields the employer or employee fills in.
• Attendance: check-in and check-out times, status, correction requests, leave applications and balances.
• Location at punch: GPS coordinates, reported accuracy, whether the phone reported a mock location, phone time and IP address, captured only when the employee checks in or out.
• Field tracking: if the employer turns it on for an employee and the employee accepts it in the app, the phone shares its location roughly every 5 minutes, only while the employee is checked in. A notification ("Sharing location while on duty") is shown while it runs, and it stops at check-out. Client visit notes and optional visit photos may also be recorded.
• Face templates: if the employer turns on face check, the app asks the employee for consent and computes a face template on the phone. A face template is a list of numbers (an embedding), not a picture. We do not upload or store face photos or selfies. Templates are stored encrypted on our servers and compared with a new template at each punch. Shared office kiosks also compute templates on the tablet to identify the employee.
• Device data: a random device identifier created when the app is installed, a public key used to verify punches (the private key stays on the phone), and push notification tokens.
• Device integrity: on Android, a Google Play Integrity verdict about whether the app and phone appear genuine.
• Documents and files: documents the employee or HR uploads, expense receipts, helpdesk attachments, letters, payslips and company letterhead.
• Payroll and identity: salary structure, payslips, loans and advances, expenses, statutory details, and bank account, PAN, UAN and ESI numbers. Bank, PAN, UAN and ESI details are stored encrypted.
• Other HR records the employer uses: onboarding and exit tasks, resignation requests, performance reviews and goals, polls, surveys and kudos, notices and helpdesk tickets.

Billing

• Wallet top-ups are paid through Razorpay. Razorpay collects your card, UPI or bank details directly; we do not receive or store full card numbers. We keep the Razorpay order and payment IDs, amounts, wallet history and the GST invoices we issue.

Website contact form

• Name, email, phone, company name, company size, your message and the page you sent it from. We store a one-way hash of your IP address to limit abuse.

Technical logs

• Our servers keep operational and error logs (for example, failed requests or email delivery errors) to run and secure the service. These may include email addresses, IP addresses and request details.

Why we use it

• To provide PunchMe: record attendance and leave, verify that a punch is genuine (signature, device integrity, face match, location and geofence checks), run payroll and produce reports and statutory files the customer asks for.
• To send sign-in codes, verification links, notifications and service emails, and push notifications to the app.
• To bill customers, issue GST invoices and keep tax and accounting records.
• To answer support requests and contact form enquiries.
• To keep the service secure, prevent fraud and abuse, and fix problems.
• To meet legal obligations.

We do not sell personal data, and we do not use employee data for advertising.

Legal basis and consent

• Employee data is processed on the employer's instructions. The employer is responsible for having a lawful basis under the DPDP Act and for giving employees notice. For employment purposes this is often a "legitimate use" under the Act; for face templates and field tracking, PunchMe also asks the employee for consent in the app before these start.
• Account, billing and contact form data is processed with your consent, which you give when you sign up, top up or contact us, and to meet our legal obligations (for example, GST records).
• You can withdraw consent at any time. For face check, ask your HR to reset your face data. For field tracking, ask your employer to turn it off for you. Withdrawing consent does not affect processing that happened before, and some features may stop working.

Who we share data with

We share data only with service providers that help us run PunchMe, and only as needed for that purpose.

We may also disclose data when required by law, a court order or a government authority, or to protect the rights and safety of our users or the public.

If a customer connects its own RazorpayX account for salary payouts, payout details are sent to RazorpayX on the customer's instructions under the customer's own agreement with Razorpay.

Where data is stored

PunchMe runs on Cloudflare's global infrastructure. Data may be stored or processed on servers outside India. Where it is transferred, we rely on our providers' security commitments, and we will follow any restrictions the Government of India notifies under the DPDP Act.

How long we keep it

When a customer closes its account, we delete its data on request, except records we must keep by law (for example, GST invoices and billing records). Face templates are deleted when HR resets them, and a device registration is removed when HR resets the device.

How we protect it

• All connections to PunchMe use HTTPS.
• Passwords are stored as salted PBKDF2 hashes.
• Face templates are encrypted with AES-256-GCM, and bank, PAN, UAN and ESI details are encrypted with AES-GCM, before they are stored.
• Each punch is signed by a key held in the phone's secure keystore and checked against a single-use challenge that expires after 60 seconds.
• On the phone, the sign-in token is encrypted with the Android Keystore, and offline punches are stored encrypted.
• Dashboard access is controlled by roles and permissions, and actions are recorded in an audit log.

No system is perfectly secure. If a personal data breach affects you, we will inform the affected customer, the Data Protection Board of India and affected people as the law requires.

Your rights

Under the DPDP Act you have the right to:

• get a summary of your personal data and how it is processed;
• correct, complete or update it;
• have it erased when it is no longer needed, unless the law requires us to keep it;
• withdraw consent;
• have your grievance addressed;
• nominate another person to exercise these rights if you die or become unable to.

Employees should send requests to their employer first. Account holders and others can email support@punchme.online. We may need to confirm your identity before acting on a request.

Children

PunchMe is a workplace tool. Account holders must be 18 or older. We do not knowingly collect children's data for our own purposes. Employers must not add anyone under 18 without meeting the DPDP Act's requirements for children's data, including verifiable parental consent.

Changes to this policy

We may update this policy as PunchMe changes. We will change the date at the top and, for significant changes, tell account holders by email or in the dashboard.

Contact

• Questions and requests: support@punchme.online
• Complaints: our Grievance Officer, Rohan Kumar, at grievance@punchme.online
• Post: Hostspica, U.G.F 02, Plot 11-12, FH Avantika 2, Ghaziabad, Uttar Pradesh 201002